WordPress Patches Pre-Auth XSS Vulnerability That Could Enable Server Takeover
A high-severity flaw in the WordPress login screen allows attackers to chain reflected XSS into remote PHP code execution.
WordPress has released a critical security update to address a pre-authentication reflected cross-site scripting (XSS) vulnerability that could allow attackers to execute arbitrary code on web servers. The flaw, tracked as CVE-2026-64638, affects the login screen—the most exposed portion of the CMS—and is accessible to any visitor without requiring valid credentials.
On August 6, 2026, WordPress deployed version 7.0.3 to patch a total of 12 security vulnerabilities. The most severe of these, CVE-2026-64638, carries a CVSS score of 8.9. The vulnerability was first identified and reported by the security team at pwn.ai. While the flaw begins as a reflected XSS on the login page, researchers demonstrated that it can be chained to achieve remote PHP code execution (RCE) on the server, provided a logged-in administrator interacts with a page controlled by the attacker.
The Context of the Patch
WordPress frequently issues security-only updates to harden its core against a variety of threats. The 7.0.3 release was specifically designed to resolve a cluster of issues, including server-side request forgery (SSRF), privilege escalation, and stored XSS. However, the pre-auth XSS on the login screen is particularly concerning because it targets the primary gateway of the installation. Unlike stored XSS, which requires a payload to be saved on the site, this reflected vulnerability allows an attacker to target users via a crafted link, making the login screen a high-reliability entry point for initial exploitation.
Why This Matters for Site Owners
The ability to escalate a simple XSS flaw into PHP code execution represents a worst-case scenario for website administrators. If an attacker successfully executes RCE, they can potentially gain full control over the web server, allowing them to steal sensitive database information, install backdoors for persistent access, or completely deface the website. Because the vulnerability is pre-authentication, the attack surface is universal across all WordPress installations that have not yet updated to the latest version, regardless of how strictly they have configured their internal user permissions.
What's Next for Administrators
Site owners are urged to update to WordPress 7.0.3 immediately to close this gap. Security professionals are continuing to monitor for active exploits in the wild, as the public disclosure of the patch often provides a roadmap for attackers to reverse-engineer the flaw. While the RCE chain requires administrator interaction, the severity of the potential outcome makes the update mandatory for maintaining server integrity. Administrators should also review their login security and consider implementing additional layers of protection, such as two-factor authentication, to mitigate the risk of administrative account compromise.