CVE-2026-64638: WordPress XSS2Shell flaw could lead to PHP code execution
- Evelyn Carter
- Aug 12
- 4 min read
WordPress released version 7.0.3 on August 6, 2026, to address CVE-2026-64638, a pre-authentication reflected XSS vulnerability affecting the login screen. Researchers at pwn.ai demonstrated that the flaw could be chained into XSS2Shell and ultimately lead to PHP code execution if a logged-in administrator interacts with an attacker-controlled page.
A vulnerability in wp-login.php can create a much broader security impact than a typical reflected XSS issue. In research published on August 6, 2026, pwn.ai showed that CVE-2026-64638 could allow attacker-controlled JavaScript to execute within the origin of a WordPress site without requiring an authenticated attacker account.
What happened with CVE-2026-64638 in WordPress?
CVE-2026-64638 is a pre-authentication reflected cross-site scripting vulnerability in WordPress Core. The issue affects the WordPress login screen, while pwn.ai refers to the broader exploit chain as XSS2Shell.
According to the technical analysis, when a non-existent username is submitted to wp-login.php, attacker-controlled input passes through multiple layers of HTML processing. Differences in how PHP strip_tags() and WordPress KSES interpret certain HTML strings can allow attacker-controlled DOM elements to appear on the login page.
These elements can then interact with JavaScript already loaded by WordPress. pwn.ai combined this behavior with DOM clobbering, the REST API and JSONP to achieve JavaScript execution within the WordPress origin without prior authentication.
Item | Confirmed status |
CVE | CVE-2026-64638 |
Vulnerability type | Pre-auth reflected XSS |
Component | WordPress Core login screen |
Reported CVSS score | 8.9 |
Main fixed release | WordPress 7.0.3 |
Patch release date | August 6, 2026 |
Potential PHP execution | Yes, through a chained exploit under additional conditions |
Confirmed in-the-wild exploitation | No confirmed evidence in the reviewed sources |
WordPress confirmed that version 7.0.3 includes a fix for the login-screen XSS issue and stated that the relevant security fixes were backported to eligible maintained branches, currently extending back to WordPress 4.7.
How can XSS2Shell progress from the login page to PHP code execution?
The exploit chain does not depend on a single request. Instead, pwn.ai combined several legitimate WordPress and browser behaviors to move from HTML injection to JavaScript execution and then abuse the privileges of a logged-in administrator.
At the first stage, attacker-controlled input submitted to the WordPress login page can survive one layer of processing because PHP and KSES interpret crafted HTML differently. The resulting DOM elements can trigger logic in user-profile.js, while DOM clobbering is used to influence an AJAX destination and REST JSONP is leveraged to execute JavaScript in the WordPress origin.
To advance toward PHP code execution, the research uses a technique known as Same Origin Method Execution (SOME). A logged-in administrator must visit and interact with an attacker-controlled page. From there, the chain can trigger privileged actions within the administrator’s session, create an Application Password, send privileged API requests and ultimately introduce PHP code onto the server.
Which WordPress versions are affected, and what is the business risk?
All maintained WordPress versions prior to 7.0.3 were within the affected range. WordPress subsequently backported the required fixes to branches eligible for security updates, currently extending back to version 4.7.
More than 500 million websites may have fallen within the potential exposure range and noted that WordPress powers more than 43% of Internet-facing websites. These figures should be treated as researcher estimates and ecosystem statistics, rather than a WordPress-published asset count for this specific CVE.
If the attack chain reaches PHP execution, the potential impact can extend well beyond website defacement. An attacker may be able to access sensitive information such as database credentials in wp-config.php, maintain administrative access, alter content, or read files and secrets available to the PHP process.
For Vietnamese organizations using WordPress for e-commerce, customer portals, campaign landing pages or corporate websites, the vulnerability reinforces the need to treat asset inventory and version management as part of application security governance.
👉 IPSIP Vietnam has also analyzed a critical WordPress plugin vulnerability that threatened a large number of websites, highlighting that WordPress security must cover both the Core platform and its plugin ecosystem.
What should organizations do immediately?
The first priority is to identify every WordPress site under organizational control and verify the actual software version, rather than assuming the hosting provider or automatic update mechanism has already applied the fix. WordPress recommends upgrading to version 7.0.3, while older supported branches should receive the corresponding backported security update.
Priority action checklist:
Inventory all websites, microsites, landing pages and portals running WordPress.
Verify the WordPress Core version on each system and confirm that the CVE-2026-64638 fix has been applied.
Prioritize Internet-facing sites and systems where Administrator accounts are used regularly.
Review privileged accounts, Application Passwords and unexpected permission changes.
Audit plugins, themes and custom code to avoid leaving other attack surfaces unaddressed after patching Core.
Review web server, WAF, reverse proxy and WordPress audit logs for suspicious activity involving wp-login.php, REST API access and privileged administrative actions.
Apply least privilege and avoid using Administrator accounts for routine tasks that do not require elevated permissions.
Conduct Vulnerability Assessment or Pentest activities on critical websites after patching to validate the resulting security posture.
What does the IPSIP Vietnam's expert perspective highlight?
Organizations with critical websites can use Pentest Service to validate exploitability within a defined scope, especially after major changes or when they need to verify whether existing controls truly interrupt the attack chain.
CVE-2026-64638 demonstrates how a browser-side XSS weakness in WordPress Core can become the foundation for a more complex attack chain when combined with browser behavior and Administrator privileges.
For Vietnamese organizations operating Internet-facing WordPress sites, the immediate priority is to verify patch status on every individual asset rather than assume a hosting provider or auto-update mechanism has already addressed the issue.
After patching, systems that process sensitive data or expose privileged administrative functions should undergo log review, vulnerability assessment and appropriate security testing to reduce the risk posed by other weaknesses on the same attack surface.
Reference
Comments