Patch Released Immediately as Admins Urged to Update
A reflected cross‑site scripting flaw in WordPress’s login page can be leveraged by attackers to run arbitrary PHP code on a site when an administrator visits a malicious page. The issue, catalogued as CVE‑2026‑64638, has been patched by the core team.
WordPress, the world’s most widely used content‑management system, has released a security patch addressing a pre‑authentication reflected XSS vulnerability that appears in the login screen of every released version.
The flaw, identified as CVE‑2026‑64638, allows an attacker to inject malicious script into the login form’s query string. When an unauthenticated user loads the page, the script runs in the victim’s browser.
While reflected XSS is commonly limited to client‑side damage, the team discovered a chain that elevates the threat. An attacker can embed a payload that, once executed by a logged‑in administrator, triggers a PHP function that writes a file to the server.
The vulnerability is exploitable only when a site admin visits a specially crafted URL. The injected code can then call PHP functions that write to the filesystem, effectively granting the attacker code‑execution privileges on the server.
pwn.ai demonstrated the full attack flow by hosting a malicious page that, when visited by an administrator, caused the server to write a PHP script that was subsequently executed, demonstrating a full compromise.
The CVSS score for the vulnerability is 8.9, reflecting a high impact on confidentiality, integrity, and availability, especially given the privileged nature of the affected role.
The WordPress core team released the fix on 2026‑08‑10. The patch removes the vulnerable query‑string handling and sanitizes all inputs before rendering the login form.
Site owners are urged to update to the latest WordPress release immediately. Administrators should also review their user roles and consider disabling or limiting XSS‑sensitive endpoints until the patch is applied.
WordPress, the world’s most widely used content‑management system, has released a security patch addressing a pre‑authentication reflected XSS vulnerability that appears in the login screen of every released version.
The flaw, identified as CVE‑2026‑64638, allows an attacker to inject malicious script into the login form’s query string. When an unauthenticated user loads the page, the script runs in the victim’s browser.
While reflected XSS is commonly limited to client‑side damage, the team discovered a chain that elevates the threat. An attacker can embed a payload that, once executed by a logged‑in administrator, triggers a PHP function that writes a file to the server.
The vulnerability is exploitable only when a site admin visits a specially crafted URL. The injected code can then call PHP functions that write to the filesystem, effectively granting the attacker code‑execution privileges on the server.
pwn.ai demonstrated the full attack flow by hosting a malicious page that, when visited by an administrator, caused the server to write a PHP script that was subsequently executed, demonstrating a full compromise.
The CVSS score for the vulnerability is 8.9, reflecting a high impact on confidentiality, integrity, and availability, especially given the privileged nature of the affected role.
The WordPress core team released the fix on 2026‑08‑10. The patch removes the vulnerable query‑string handling and sanitizes all inputs before rendering the login form.
Site owners are urged to update to the latest WordPress release immediately. Administrators should also review their user roles and consider disabling or limiting XSS‑sensitive endpoints until the patch is applied.