In brief: An unpatched, pre-authentication exploitable XSS vulnerability in WordPress login (CVE-2026-64638, CVSS 8.9) can lead to PHP code execution on the server under additional conditions and affects all WordPress versions.
WordPress has closed a reflected XSS vulnerability in the login screen that can be exploited without authentication and affects all versions of the CMS. Under certain additional conditions, the flaw can be escalated to PHP code execution on the server.
The vulnerability is tracked as CVE-2026-64638 and rated with a CVSS score of 8.9 (High). It is a pre-authentication reflected cross-site scripting vulnerability in the WordPress login screen. Exploitation does not require prior login or authorization by the attacker, which significantly lowers the attack effort. According to the security platform pwn.ai, the flaw affects every version of the content management system software.
For a CISO, it is particularly relevant that the vulnerability goes beyond the pure XSS class: under additional conditions, the attack can be chained to achieve PHP code execution on the server. This raises the risk from client-side session or credential theft to a full compromise of the host, including database access, persistence and potential lateral spread to other systems in the same hosting environment. Since the login screen is publicly accessible, this affects virtually every exposed WordPress instance, regardless of plugin or theme configuration.
The original report does not yet provide further technical details on the exact additional conditions required to escalate to code execution. Companies operating WordPress should apply the provided patch promptly and additionally secure access to login endpoints via web application firewalls or rate limiting until the update has been fully rolled out.
Source: thehackernews.com · Published August 7, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.