CVE-2026-64638: WordPress Pre-Auth XSS Vulnerability

CVE-2026-64638 Overview

CVE-2026-64638 is a pre-authentication reflected cross-site scripting (XSS) vulnerability in the WordPress login screen. All versions of WordPress prior to 7.0.3 are affected. The flaw is categorized under CWE-79, Improper Neutralization of Input During Web Page Generation.

An attacker can craft a malicious third-party page that reflects script into the WordPress login response. Under specific conditions outside the attacker's control, this XSS can escalate to remote code execution (RCE). Exploitation requires social engineering and explicit victim interaction.

The issue was discovered and responsibly disclosed by the team at pwn.ai. A fix shipped in WordPress 7.0.3 and was backported to every supported branch down to 4.7.

Critical Impact
Successful exploitation executes attacker-controlled JavaScript in the victim's browser session against the WordPress login endpoint, with potential escalation to RCE when environmental conditions align.

Affected Products

WordPress core, all versions prior to 7.0.3
WordPress legacy branches back to 4.7 (fix backported)
Any site exposing the WordPress login screen (wp-login.php) to untrusted networks

Discovery Timeline

Vulnerability discovered and responsibly disclosed by the team at pwn.ai
2026-08-07 - CVE-2026-64638 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-64638

Vulnerability Analysis

The defect is a reflected XSS on the WordPress login page. User-controlled input reaches the rendered login response without adequate output encoding. Because the sink is on wp-login.php, no authentication is required to trigger the reflection.

The HackerOne report #3877102 describes an escalation path from XSS to RCE. The escalation is not universal. It depends on factors outside the attacker's control, and requires the victim to visit and interact with an attacker-hosted page. The WordPress 7.0.3 release announcement confirms the fix and backports.

Root Cause

The root cause is insufficient neutralization of input rendered in the login screen response. Reflected parameters are inserted into the HTML context in a form that permits script execution when a crafted payload is supplied by a third-party origin.

Attack Vector

The attack vector is network-based and user-interaction dependent. An attacker hosts a malicious page that directs the victim's browser to submit or navigate to a crafted request against the target WordPress instance's login endpoint. The reflected payload executes in the victim's browser under the WordPress site's origin. When escalation conditions are present, the attacker chains the XSS into code execution on the WordPress backend.

No verified public exploit code is available. The vulnerability is described in prose only; refer to the vendor advisory and HackerOne report for technical details.

Detection Methods for CVE-2026-64638

Indicators of Compromise

Requests to wp-login.php containing suspicious query parameters with HTML or JavaScript tokens such as <script, onerror=, onload=, or javascript:.
HTTP Referer headers pointing to unfamiliar third-party domains preceding login-page hits.
Unexpected administrative actions, plugin installs, or file writes shortly after a login-page reflection event.

Detection Strategies

Inspect web server and WAF logs for reflected payloads targeting wp-login.php query strings and POST bodies.
Correlate login-page requests with subsequent authenticated administrative actions from the same session or IP.
Enable and review Content Security Policy (CSP) violation reports for inline script execution on login pages.

Monitoring Recommendations

Alert on WordPress core version fingerprints below 7.0.3 across the estate.
Monitor filesystem changes under wp-content/, especially additions to plugins/, mu-plugins/, and themes/ directories.
Track outbound network connections from PHP worker processes to unusual destinations that may indicate post-exploitation callbacks.

How to Mitigate CVE-2026-64638

Immediate Actions Required

Upgrade WordPress core to 7.0.3 or apply the backported patch for your branch down to 4.7.
Restrict access to wp-login.php and /wp-admin/ by IP allow-list or an authenticated reverse proxy where feasible.
Force password rotation and invalidate active sessions for administrator accounts if exploitation is suspected.
Audit wp-content/ for unauthorized plugins, themes, or PHP files added after the vulnerability disclosure window.

Patch Information

WordPress released version 7.0.3 containing the fix. The patch was backported to all supported branches down to 4.7. See the WordPress 7.0.3 Release Announcement for release notes and upgrade instructions. Additional technical detail is available in HackerOne Report #3877102.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks reflected script payloads targeting wp-login.php parameters.
Enforce a strict Content Security Policy on WordPress responses to prevent inline script execution.
Require multi-factor authentication for all administrator accounts to limit the impact of session compromise.
Educate administrators to avoid clicking login-related links from untrusted sources until patching is complete.

bash

# Verify installed WordPress core version using WP-CLI
wp core version

# Upgrade WordPress core to the fixed release
wp core update --version=7.0.3 --force
wp core update-db

# Confirm the running version post-upgrade
wp core version