Pre-Authentication reflected XSS vulnerability(CVE-2026-64638)
August 14th, 2026
High
Our Cyber Threat Intelligence Unit has identified a high-severity, pre-authentication cross-site scripting vulnerability in WordPress Core, tracked as CVE-2026-64638 and also tracked as XSS2Shell, that can be chained to full PHP code execution. The vulnerability exploits a parser mismatch between sanitize_user()/wp_strip_all_tags() and wp_kses_post() when WordPress echoes a failed-login username into an error message, requiring no attacker account. Chained against a logged-in administrator who is socially engineered into a single click on an attacker-controlled page, it can escalate to full PHP code execution. pwn.ai discovered the vulnerability, building on Paulos Yibelo's 2022 research; it reported it to WordPress in July 2026 and disclosed it publicly on August 7, 2026. WordPress addressed the vulnerability in version 7.0.3, released August 6, 2026 (GHSA-52p2-r8wf-jcrf), a security-only release fixing 12 vulnerabilities in total. The exploitable range for this specific CVE is WordPress 6.4 through 7.0.2; the fix was backported through the 4.7 branch, and versions older than 4.7 remain unsupported and should be upgraded regardless. As of August 7, 2026, there is no confirmed in-the-wild exploitation and the CVE does not appear in CISA's KEV catalog. However, a functional public proof-of-concept exploit tool covering the full XSS-to-RCE chain appeared on GitHub within roughly 24 hours of disclosure, along with detailed technical write-ups, meaningfully lowering the barrier to exploitation and elevating patch priority.
Technical Details
CVE ID: CVE-2026-64638 (GHSA-52p2-r8wf-jcrf).
Severity: High.
CVSS Score: 8.9
Vulnerability Type:Pre-authentication reflected cross-site scripting on the login screen, chainable to remote code execution.
Component Affected:WordPress Core.
Affected Versions:WordPress 6.4–7.0.2; escalation chain demonstrated on WordPress 7.0.2
Note:Exploit chain specifically targets 6.4–7.0.2, but safety patches were backported down to 4.7.
Fixed Version:WordPress 7.0.3 (one of 12 security fixes in this release); backported through the 4.7 branch.
Threat Actors:None identified; discovered and responsibly disclosed by research group pwn.ai
Attack Chain:
Initial Access: A single unauthenticated failed login with a crafted username delivers a reflected payload; no victim interaction required for the XSS itself.
Exploitation:Username value bypasses strip_tags()-based sanitization as inert text, then is re-parsed as live HTML by wp_kses_post(), producing attacker-controlled DOM elements that hijack the login page's own JavaScript.
Escalation to Code Execution: Requires a logged-in administrator to click an attacker-controlled page; injected script can trigger Application Password approval to mint a valid API credential, used to upload a plugin package and request PHP directly from the extracted files.
Post-Exploitation Impact: Exposure of database credentials in wp-config.php, persistent unauthorized administrator accounts, unauthorized content changes, exposure of files/secrets readable by the PHP worker, and operating-system command execution with the PHP worker's privileges.
Impact
Unauthenticated JavaScript execution in the WordPress origin against any unpatched, network-reachable login screen.
Exposure of database credentials and site secrets if the escalation path is completed.
Creation of persistent, unauthorized administrator accounts and unauthorized content changes.
Operating-system command execution with the privileges of the PHP worker process.
Broad exposure given WordPress's large installed base across the affected version range.
Detection Method
Alert on POST /wp-login.php requests where the log parameter contains a URL-encoded < (%3C) in any form; valid usernames never contain a bracket. Do not scope detection to a specific tag name or a space-only pattern — any KSES-allowlisted tag and whitespace character (space, tab, newline, carriage return) can be used.
Monitor for elevated-confidence variants of the same request that also carry _jsonp=, _method=GET, rest_route=, or _envelope=1 parameters
Monitor REST traffic to /?rest_route= or /wp-json/... carrying a _jsonp= callback containing a dot, indicating progression to the escalation stage.
Alert on requests to wp-admin/authorize-application.php carrying an off-origin success_url
Monitor for POST /wp-admin/update.php?action=upload-plugin followed shortly by a direct GET to a file under wp-content/plugins/<name>/
Review Application Password grants and administrator account lists for unrecognized entries.
Note that many WordPress deployments do not log login POST bodies by default; enable request-body logging on login and REST paths to make the above signatures usable.
Indicators of Compromise
There are no Indicators of Compromises observed.
Recommendations
Update all WordPress installations to version 7.0.3 or later immediately; this is a security release.
Confirm automatic background updates completed successfully where relied upon.
Migrate any instance running a version older than 4.7 to a supported, patched branch, as these remain outside the current backport range.
For instances that cannot be updated immediately, block POST requests to wp-login.php where the log parameter contains an encoded <, and flag REST requests whose _jsonp= callback contains a dot.
As a temporary compensating control only, consider disabling Application Passwords and enforcing DISALLOW_FILE_MODS (or equivalent hardening against PHP execution from inactive plugin directories); these reduce blast radius but do not remediate the underlying vulnerability.
Review existing Application Passwords and administrator accounts for unrecognized entries and revoke as needed.
Add or verify request-body logging on login and REST paths to support the detection methods above.
Regularly conduct security assessments and penetration testing to identify and remediate vulnerabilities across WordPress installations.
Treat patching as urgent given the availability of public, functional exploit code (not just theoretical write-ups) as of August 7, 2026.
Conclusion
CVE-2026-64638 (XSS2Shell) is a high-severity (CVSS 8.9), pre-authentication cross-site scripting vulnerability in WordPress Core that can chain to full PHP code execution when a logged-in administrator interacts with attacker-controlled content. It is one of 12 vulnerabilities addressed in the security-only WordPress 7.0.3 release of August 6, 2026. No in-the-wild exploitation is confirmed, but publicly available technical detail on the exploitation chain makes prompt patching a priority for unpatched, internet-facing installations.