WordPress up to 7.0.2 Login Screen cross site scripting

Summaryinfo

A vulnerability marked as problematic has been reported in WordPress up to 7.0.2. This impacts an unknown function of the component Login Screen. This manipulation causes cross site scripting. This vulnerability is registered as CVE-2026-64638. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability classified as problematic was found in WordPress up to 7.0.2. Affected by this vulnerability is an unknown code of the component Login Screen. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).

It is possible to read the advisory at hackerone.com. This vulnerability is known as CVE-2026-64638 since 07/20/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/07/2026). The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

Upgrading to version 7.0.3 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• WordPress

Version

• 7.0.0
• 7.0.1
• 7.0.2

License

• open-source

Website

• Product: https://wordpress.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion