WordPress patches pre-authentication XSS tracked as CVE-2026-64638
WordPress has released version 7.0.3 to fix CVE-2026-64638, a high-severity pre-authentication reflected cross-site scripting flaw in its login screen. Rated 8.9 under CVSS, the vulnerability affects every version of the content management system. Fixes were issued on August 6 and backported through the WordPress 4.7 branch.
The underlying XSS requires no attacker privileges. pwn.ai, which discovered and responsibly disclosed the issue, said a crafted request can trigger execution without an account or additional victim interaction after delivery. WordPress recommends immediate updates; installations that permit automatic background updates should receive the security release automatically.
How the login-page flaw works
The issue begins with a username supplied after a failed login attempt. pwn.ai said the value passes through sanitize_user() and wp_strip_all_tags(), which relies on PHP's strip_tags(). A tag-like input with whitespace after the opening angle bracket can survive this stage as text, but a later pass through wp_kses_post() interprets it as allowed HTML.
That parser mismatch can create attacker-controlled DOM elements on the failed-login page. The elements interact with WordPress's user-profile.js, which is loaded there for password-reset handling. Researchers found that missing profile inputs can satisfy an equality check, while an injected element can clobber the otherwise undefined ajaxurl variable and redirect WordPress JavaScript to an attacker-selected same-origin REST request.
Escalation requires additional conditions
pwn.ai used WordPress REST JSONP support to turn that request into JavaScript running in the site's origin. Where anonymous REST requests return HTTP 401, the _envelope=1 parameter can wrap the denial in an outer HTTP 200 response that jQuery continues to process as script. The researchers said a nonce-based Content Security Policy using strict-dynamic did not stop their demonstrated path.
The path to PHP execution is not automatic. It requires a logged-in Administrator on a single-site deployment to click an attacker-controlled page, plus Application Passwords, the usual unfiltered_html and upload_plugins capabilities, writable plugin storage, and no hardening that blocks file changes or direct PHP execution in inactive plugin directories. This builds on the WordPress core risk outlined in WordPress core risk outlined in this analysis while showing how particular browser and deployment conditions can extend an XSS impact.
In the demonstration, the XSS invoked the Application Password approval control in the Administrator's session, obtained an API credential, and used authenticated REST access to publish a page with same-origin JavaScript. That script acquired a plugin-upload nonce, uploaded a ZIP, and enabled direct requests to PHP in the extracted plugin without activating it.
pwn.ai reproduced the cookie-less login-page XSS on two WordPress 7.0.2 deployments, but did not attempt the escalation steps on those systems. The full PHP-execution chain was demonstrated separately on a clean local 7.0.2 installation. Organizations should update to 7.0.3 or the applicable supported backport, identify installations below 4.7 that remain affected, and review Application Password, plugin-upload, and PHP execution controls.