This is a serious vulnerability affecting all supported WordPress versions. It can be exploited by any unauthenticated attacker, and a working proof of concept is available. However, to achieve remote code execution an attacker must trick a WordPress admin into opening a malicious link as part of a social engineering attack. This vulnerability is patched in WordPress 7.0.3 (released Aug 6, 2026).
AI description
Verified by IntruderAutomated description summarized from trusted sources.
CVE-2026-64638 is a pre-authentication reflected Cross-Site Scripting (XSS) vulnerability present in the login screen of all WordPress versions. This flaw allows for the execution of XSS without requiring attacker privileges or direct victim interaction once a specially crafted request is delivered. The vulnerability originates from how WordPress processes the username during a failed login attempt, specifically concerning the `sanitize_user()` and `wp_strip_all_tags()` functions, which can mishandle tag-like strings containing whitespace. Under specific circumstances, this XSS vulnerability can be escalated to achieve PHP code execution on the server. This escalation path is more involved, typically requiring a victim who is already logged in as a single-site Administrator to interact with an attacker-controlled page, alongside certain WordPress features and deployment conditions being met. WordPress addressed this issue in version 7.0.3, with fixes also backported to versions as far back as 4.7.
- Description
- WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).
- Source
- support@hackerone.com
- NVD status
- Awaiting Analysis
CVSS 4.0
- Type
- Secondary
- Base score
- 8.9
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- HIGH
- support@hackerone.com
- CWE-79
- Hype score
- Not currently trending
XSS2Shell CVE-2026-64638: Nuclei Template + Affected Versions - https://t.co/jsCQ2pJb2k #bugbounty #infosec #infosecurity #netsec #offsec #redteam #pentest #CVE #exploit https://t.co/9a7EYHmfFN
@xer0dayz
12 Sept 2026
228 Impressions
1 Retweet
1 Like
1 Bookmark
0 Replies
0 Quotes
XSS2Shell CVE-2026-64638: Nuclei Template + Affected Versions - https://t.co/tOyLS2fGvu #bugbounty #infosec #infosecurity #netsec #offsec #redteam #pentest #CVE #exploit https://t.co/F8UX9LZRjl
@Sn1perSecurity
30 Aug 2026
118 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
500M WordPress sites had pre-auth RCE in the login page. CVE-2026-64638: XSS → admin session → code execution. No account needed. Bug: strip_tags() and wp_kses_post() disagree on "safe" HTML. https://t.co/OfXFWPbNAz found it. Patched in 7.0.3. Unpatched = you're the PoC.
@fiona_novesai
22 Aug 2026
9 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
🕸️ WordPress CVE-2026-64638 취약점 분석 WordPress Core에서 인증 전 악용이 가능한 Reflected XSS 취약점 CVE-2026-64638이 공개됐습니다. 공격자가 관리자 사용자의 상호작용을 유도하면, Reflected XSS → 관리자 세션 악
@CriminalIP_KR
18 Aug 2026
43 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 CVE-of-the-Day: CVE-2026-64638 "XSS2Shell" — WordPress, pre-auth login XSS CVSS: 8.9 | EPSS: N/A (too new to be scored) Every WordPress version is affected. A crafted username on a failed login runs attacker JS on the login page — no account needed. #CVE #infosec #Wor
@YourDailyCVE
9 Aug 2026
15 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
XSS2Shell: WordPress Preauth XSS to RCE Chain (CVE-2026-64638) #bugbounty #bugbountytips #cve #rce https://t.co/Rndn0cf8RL
@zapstiko
9 Aug 2026
3004 Impressions
7 Retweets
44 Likes
28 Bookmarks
1 Reply
0 Quotes
🚨 CVE-2026-64638 - high 🚨 WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell) > Pre-authentication reflected XSS in WordPress wp-login.php (CVE-2026-64638). The flaw... 👾 https://t.co/WWNoJB1PYt @pdnuclei #NucleiTemplates #cve
@pdnuclei_bot
8 Aug 2026
717 Impressions
2 Retweets
18 Likes
9 Bookmarks
0 Replies
0 Quotes
🔸CVE-2026-64638 (XSS2Shell) بازم cve با high severity در وردپرس! از XSS تا RCE ! ورژنهایی که اسیبپذیر هستن توی عکس هستش: https://t.co/5vfOwVk089 جزییات: https://t.co/zQguAktjuu https://t.co/yAapWhGd5V
@maanimis
7 Aug 2026
1093 Impressions
0 Retweets
9 Likes
1 Bookmark
0 Replies
1 Quote
@ICTAuthorityKE. please patch our all websites that are running WordPress in the .go.ke new CVE in the fly XXS2SHELL CVE-2026-64638 it's time you guys move away from WordPress hire us we revamp the .go.ke sites that run WordPress with new frameworks like nestjs
@Cephas_PM
7 Aug 2026
40 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
WordPress 7.0.3 fixes CVE-2026-64638, a pre-auth XSS on the login screen that can escalate to remote code execution. CVSS 8.9. Update now. #WordPress #XSS #RCE #CVE #CyberSecurity https://t.co/OknmckKbQJ
@Daily_CyberSec
7 Aug 2026
321 Impressions
4 Retweets
6 Likes
2 Bookmarks
0 Replies
0 Quotes