WordPress released an emergency security patch on August 6, 2026, addressing a critical pre-authentication cross-site scripting (XSS) flaw that impacts every version of the platform. The vulnerability, discovered by pwn.ai, can be exploited to achieve PHP code execution when combined with specific attack conditions.

The security flaw affects WordPress installations across all versions. However, the patch has been backported only to version 4.7 and newer releases. Sites running older versions remain vulnerable but fall outside WordPress’s current support window.

Understanding the WordPress XSS Vulnerability

Tracked as CVE-2026-64638, the vulnerability carries a CVSS score of 8.9, placing it in the high-severity category. The flaw exists in WordPress’s login screen and requires no attacker privileges to exploit. According to pwn.ai, the initial XSS attack needs no authentication whatsoever.

The vulnerability works through a carefully crafted username submitted to the login page. When the login attempt fails, the malicious JavaScript executes automatically in the visitor’s browser. The attack functions against default WordPress installations without requiring unusual hosting configurations or custom plugins.

Researchers told The Hacker News that the exploit chain works reliably on standard WordPress deployments. The attack doesn’t depend on specific server configurations or third-party modifications to succeed.

From XSS to Code Execution: The Attack Chain

While the XSS itself requires no authentication, escalating to full code execution involves additional steps. The complete attack chain requires a logged-in administrator to interact with an attacker-controlled page. In pwn.ai’s proof-of-concept demonstration, this interaction amounts to a single click.

The researchers developed multiple paths from XSS to code execution. These variants include methods to install malicious plugins or upload arbitrary ZIP files. The team calls this attack sequence “XSS2Shell” and successfully demonstrated it against WordPress 7.0.2.

WordPress’s official security advisory takes a more measured stance on exploitability. The project notes that reaching remote code execution requires conditions outside direct attacker control. Successfully executing the full chain demands social engineering and explicit victim interaction.

Technical Details of the Exploit

The vulnerability originates in WordPress’s username processing during failed login attempts. The username value passes through sanitize_user() and wp_strip_all_tags() functions, which rely on PHP’s strip_tags() parser. A specially formatted string containing whitespace after the opening bracket can bypass this sanitization.

Subsequently, WordPress processes the value through wp_kses_post(), whose parser interprets the same input as permitted HTML. This creates attacker-controlled DOM elements on the failed-login page. These elements then interact with WordPress’s user-profile.js script, which loads on the login page for password reset functionality.

The exploit leverages missing input elements that resolve to undefined values. This allows equality checks to pass unexpectedly. Additionally, attackers can inject a DOM element to clobber the ajaxurl variable, redirecting WordPress’s JavaScript toward attacker-selected same-origin REST requests.

The Application Password Attack Vector

One exploitation path demonstrated by pwn.ai uses the XSS to trigger WordPress’s Application Password approval mechanism. This occurs within a logged-in administrator’s active session. WordPress then generates an API credential and redirects it to an attacker-controlled HTTPS URL.

Application Passwords serve as revocable credentials for API access. Therefore, this attack path doesn’t require stealing the administrator’s primary password. Researchers used the obtained credential for authenticated REST API access to publish a WordPress page containing malicious JavaScript.

When the administrator’s session opened that page, the embedded script obtained WordPress’s plugin-upload nonce. The script then uploaded an attacker-supplied ZIP file. The resulting PHP code could be executed directly from the extracted plugin without activation.

Real-World Testing and Proof of Concept

The pwn.ai team provided production evidence demonstrating the cookie-less login-page XSS. They successfully reproduced this vulnerability against two WordPress 7.0.2 installations using fresh Chrome browser profiles. These tests used no existing WordPress cookies or stored credentials.

However, the researchers did not attempt the complete attack chain on these production systems. They stopped at demonstrating the XSS vulnerability itself. The full PHP-execution sequence was separately validated on a clean local WordPress 7.0.2 installation under controlled conditions.

AI-Powered Vulnerability Discovery

Interestingly, pwn.ai’s autonomous security system discovered and reproduced this vulnerability chain independently. The system started with Paulos Yibelo’s 2022 Same Origin Method Execution (SOME) research as a foundation. Using open-source models and multi-agent workflows, the discovery process took nearly four days.

The team successfully reproduced the attack chain on July 26, 2026. They responsibly disclosed the vulnerability to WordPress the following day, allowing the project to develop and release patches quickly.

Patch Details and Affected Versions

WordPress released version 7.0.3 on August 6, 2026, containing the security fix. The patch was backported through the 4.7 branch, covering a wide range of WordPress installations. Sites with automatic background updates enabled should receive the security release without manual intervention.

WordPress strongly recommends immediate updates for all installations. Versions older than 4.7 remain vulnerable but fall outside the project’s current backport support range. Site administrators running these legacy versions face increased risk.

The researchers emphasized that standard WordPress hardening measures don’t fully mitigate the underlying XSS vulnerability. Applying the official security update remains the only complete solution. Relying on security plugins or WAF rules alone provides insufficient protection.

Potential Impact of Successful Exploitation

A successful PHP execution attack carries severe consequences. Attackers gain access to WordPress database credentials stored in wp-config.php. This enables persistent administrator account creation and unrestricted content modifications across the entire site.

Additionally, successful exploitation exposes all files and secrets readable by the PHP worker process. Attackers can execute operating-system commands with the privileges of that worker. This level of access typically allows complete site compromise and potential lateral movement within hosting environments.

WordPress credited the pwn.ai research team with discovering and responsibly disclosing the vulnerability. As of August 7, 2026, the project’s security advisory reports no evidence of active in-the-wild exploitation. However, public disclosure typically accelerates exploit development timelines.

Immediate Action Required

All WordPress site administrators should verify their installations have updated to the latest patched version. Sites running WordPress 7.x should confirm they’re on version 7.0.3 or newer. Older supported versions should reflect corresponding security patches.

Organizations using WordPress should review their update procedures to ensure timely application of security patches. Enabling automatic background updates provides the fastest protection against newly disclosed vulnerabilities. However, testing updates in staging environments before production deployment remains a best practice for business-critical sites.

The discovery highlights the ongoing importance of security research and responsible disclosure practices. The vulnerability’s complexity demonstrates how seemingly minor parsing differences can create exploitable security gaps. WordPress’s rapid response and comprehensive patching reflect the project’s commitment to platform security.

Original Source: thehackernews.com