Critical WordPress XSS Vulnerability Enables Code Execution Attacks

Your WordPress site needs an urgent update right now. Regarding WordPress XSS vulnerability, A newly discovered security flaw could let attackers take complete control of your website, even if they never log in.

WordPress released a critical security patch on August 6 that fixes a pre-authentication cross-site scripting (XSS) vulnerability affecting every version of the platform. The issue, tracked as CVE-2026-64638, carries a CVSS score of 8.9 out of 10. That puts it firmly in the high-severity category.

Here is what makes this vulnerability particularly concerning for your site. Attackers do not need an account on your WordPress installation to exploit the initial flaw. The vulnerability sits right on your login page, where anyone can reach it.

How This Vulnerability Actually Works

Security researchers at pwn.ai discovered the flaw and shared the technical details exclusively with The Hacker News. The attack starts with a carefully crafted username submitted to your login page. When WordPress displays the failed login error, malicious JavaScript code executes automatically in the visitor’s browser.

That sounds bad enough on its own. However, the researchers demonstrated something worse: they can chain this XSS vulnerability into full PHP code execution on your server. The catch is that an administrator needs to be logged in and must click on a single attacker-controlled link.

According to pwn.ai, this works on default WordPress installations. You do not need unusual hosting configurations or special plugins installed. Your standard WordPress site is vulnerable right out of the box.

The Path from XSS to Complete Server Control

The researchers call their attack chain “XSS2Shell.” Their autonomous system discovered and reproduced the vulnerability after nearly four days of work using open-source models and multi-agent workflows. They found the flaw on July 26 and reported it to WordPress the very next day.

The technical details reveal why this is so dangerous. WordPress handles failed login usernames through several sanitization functions: sanitize_user(), wp_strip_all_tags(), and wp_kses_post(). These functions rely on different HTML parsers that disagree about what counts as a tag.

A carefully crafted string with whitespace after the opening angle bracket can slip through one parser as plain text. Then the second parser interprets that same input as legitimate HTML. This parser confusion creates live DOM elements under the attacker’s control.

Exploiting WordPress’s Own JavaScript

Those injected elements interact with user-profile.js, a WordPress script that handles profile management. This script also loads on the login page because WordPress uses the same page for password resets. Missing form inputs create undefined variables, allowing attackers to hijack WordPress’s own JavaScript functionality.

The researchers discovered multiple paths from XSS to code execution. One demonstrated path abuses WordPress’s Application Password feature, which creates revocable API credentials. The attack tricks WordPress into generating an API credential and sending it to an attacker-controlled URL.

With that credential, attackers gain authenticated REST API access. They use this access to publish a WordPress page containing malicious JavaScript. When an administrator views that page, the script grabs WordPress’s plugin-upload security token and uploads a ZIP file containing PHP code.

The plugin does not even need activation. Attackers can request the PHP file directly and execute arbitrary code on your server.

What Successful Attacks Mean for Your Site

If attackers achieve PHP code execution on your WordPress installation, they gain access to everything. They can read your wp-config.php file, which contains your database credentials. They can create permanent administrator accounts. They can modify any content on your site.

Additionally, attackers can access any files readable by your web server’s PHP process. That includes potentially sensitive business information, customer data, or API keys stored in configuration files. They can execute operating system commands with whatever privileges your PHP worker has.

WordPress itself takes a more cautious view of the exploitability. Their official advisory notes that escalation to remote code execution requires conditions outside the attacker’s direct control. Successful exploitation needs social engineering plus explicit victim interaction. Nevertheless, the path exists and has been demonstrated.

The Fix and What You Need to Do

WordPress patched the vulnerability in version 7.0.3, released on August 6. The security team backported fixes all the way through the 4.7 branch. If you run an older version, you need to update immediately.

Sites with automatic background updates enabled should receive the security release automatically. However, you should verify that the update actually installed. Log into your WordPress dashboard and check your version number under Dashboard > Updates.

Versions older than 4.7 remain affected but fall outside WordPress’s current backport support range. If you are running WordPress 4.6 or earlier, you have a bigger problem than just this vulnerability. Those versions have not received security updates in years.

The researchers emphasized that known WordPress hardening measures should not be treated as complete mitigation for this XSS vulnerability. Even if you run security plugins or have implemented Content Security Policy headers, you still need to apply the official security update.

No Known Attacks Yet

As of August 7, WordPress’s security advisory reports no in-the-wild exploitation of this vulnerability. That is good news, but it does not mean you should wait to update. Public disclosure of technical details typically accelerates exploit development.

WordPress credited the pwn.ai team with discovering and responsibly disclosing the vulnerability. The researchers provided production evidence of the login-page XSS against two fresh WordPress 7.0.2 installations. They demonstrated the complete PHP execution chain separately on a clean local installation.

Your Next Steps

Check your WordPress version right now. If you are not running 7.0.3 or newer (or the latest version in your branch if you are on an older major release), update immediately. This is not something you can safely postpone until your next maintenance window.

If you manage multiple WordPress sites, prioritize updating them today. The vulnerability affects every version of WordPress, so every site needs attention. If you have a care plan or managed WordPress hosting, verify with your provider that they have applied the security update.

For business owners who do not manage their own WordPress updates, contact your developer or hosting provider today. Ask them to confirm your site has been patched against CVE-2026-64638. Your website’s security depends on it.

Original Source: thehackernews.com