This is a serious vulnerability affecting all supported WordPress versions. It can be exploited by any unauthenticated attacker, and a working proof of concept is available. However, to achieve remote code execution an attacker must trick a WordPress admin into opening a malicious link as part of a social engineering attack. Intruder expects a full exploit to become widely available. This vulnerability is patched in WordPress 7.0.3 (released Aug 6, 2026).
AI description
Verified by IntruderAutomated description summarized from trusted sources.
CVE-2026-64638 is a pre-authentication reflected Cross-Site Scripting (XSS) vulnerability present in the login screen of all WordPress versions. This flaw allows for the execution of XSS without requiring attacker privileges or direct victim interaction once a specially crafted request is delivered. The vulnerability originates from how WordPress processes the username during a failed login attempt, specifically concerning the `sanitize_user()` and `wp_strip_all_tags()` functions, which can mishandle tag-like strings containing whitespace. Under specific circumstances, this XSS vulnerability can be escalated to achieve PHP code execution on the server. This escalation path is more involved, typically requiring a victim who is already logged in as a single-site Administrator to interact with an attacker-controlled page, alongside certain WordPress features and deployment conditions being met. WordPress addressed this issue in version 7.0.3, with fixes also backported to versions as far back as 4.7.
- Description
- WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).
- Source
- support@hackerone.com
- NVD status
- Received
CVSS 4.0
- Type
- Secondary
- Base score
- 8.9
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- HIGH
- support@hackerone.com
- CWE-79
- Hype score
- Not currently trending
🚨 CVE-2026-64638 - high 🚨 WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell) > Pre-authentication reflected XSS in WordPress wp-login.php (CVE-2026-64638). The flaw... 👾 https://t.co/WWNoJB1PYt @pdnuclei #NucleiTemplates #cve
@pdnuclei_bot
8 Aug 2026
479 Impressions
2 Retweets
14 Likes
8 Bookmarks
0 Replies
0 Quotes
🔸CVE-2026-64638 (XSS2Shell) بازم cve با high severity در وردپرس! از XSS تا RCE ! ورژنهایی که اسیبپذیر هستن توی عکس هستش: https://t.co/5vfOwVk089 جزییات: https://t.co/zQguAktjuu https://t.co/yAapWhGd5V
@maanimis
7 Aug 2026
1093 Impressions
0 Retweets
9 Likes
1 Bookmark
0 Replies
1 Quote
@ICTAuthorityKE. please patch our all websites that are running WordPress in the .go.ke new CVE in the fly XXS2SHELL CVE-2026-64638 it's time you guys move away from WordPress hire us we revamp the .go.ke sites that run WordPress with new frameworks like nestjs
@Cephas_PM
7 Aug 2026
40 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
WordPress 7.0.3 fixes CVE-2026-64638, a pre-auth XSS on the login screen that can escalate to remote code execution. CVSS 8.9. Update now. #WordPress #XSS #RCE #CVE #CyberSecurity https://t.co/OknmckKbQJ
@Daily_CyberSec
7 Aug 2026
321 Impressions
4 Retweets
6 Likes
2 Bookmarks
0 Replies
0 Quotes