Critical WordPress XSS Flaw Exposes Sites to Remote Code Execution
A newly patched pre-authentication XSS vulnerability in WordPress could allow attackers to execute arbitrary PHP code. All versions of the CMS are affected, making immediate updates essential.
TL;DR
- WordPress released an emergency fix for CVE-2026-64638, a high-severity reflected XSS flaw.
- The vulnerability exists in the login screen and affects all WordPress versions.
- Attackers can chain this XSS into full PHP code execution if an admin visits a malicious page.
- The flaw carries a CVSS score of 8.9, indicating critical risk.
- Site administrators should update immediately to mitigate potential compromise.
WordPress has addressed a severe security vulnerability that could allow unauthenticated attackers to inject malicious scripts into the login page. The flaw, tracked as CVE-2026-64638, impacts every version of the popular content management system and poses a significant risk to millions of websites.
Security researchers at pwn.ai demonstrated that this reflected cross-site scripting (XSS) issue can be exploited to achieve remote PHP code execution. This escalation occurs when an authenticated administrator interacts with a page controlled by the attacker, potentially leading to full site compromise.
Vulnerability Details
- CVE-2026-64638 is a pre-authentication reflected XSS affecting WordPress login screens across all versions.
- The flaw allows attackers to inject malicious JavaScript without requiring user credentials.
- It carries a high CVSS severity score of 8.9 due to its potential impact and ease of exploitation.
- No authentication is needed to trigger the XSS, making it accessible to any remote attacker.
Exploitation Chain and Impact
- The XSS can be chained into PHP code execution when a logged-in administrator visits an attacker-controlled page.
- Successful exploitation grants attackers the ability to run arbitrary code on the server.
- This could result in complete site takeover, data theft, or further lateral movement within hosting environments.
- Sites remain vulnerable until updated, regardless of plugins or theme configurations.
Remediation Steps
- Immediately update WordPress core to the latest patched version available.
- Verify that automatic background updates have been applied if enabled.
- Review server logs for suspicious activity related to login page access patterns.
- Consider implementing additional web application firewall rules as temporary mitigation.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.