Critical Vulnerability Discovered in WordPress: Immediate Action Required
WordPress, the predominant content management system that underpins over 40% of global websites, has unveiled a significant security flaw.
If exploited, malicious actors could commandeer websites or execute arbitrary code on associated servers.
On August 6, the WordPress team released an emergency patch, urging all users to update to the latest version without delay.
This vulnerability, designated as CVE-2026-64638, is rated 8.9 out of 10 on the Common Vulnerability Scoring System (CVSS), categorizing it as “High.”
Notably, this issue resides within the core of WordPress itself, independent of any particular plugin or theme. An official communique details that all versions, including legacy iterations, are susceptible.
The flaw was discovered and reported by the cybersecurity firm pwn.ai. As outlined in technical correspondence shared with cybersecurity outlet The Hacker News, the root of the issue lies in a pre-authentication reflected cross-site scripting (XSS) vulnerability on the WordPress login interface.
Remarkably, this XSS can be initiated by dispatching a crafted request, circumventing the need for an attacker account or any victim involvement.
The mechanism behind the attack is related to how WordPress processes usernames during failed login attempts.
Although WordPress applies multiple sanitization filters, certain tag-like strings linger as text and are subsequently interpreted as valid HTML in following stages of processing.
This vulnerability permits an attacker to generate arbitrary DOM elements on the login failure page.
Moreover, the login page loads the user-profile.js JavaScript file, which is typically reserved for the administrative dashboard due to the password reset functionality.
Insights from pwn.ai suggest that by amalgamating the undefined behavior of nonexistent profile elements on the login page with variable overwriting via injected DOM elements, an attacker can redirect WordPress’s own scripts to execute same-origin REST API requests of their choosing. This attack sequence has been dubbed “XSS2Shell.”
Of greater concern is the potential for the XSS vulnerability to ultimately lead to the execution of PHP code on the server. pwn.ai showcased an exploit scenario where an administrator with single-site privileges is already logged in and performs a trivial action—like a click—on an assailant-prepared page.
This stratagem utilizes a technique termed “Same Origin Method Execution” (SOME), introduced in 2022 by security researcher Paulos Yibelo.
In the proof-of-concept demonstration, the attacker leveraged the logged-in administrator session to remotely access the authorization controls for the “Application Passwords” feature, first introduced in WordPress 5.6.
Consequently, this facilitated the creation of API authentication credentials without needing to seize the administrator’s master password, allowing redirection to a URL designated by the attacker. pwn.ai validated this entire chain: leveraging these credentials to publish a page with JavaScript, capturing a plugin upload nonce (a one-time token) when the administrator accesses that page, uploading an attacker-prepared ZIP file, and ultimately executing PHP code on the server.
A successful exploitation could unearth the content ofwp-config.php, which holds essential WordPress database connection credentials.
This breach could permit the persistent creation of administrator accounts, unauthorized content manipulation, data theft from files or secrets accessible to the PHP worker, and even execution of operating system commands with equivalent privileges.
In response to this pressing concern, WordPress has circulated patched versions, including WordPress 7.0.3, retrofitting fixes as far back as the 4.7 branch.
Websites equipped with automatic background updates may receive this security upgrade autonomously, though manual verification and updating are strongly advised.
It is crucial to note that versions prior to 4.6 remain vulnerable and are not encompassed within this patch release.
As of August 7, 2026, neither WordPress nor The Hacker News has documented any confirmed instances of this vulnerability being exploited in real-world cyberattacks.
Nonetheless, since pwn.ai has disclosed the specific attack methodology and proof-of-concept code, immediate remedial action is imperative.
While executing the attack chain that leads to PHP code execution necessitates multiple conditions—including the enabling of Application Passwords and an administrator initiating a click action—not all environments are at immediate risk of server compromise.
However, the core issue—the XSS vulnerability on the login page—does not require these additional prerequisites and is a concern for all versions of WordPress.
Temporarily disabling Application Passwords may offer a short-term mitigation by obstructing this specific escalation method; however, it does not rectify the foundational XSS vulnerability.
During its inquiry, pwn.ai reported that an autonomous system employing open-source models and multi-agent workflows successfully identified the vulnerability and reproduced the attack sequence within a span of approximately four days.
The reproduction was completed on July 26, with the issue reported to WordPress the very next day, July 27.
According to data from W3Techs, WordPress currently powers 41.2% of all websites, signifying its integral role in the digital realm.
Given its extensive reach, this vulnerability represents a significant concern that demands urgent attention from website administrators.
Source link: Finance.biggo.com.
