New Word Press Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP
Summary: WordPress patched a pre-authentication reflected XSS in its login screen, tracked as CVE-2026-64638 with a CVSS score of 8.9, affecting every version of the CMS; the fix shipped August 6 in WordPress 7.0.3 with backports through the 4.7 branch. Researchers at pwn.ai chained the flaw, which needs no attacker privileges, into PHP code execution when a logged-in administrator makes one ordinary click on an attacker-controlled page, and said their autonomous system reproduced the chain in nearly four days after being given Paulos Yibelo's 2022 Same Origin Method Execution research as a starting point.
Bottom line: The code-execution path does not need the administrator's password: it invokes WordPress's own Application Password approval control to mint an API credential, then uploads a ZIP and runs PHP from the extracted plugin without activating it. A successful execution exposes the database credentials in wp-config.php, and as of August 7 WordPress's advisory reports no in-the-wild exploitation.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2026-64638
- Related
- ⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors Cyber Risks ·US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026