Executive Summary
A critical vulnerability has been identified in WordPress—specifically, a pre-authentication reflected Cross-Site Scripting (XSS) flaw tracked as CVE-2026-64638. This vulnerability, present in all WordPress versions up to 7.0.2, enables unauthenticated attackers to inject and execute JavaScript on the login page. When combined with social engineering, this XSS can escalate to remote PHP code execution (RCE), potentially resulting in full compromise of the affected site. Immediate patching to WordPress 7.0.3 or the latest available security release is strongly advised. While public technical details and proof-of-concept code are available, there is currently no confirmed exploitation in the wild, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Technical Information
CVE-2026-64638 is a pre-auth reflected XSS vulnerability that can be leveraged to achieve PHP code execution on WordPress servers. The flaw arises from improper sanitization of the username field on failed login attempts. Attackers can craft a username containing a < character followed by whitespace, which bypasses the sanitize_user() and wp_strip_all_tags() functions due to the behavior of PHP's strip_tags(). The input is then processed by wp_kses_post(), which interprets it as permitted HTML, resulting in attacker-controlled DOM elements being rendered on the login error page.
The attack chain, dubbed XSS2Shell, proceeds as follows: The attacker injects malicious JavaScript via the login page. The page loads user-profile.js for password resets, and the attacker can manipulate missing elements and the undefined ajaxurl variable through the injected DOM. This enables the execution of attacker-controlled JavaScript, which can make same-origin REST API requests.
If a logged-in administrator visits a malicious page, the XSS can be used to exploit the WordPress REST JSONP endpoint, execute JavaScript in the site's origin, and leverage the Application Password approval flow to create a new API credential. With this credential, the attacker can publish a page containing further malicious JavaScript, obtain a plugin-upload nonce, and upload a ZIP file containing a PHP webshell or backdoor. The PHP file can be executed directly, even if the plugin is not activated.
The impact of successful exploitation is severe: Attackers can gain full control over the WordPress site, extract database credentials from wp-config.php, create persistent admin users, modify site content, exfiltrate files and secrets, and execute arbitrary OS commands with the privileges of the PHP worker process.
Exploitation in the Wild
As of August 7, 2026, there are no confirmed reports of in-the-wild exploitation of CVE-2026-64638. However, public technical details and proof-of-concept exploits are available from sources such as pwn.ai and The Hacker News, significantly increasing the risk of imminent exploitation. The attack does not require authentication for the initial XSS, but escalation to RCE depends on social engineering—specifically, tricking a logged-in administrator into visiting a malicious page. No sector, country, or organization-specific targeting has been observed, and no ransomware or criminal campaigns have been attributed to this vulnerability.
Threat Actor Profile
There is currently no evidence that any Advanced Persistent Threat (APT) groups or criminal threat actors are exploiting CVE-2026-64638. Open sources, including MITRE and major threat intelligence platforms, have not reported any targeted campaigns or group attributions related to this vulnerability as of the time of writing.
Technical Analysis of Malware/TTPs
All versions of WordPress prior to 7.0.3 are affected by CVE-2026-64638. This includes all major and minor releases from the initial release up to and including 7.0.2. The patch has been backported to the 4.7 branch and later, but older versions (4.6 and below) are no longer supported and remain vulnerable. The fixed version is WordPress 7.0.3 and corresponding backported security releases for supported branches.
Exploitation in the Wild
As of August 7, 2026, there are no confirmed reports of in-the-wild exploitation of CVE-2026-64638. However, public technical details and proof-of-concept exploits are available from sources such as pwn.ai and The Hacker News, significantly increasing the risk of imminent exploitation. The attack does not require authentication for the initial XSS, but escalation to RCE depends on social engineering—specifically, tricking a logged-in administrator into visiting a malicious page. No sector, country, or organization-specific targeting has been observed, and no ransomware or criminal campaigns have been attributed to this vulnerability.
Victimology and Targeting
There is currently no evidence that any Advanced Persistent Threat (APT) groups or criminal threat actors are exploiting CVE-2026-64638. Open sources, including MITRE and major threat intelligence platforms, have not reported any targeted campaigns or group attributions related to this vulnerability as of the time of writing.
Mitigation and Countermeasures
The most effective mitigation is to upgrade immediately to WordPress 7.0.3 or the latest available security release. Ensure that automatic background updates are enabled to receive future patches promptly. Administrators should monitor logs for suspicious login attempts, unexpected Application Password creation, and unauthorized plugin uploads. Restrict admin access to trusted networks and educate administrators about the risks of social engineering and phishing. Review all custom plugins and themes to ensure they do not bypass WordPress sanitization routines.
References
The Hacker News: New WordPress Pre-Auth XSS Could Lead to PHP Code Execution, KSEC Community Forum, Reddit: r/SecOpsDaily, LinkedIn: a cyber security professional, WordPress Security Advisory, pwn.ai Research, MITRE ATT&CK Framework
About Rescana
Rescana provides a comprehensive Third-Party Risk Management (TPRM) platform, empowering organizations to continuously monitor, assess, and mitigate cyber risks across their digital supply chain. Our platform delivers actionable intelligence and automated workflows to help you stay ahead of emerging threats. We are happy to answer any questions at info@rescana.com.
