---

📌 Overview

CVE-2026-64638 is a high-severity pre-authentication reflected Cross-Site Scripting (XSS) vulnerability affecting the WordPress login screen.

Under specific conditions, the flaw can be chained into Remote Code Execution (RCE) on the server (researchers call the chain XSS2Shell).

---

🔍 Technical Summary

The vulnerability exists in the way WordPress handles the username on a failed login attempt.

• Input passes through sanitize_user() and wp_strip_all_tags() (which relies on PHP’s strip_tags()).
• Later processing with wp_kses_post() allows certain tag-like payloads containing whitespace to survive and become live DOM elements.
• These elements interact with WordPress’s own JavaScript (user-profile.js) loaded on the login page.
• Attackers can leverage REST API / JSONP behavior and same-origin techniques to escalate further.

Full RCE path requires:

1. A victim already logged in as a single-site Administrator
2. Explicit interaction (typically one click) with an attacker-controlled page
3. Specific WordPress features aligned (Application Passwords, plugin upload capability, etc.)

⚠️ WordPress notes that successful escalation to RCE depends on conditions outside the attacker’s full control and requires social engineering.

---

📦 Affected & Patched Versions

• All versions from 4.7.0 through 7.0.2 are affected.
• Versions older than 4.7 remain vulnerable but fall outside current backport support.

---

✅ Mitigation & Recommendations

🚨 Update Immediately

• Upgrade to WordPress 7.0.3 (or the corresponding security release on your branch).
• Sites with automatic background updates enabled should receive the fix automatically.
• Do not rely solely on hardening plugins or CSP as complete mitigation — the core patch is required.
• Advise administrators to avoid clicking unsolicited links while logged into the WordPress dashboard.

---

📎 Official References

• GitHub Security Advisory
  GHSA-52p2-r8wf-jcrf

• WordPress 7.0.3 Release
  wordpress.org/news/2026/08/wordpress-7-0-3-release/

• Technical Analysis
  The Hacker News – New WordPress Pre-Auth XSS

---