---

📌 Overview

CVE-2026-64638 is a high-severity pre-authentication reflected Cross-Site Scripting (XSS) vulnerability affecting the WordPress login screen.

Under specific conditions, the flaw can be chained into Remote Code Execution (RCE) on the server (researchers call the chain XSS2Shell).

Attribute	Details
CVE ID	CVE-2026-64638
Severity	High (CVSS 8.9)
Attack Vector	Network
Privileges Required	None
User Interaction	Required (for full RCE chain)
Impact	Confidentiality • Integrity • Availability

---

🔍 Technical Summary

The vulnerability exists in the way WordPress handles the username on a failed login attempt.

• Input passes through sanitize_user() and wp_strip_all_tags() (which relies on PHP’s strip_tags()).
• Later processing with wp_kses_post() allows certain tag-like payloads containing whitespace to survive and become live DOM elements.
• These elements interact with WordPress’s own JavaScript (user-profile.js) loaded on the login page.
• Attackers can leverage REST API / JSONP behavior and same-origin techniques to escalate further.

Full RCE path requires:

1. A victim already logged in as a single-site Administrator
2. Explicit interaction (typically one click) with an attacker-controlled page
3. Specific WordPress features aligned (Application Passwords, plugin upload capability, etc.)

⚠️ WordPress notes that successful escalation to RCE depends on conditions outside the attacker’s full control and requires social engineering.

---

📦 Affected & Patched Versions

Branch	Affected Versions	Patched Version
7.0.x	7.0.0 – 7.0.2	7.0.3
6.9.x	6.9.0 – 6.9.5	6.9.6
6.8.x	6.8.0 – 6.8.6	6.8.7
…	…	…
4.7.x	4.7.0 – 4.7.33	4.7.34

• All versions from 4.7.0 through 7.0.2 are affected.
• Versions older than 4.7 remain vulnerable but fall outside current backport support.

---

✅ Mitigation & Recommendations

🚨 Update Immediately

• Upgrade to WordPress 7.0.3 (or the corresponding security release on your branch).
• Sites with automatic background updates enabled should receive the fix automatically.
• Do not rely solely on hardening plugins or CSP as complete mitigation — the core patch is required.
• Advise administrators to avoid clicking unsolicited links while logged into the WordPress dashboard.

---

📎 Official References

• GitHub Security Advisory
  GHSA-52p2-r8wf-jcrf

• WordPress 7.0.3 Release
  wordpress.org/news/2026/08/wordpress-7-0-3-release/

• Technical Analysis
  The Hacker News – New WordPress Pre-Auth XSS

---