New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP
WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. The flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with …
Intelligence analysis by Llama
A high-severity vulnerability in WordPress's login screen can be chained into PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page. The issue was patched on August 6 in WordPress 7.0.3, with fixes backported through the 4.7 branch.
Imagine you're trying to log in to a website, but you accidentally type in a special code that makes the website do something it's not supposed to do. This special code can make the website do something bad, like let someone else control it. WordPress fixed this problem, but it's essential to update the website to prevent this from happening again.
Analysis
Vulnerability Overview
The vulnerability, tracked as CVE-2026-64638 (CVSS score: 8.9), is a pre-authentication reflected cross-site scripting (XSS) flaw in WordPress's login screen. It affects every version of the content management system and requires no attacker privileges. The flaw starts in the way WordPress handles the username from a failed login, which passes through sanitize_user() and wp_strip_all_tags(). A tag-like string containing whitespace after the opening < can survive that parser as text, and later, WordPress passes the value through wp_kses_post(), whose separate parser interprets the same input as permitted HTML. The result is attacker-controlled live DOM elements on the failed-login page.
Attack Chain
The attack chain, dubbed XSS2Shell, starts with the login-page XSS. Once a crafted username reaches the failed-login error page, the resulting JavaScript executes in the visitor's browser with no further interaction required on that page. The code-execution path requires a victim already logged in as an Administrator and explicit interaction with an attacker-controlled page. In pwn.ai's demonstration, that interaction is one ordinary click. The researchers told The Hacker News that the attack works against default WordPress installations and does not require unusual hosting or deployment settings.
Patch and Mitigation
The issue was patched on August 6 in WordPress 7.0.3, with fixes backported through the 4.7 branch. WordPress recommends updating immediately, and sites that support automatic background updates should receive the security release automatically. Versions older than 4.7 remain affected but fall outside the project's current backport range. The researchers, who call the attack chain XSS2Shell, said its autonomous system discovered and reproduced the vulnerability chain after being given Paulos Yibelo's 2022 Same Origin Method Execution (SOME) research as a starting point. The company said the work took nearly four days using open-source models and a multi-agent workflow. It said the chain was reproduced on July 26 and reported to WordPress the following day.
Key points
- WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen.
- The flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page.
- The issue was patched on August 6 in WordPress 7.0.3, with fixes backported through the 4.7 branch.
- WordPress recommends updating immediately, and sites that support automatic background updates should receive the security release automatically.
If this vulnerability is patched effectively, it could lead to improved security measures being implemented in WordPress, making it more difficult for attackers to exploit similar vulnerabilities in the future.
If the patch is not implemented correctly or if the vulnerability is not fully understood, it could lead to further exploitation of the vulnerability, potentially resulting in significant security breaches.
