vulnerability
New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP
High
Summary
A high-severity cross-site scripting (XSS) vulnerability in WordPress's login screen allows attackers to execute PHP code on a server, potentially leading to database compromise and full system control. The vulnerability, tracked as CVE-2026-64638, can be exploited without requiring an account or additional interaction, and has been patched in version 7.0.3. The vulnerability stems from how WordPress handles usernames during failed logins and leverages a chain of vulnerabilities to achieve code execution.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data