thehackernews.com
Aug 7, 2026
New WordPress Pre-Auth XSS Could Lead to PHP Code Execution – Patch ASAP
AI-summarised brief · reviewed before publication
WordPress patched a pre‑authentication reflected XSS flaw (CVE‑2026‑64638, CVSS 8.9) that allows attackers to inject JavaScript into the failed‑login page. pwn.ai demonstrated that a logged‑in administrator who clicks an attacker‑controlled link can trigger PHP code execution on the server, enabling plugin installation or arbitrary ZIP uploads. The vulnerability exists in all WordPress versions, was fixed on August 6 in 7.0.3 and backported to 4.7, and requires no special hosting or privileges.
💡 Why It Matters
- · The flaw shows how a seemingly benign XSS can be chained into full server compromise, underscoring the need for immediate patching and vigilant monitoring of admin interactions.
