WordPress has patched a high-severity cross-site scripting vulnerability on its login page that requires no authentication to trigger — and that security researchers have chained into full PHP code execution on the server with a single click from a logged-in administrator. Tracked as CVE-2026-64638 with a CVSS score of 8.9, the flaw was discovered by researchers at pwn.ai, who named the attack chain “XSS2Shell” and reported it responsibly to the WordPress project.
The vulnerability lives in how WordPress processes a failed login: a crafted username value can survive the sanitize_user() and wp_strip_all_tags() functions and later be interpreted as live HTML by wp_kses_post(), landing attacker-controlled DOM elements on the login error page. Those elements interact with WordPress’s own user-profile.js script — also loaded on the login page for password resets — to steer WordPress’s own JavaScript toward an attacker-selected same-origin REST request. From there, pwn.ai demonstrated a path that uses the WordPress Application Password API to create a revocable credential, which is then used to upload a plugin ZIP containing arbitrary PHP. The resulting PHP could then be executed directly from the extracted plugin without activation. WordPress’s own advisory notes that the full code-execution path requires social engineering a logged-in administrator to interact with an attacker-controlled page, which limits opportunistic mass exploitation.
How to check if you’re affected
Affected versions include all WordPress installations running versions before 7.0.3, specifically any release going back to version 4.7. Sites on versions older than 4.7 fall outside WordPress’s current backport range and remain affected. Sites that have automatic background updates enabled should already have received the WordPress 7.0.3 security release. To confirm, go to your WordPress admin dashboard → Dashboard → Updates and verify the installed version is 7.0.3 or later. No in-the-wild exploitation of CVE-2026-64638 has been reported as of August 7.