WordPress Pre-Auth XSS Flaw CVE-2026-64638 Could Lead to PHP Code Execution

WordPress has released a critical security update to address a pre-authentication reflected cross-site scripting (XSS) vulnerability that affects all versions of the content management system. Tracked as CVE-2026-64638 with a CVSS score of 8.9, the flaw can be chained to achieve PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page.

Discovered by the security firm pwn.ai, the vulnerability resides in the WordPress login screen. An attacker can craft a malicious username that, when submitted, bypasses sanitization and results in arbitrary JavaScript execution in the visitor’s browser without requiring authentication. The researchers demonstrated that the XSS can be escalated to full PHP code execution through multiple attack paths, including installing a malicious plugin or uploading an arbitrary ZIP file.

The attack chain, dubbed XSS2Shell, leverages a Same Origin Method Execution (SOME) technique originally researched by Paulos Yibelo in 2022. pwn.ai’s autonomous system reproduced the vulnerability chain in nearly four days using open-source models and a multi-agent workflow. The flaw was reported to WordPress on July 27 and patched on August 6 in WordPress 7.0.3, with backports available for versions 4.7 and later.

WordPress’s advisory notes that escalation to remote code execution requires social engineering and explicit victim interaction, but the researchers caution that hardening measures alone are insufficient. Successful exploitation could expose database credentials, allow persistent administrator creation, and permit operating-system commands with the web server’s privileges. As of August 7, no in-the-wild exploitation has been reported, but immediate updating is strongly recommended.