WordPress login screen pre-auth reflected XSS (CVE-2026-64638)
Vulnerability
Summary
Hide ▲
Show ▼
WordPress patched CVE-2026-64638, a pre-auth reflected XSS in the login screen that affects every version of the CMS. The flaw can be chained under additional conditions into PHP code execution, but the advisory reports no in-the-wild exploitation. WordPress fixed it in 7.0.3 and backported the patch through the 4.7 branch.
Timeline
-
07.08.2026 03:00 1 articles · 17h ago
WordPress ships 7.0.3 to fix CVE-2026-64638
Mitigation Patch UpdateWordPress fixed CVE-2026-64638, a pre-authentication reflected XSS in the login screen that affects every version of the CMS, in WordPress 7.0.3 and backported the fix through the 4.7 branch. WordPress recommends immediate updating, and the advisory does not report in-the-wild exploitation as of August 7, 2026.
Show sources
- New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP — thehackernews.com — 07.08.2026 15:56
-
27.07.2026 03:00 2 articles · 11d ago
pwn.ai reproduces and reports the WordPress login-page XSS chain
Initial Disclosurepwn.ai's autonomous system reproduced the WordPress login-page reflected XSS chain after using Paulos Yibelo's 2022 Same Origin Method Execution (SOME) research as a starting point, then reported the result to WordPress the next day.
Show sources
- New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP — thehackernews.com — 07.08.2026 15:56
- New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP — thehackernews.com — 07.08.2026 15:56