Urgent Security Alert: WordPress CVE-2026-64638 WordPress, the world’s most popular Content Management System (CMS), has recently patched a critical pre-authentication reflected Cross-Site Scripting (XSS) vulnerability that impacts every prior version of the platform. Tracked as CVE-2026-64638 and carrying a high-severity CVSS score of 8.9, this flaw exists on the default WordPress login screen. Discovered by cybersecurity firm pwn.ai, the vulnerability requires zero prior authentication or privileges to trigger, and under specific conditions, can be chained by hackers to achieve full remote PHP code execution (RCE) on the host server.

Understanding the Login Screen Vulnerability The root cause of the vulnerability lies in how WordPress processes usernames during a failed login attempt. When a maliciously crafted username is submitted, it passes through sanitize_user() and a tag-stripping function. However, threat actors found that a tag-like string containing specific whitespace can survive this initial parsing. When WordPress later processes this input through wp_kses_post()—a function designed to permit certain HTML—the malicious input is rendered as live, attacker-controlled DOM elements directly on the failed-login error page.

Escalating XSS to Remote Code Execution While the XSS itself is pre-authenticated, escalating the attack to remote code execution requires a victim who is already logged in as a WordPress Administrator to interact with an attacker-controlled page (often requiring just a single click). Leveraging a technique related to Same Origin Method Execution (SOME), the attacker’s injected DOM elements manipulate the user-profile.js script loaded on the login page. By clobbering undefined variables, the attacker forces the site to execute a same-origin REST request, transforming it into malicious JavaScript executing within the site’s origin.

The Application Password Attack Chain The researchers at pwn.ai demonstrated a devastating attack chain using this flaw. The unauthorized JavaScript silently invokes the native Application Password approval control within the Administrator’s session, generating a new API credential sent to the attacker’s server. Using this credential, the attacker can authenticate via the REST API, publish a hidden WordPress page containing further malicious scripts, and upload a weaponized ZIP file or plugin. This ultimately grants the attacker the ability to execute arbitrary PHP commands, exposing database credentials in wp-config.php and allowing full server takeover.

AI-Driven Discovery and Immediate Mitigation Fascinatingly, this vulnerability was discovered in just four days by pwn.ai using an autonomous multi-agent AI workflow, highlighting how artificial intelligence is accelerating both vulnerability discovery and potential exploitation. WordPress has addressed the issue in version 7.0.3, with security fixes backported to the 4.7 branch. Website administrators are strongly urged to ensure their CMS is updated immediately. Relying solely on standard Web Application Firewalls (WAF) or nonce-based Content Security Policies may not be sufficient to block this highly sophisticated attack chain.