CVE-2026-64638 in WordPress
Summary
by MITRE • 08/07/2026
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim.
This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.
Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/07/2026
WordPress contains a pre-authentication reflected cross-site scripting vulnerability on its login screen that represents a significant security risk for all versions of the platform. This vulnerability allows attackers to inject malicious scripts into the login page through crafted URLs that are reflected back to users without proper input sanitization or output encoding. The flaw occurs when user-supplied input is directly included in HTTP responses without adequate validation or escaping mechanisms, creating an opening for malicious actors to execute arbitrary JavaScript code within the context of a victim's browser session.
The technical exploitation of this vulnerability requires attackers to craft malicious URLs that contain XSS payloads and deliver them through social engineering campaigns via compromised websites or phishing attacks. When victims navigate to these malicious pages and subsequently attempt to log into WordPress, their browsers will execute the injected scripts as part of the reflected response. This vulnerability maps directly to CWE-79 which defines cross-site scripting flaws where untrusted data is improperly incorporated into web page content without appropriate sanitization or encoding. The attack vector operates entirely within the browser context and can be categorized under ATT&CK technique T1566 for initial access through social engineering.
The operational impact of this vulnerability extends beyond simple XSS execution, as it can potentially be escalated to remote code execution under specific conditions that require victim interaction with attacker-controlled content. This escalation pathway depends on successful social engineering campaigns where users are convinced to click malicious links or visit compromised websites, making the attack chain more complex but still achievable in real-world scenarios. The vulnerability affects all WordPress installations regardless of version, though patches have been released in version 7.0.3 and backported to all supported branches starting from version 4.7.
The security implications are substantial as reflected XSS vulnerabilities can be leveraged for session hijacking, credential theft, and data exfiltration operations. Attackers could potentially steal user sessions, redirect victims to malicious sites, or inject additional malicious payloads that persist in the victim's browser context. The vulnerability demonstrates the critical importance of proper input validation and output encoding in web applications, particularly on authentication pages where attackers can manipulate the user experience and potentially gain unauthorized access to user accounts. Organizations should immediately apply the available patches and consider implementing additional security measures such as content security policies and web application firewalls to mitigate potential exploitation attempts.
The responsible disclosure by pwn.ai highlights the importance of coordinated vulnerability disclosure in maintaining web security standards and ensuring that developers have adequate time to implement proper fixes before public disclosure occurs. This vulnerability serves as a reminder of the ongoing need for robust security testing practices, including automated scanning tools and manual penetration testing, particularly on authentication mechanisms where user interaction is required for successful exploitation. The widespread impact across all WordPress versions emphasizes the critical nature of maintaining up-to-date software installations and implementing comprehensive security monitoring strategies to detect potential exploitation attempts.