Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.
← back | CVE Intelligence

CVE-2026-64638 [High]

Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-64638.

Vendor
WordPress
Product
WordPress Core
Affected versions
Maintained WordPress versions before 7.0.3; fix backported to maintained branches back to 4.7
CVSS
8.9
Coverage Span
2026-08-07
Reports
1 related reports

Associated Reports & Timeline

1.
XSS2Shell: WordPress pre-auth XSS to RCE chain (CVE-2026-64638)
pwn.ai | vulnerability | High | | original ↗ | #ai-security | #rce | #public-poc | #featured
The research team disclosed XSS2Shell, a pre-auth reflected XSS in the WordPress login screen that can be escalated to remote code execution when the required user interaction and deployment conditions are met. The issue affects maintained WordPress Core versions; WordPress 7.0.3 fixes it and the fix was backported to maintained branches back to 4.7. The linked research includes technical details and a public PoC.
Why it matters: WordPress powers a large share of internet-facing sites. The pre-auth login-screen XSS can execute JavaScript in the site origin after victim interaction and, under the documented conditions, be chained into impact on administrator sessions and the server. Upgrade to WordPress 7.0.3 or the corresponding patched maintenance branch, then review login activity, administrator sessions, and unexpected plugins or file changes. The current CVE record assigns CVSS 4.0 8.9 (High) and requires active user interaction; no active-exploitation signal is currently recorded.