Press play to start listening
WordPress has released security updates for a vulnerability that could turn a failed login attempt into cross-site scripting and, under additional conditions, PHP code execution on the server.
Discovered by the pwn.ai research team, the cross-site scripting flaw is tracked as CVE-2026-64638 and listed in GitHub’s Security Advisory database as GHSA-52p2-r8wf-jcrf. It has a CVSS 4.0 severity score of 8.9 out of 10.
According to the advisory, all WordPress versions are affected. WordPress 7.0.3 contains the correction, while updates were also released for older branches extending back to version 4.7.
How the XSS2Shell Attack Works
Pwn.ai named the vulnerability XSS2Shell because it provides a route from reflected XSS on the WordPress login screen to server-side code execution. An attacker does not need a WordPress account to trigger the initial flaw.
The first step involves submitting a specially prepared username during a failed login attempt at wp-login.php. WordPress includes part of that username in the resulting error page, where the browser can interpret the surviving input as HTML.
Behind the error is a disagreement between WordPress sanitization functions. Input that passes through wp_strip_all_tags(), which uses PHP’s strip_tags(), can later be reinterpreted by wp_kses_post() as permitted HTML.
In its technical report, pwn.ai explained that a carefully placed space after an opening angle bracket allowed malicious input to survive the first filter. The second filter then converted it into active page elements. The company estimated that more than 500 million websites were exposed before corrected releases became available.
The payload does not alter the WordPress user-profile.js file. It creates HTML elements that activate handlers already present in that script and uses DOM clobbering to supply an attacker-controlled value for the otherwise undefined ajaxurl variable.
“Pwn discovered a pre-auth XSS to RCE vulnerability chain affecting all versions of WordPress Core: the software that powers over 43% of all internet-facing websites. An estimated 500 million+ websites were vulnerable until today. We’re calling it XSS2Shell.”
Pwn.ai
Server Compromise Requires Administrator Interaction
Reaching PHP code execution requires more than sending a failed login request. The attacker must persuade a WordPress administrator who is already logged in to visit and interact with a malicious third-party website. The official advisory therefore classifies user interaction as active and attack complexity as high.
Building on Same Origin Method Execution research by Paulos Yibelo, pwn.ai demonstrated how an attacker-controlled page could abuse the administrator’s active session.
The attack chain causes the browser to approve a WordPress Application Password through wp-admin/authorize-application.php. This credential provides programmatic access similar to other API keys without revealing the administrator’s regular password.
After gaining that access, the attacker can publish JavaScript through the WordPress REST API, obtain a plugin-upload security nonce from the administrator’s session, and upload a ZIP archive containing malicious PHP code to wp-content/plugins/.
Pwn.ai demonstrated the final payload running as www-data, the web server account used in its test environment. This would compromise the WordPress installation, but it does not automatically provide root access to the underlying server.
WordPress Issues Updates
Pwn.ai said the flaw was found through its autonomous multi-agent system and that developing the complete exploit chain took nearly four days. The team reproduced the attack on July 26, 2026, and reported it to WordPress the following day with browser evidence and proof of PHP execution.
WordPress acknowledged the report on July 27. On August 6, pwn.ai said a bounty was paid, CVE-2026-64638 was assigned, and WordPress 7.0.3 was released. Pwn.ai published its technical findings on August 7.
Neither published disclosure identifies malicious exploitation of the flaw. Website owners should install WordPress 7.0.3 or the corrected maintenance release provided for their current branch and verify the installed version manually.
