WordPress Hit by High-Severity XSS Flaw That Can Unlock Full Server Control — Patch Now

A critical pre-authentication vulnerability in WordPress's login screen allows attackers to execute PHP code on affected servers with no prior credentials required. The flaw was patched on August 6 in WordPress 7.0.3.

The stakes could not be higher for the estimated hundreds of millions of websites running on WordPress. Cybersecurity firm pwn.ai discovered and responsibly disclosed the vulnerability — tracked as CVE-2026-64638 with a CVSS score of 8.9 — demonstrating a full attack chain from a simple login-page exploit to complete server compromise. Site owners who delay updating are leaving an unlocked door wide open.

---

What the Vulnerability Does and Who Is at Risk

The flaw lives in WordPress's login screen and requires zero attacker privileges to trigger. Researchers at pwn.ai dubbed their attack chain "XSS2Shell" and confirmed it works against default WordPress installations without unusual hosting or deployment configurations. Understanding the full scope of this threat is essential for anyone responsible for maintaining a WordPress site — and broader awareness of why cybersecurity matters for every website owner has never been more relevant.

Once a crafted username reaches the failed-login error page, the resulting JavaScript executes directly in the visitor's browser. No further interaction is needed on that page. The researchers independently reproduced the cookie-less login-page XSS against two separate WordPress 7.0.2 deployments using fresh Chrome profiles with no existing WordPress cookies or credentials.

The complete PHP-execution chain requires one additional condition: a victim who is already logged in as an Administrator must interact with an attacker-controlled page. In pwn.ai's demonstration, that interaction amounted to a single ordinary click — the kind anyone might make without suspicion.

WordPress's own advisory takes a more cautious position. The project notes that escalation to remote code execution involves conditions outside the attacker's direct control and requires successful social engineering alongside explicit victim interaction. Even so, the platform is urging all users to update immediately.

Why Default Installations Are Exposed

It is worth emphasising that no unusual server configuration or non-standard deployment is required for this vulnerability to be exploitable. A freshly installed, default WordPress 7.0.2 site is sufficient. This is not a niche edge-case scenario — it is a mainstream risk affecting the platform in its most common form.

---

How the Attack Chain Works

The technical root of the problem lies in how WordPress processes a username submitted during a failed login attempt. The value passes through two sanitization functions — sanitize_user() and wp_strip_all_tags() — which rely on PHP's native strip_tags(). A tag-like string containing whitespace after the opening < character can survive that parser as plain text rather than being stripped.

WordPress then passes the same value through wp_kses_post(), whose separate parser interprets the identical input as permitted HTML. The result is attacker-controlled live DOM elements appearing on the failed-login page — elements that should never exist there.

The Parser Inconsistency at the Core of the Flaw

Those injected elements interact with user-profile.js, a WordPress profile-management script that also loads on the login page because that page handles password resets. Two inputs the script expects are absent on the login page and resolve to undefined. An otherwise undefined ajaxurl variable can then be overwritten with an injected DOM element. That manipulation steers WordPress's own JavaScript toward an attacker-selected same-origin REST request.

The researchers use WordPress's built-in REST JSONP support to convert that request into JavaScript executing within the site's own origin. For deployments where anonymous REST requests return HTTP 401, the _envelope=1 parameter wraps the rejection inside an HTTP 200 response — allowing jQuery to continue processing the payload as executable script. The researchers also noted that a nonce-based Content Security Policy using strict-dynamic did not block the demonstrated path — a detail that should give pause to administrators who rely on CSP hardening as a meaningful line of defence.

Why Existing Hardening Measures Fall Short

This is a critical point that warrants explicit attention: known WordPress hardening measures should not be treated as a complete mitigation for the underlying XSS flaw. Disabling REST API access for anonymous users, implementing Content Security Policies, and restricting Application Passwords are all sound practices — but none of them individually, nor in common combination, were shown to prevent the demonstrated attack chain. For a comprehensive overview of the layered defences that genuinely protect a WordPress environment, this detailed guide to WordPress website security covers the full range of protective measures site owners should have in place.

---

From Stolen Credentials to Full Server Access

The path from XSS to PHP execution builds on earlier Same Origin Method Execution research published by Paulos Yibelo in 2022. One attack path demonstrated by pwn.ai uses the WordPress-origin XSS to invoke the native Application Password approval interface inside a logged-in Administrator's active session. WordPress then generates an API credential and redirects it to an attacker-selected HTTPS success URL.

Because Application Passwords are revocable API credentials rather than primary login passwords, the attack does not need to steal the administrator's main password directly. The researchers used the newly created credential to publish a WordPress page containing same-origin JavaScript. When the retained administrator session opened that page, the script obtained WordPress's plugin-upload nonce and uploaded an attacker-supplied ZIP archive. PHP could then be accessed directly from the extracted plugin — and the plugin did not even need to be activated.

What a Successful Compromise Exposes

A successful PHP execution would result in a significant and wide-ranging breach. Specifically, it would:

• Expose WordPress database credentials stored in wp-config.php
• Allow persistent administrator account creation and content modification
• Expose files and secrets readable by the PHP worker process
• Permit operating-system commands running under that worker's privileges

The breadth of what becomes accessible following a single successful chain underscores how consequential this vulnerability is in practice — not merely in theory. This is precisely the kind of multi-stage, chained exploit that highlights the importance of robust application-level website security practices across all platforms, not just WordPress.

How the Vulnerability Was Discovered

The researchers said pwn.ai's autonomous system discovered and reproduced the vulnerability chain in nearly four days using open-source models and a multi-agent workflow. The chain was reproduced on July 26 and reported to WordPress the following day. This timeline is notable: the speed with which AI-assisted security research can now identify and validate complex, multi-step vulnerability chains is accelerating — and that same capability is available to threat actors as much as to defenders.

Current Patch Status and Exposure Window

As of August 7, WordPress's advisory reports no confirmed in-the-wild exploitation. The issue was patched on August 6 in WordPress 7.0.3, with fixes backported through the 4.7 branch. Sites supporting automatic background updates should receive the security release automatically. Versions older than 4.7 remain affected but fall outside the project's current backport range — meaning operators of legacy installations must take manual action and should consider this an urgent priority.

WordPress credited the team at pwn.ai with discovering and responsibly disclosing the vulnerability and recommends that site owners apply the update without delay.

How to Act on This Information

• Update immediately. Log into your WordPress dashboard and confirm you are running version 7.0.3 or later. If automatic updates are disabled, enable them now for security releases.
• Audit administrator accounts. Review all existing Application Passwords and administrator accounts for unauthorized additions that could indicate earlier compromise.
• Brief your team. Administrators should be trained to avoid clicking links from unknown sources while logged into WordPress — the final step in this chain requires that one click.

For further technical context on this class of vulnerability, the OWASP Cross-Site Scripting Prevention Cheat Sheet provides detailed guidance on how XSS flaws arise and how they can be mitigated at the application level.