WordPress has patched a critical pre-authentication cross-site scripting vulnerability that affects every version of the content management system and can be chained into full server-side code execution. The flaw, tracked as CVE-2026-64638 with a CVSS score of 8.9, was fixed on August 6 in WordPress 7.0.3 with backports through the 4.7 branch.
The vulnerability was discovered by pwn.ai, whose autonomous security research system identified and reproduced the attack chain without human intervention. The exploit begins at the WordPress login screen, where a crafted username containing a tag-like string survives the site’s sanitization pipeline. The resulting malicious HTML executes as JavaScript in the browser of any visitor who reaches the failed-login error page.
The attack chain, dubbed XSS2Shell, escalates from reflected XSS to PHP code execution through several steps. A logged-in administrator must interact with an attacker-controlled page with a single click, which triggers WordPress’s own profile management script to issue a same-origin REST API request. The researchers used WordPress’s JSONP support to turn that request into executable JavaScript running in the site’s administrative context.
From there, the exploit leverages WordPress’s Application Password feature to create an API credential without needing the administrator’s primary password. That credential is used to upload a malicious plugin ZIP file through WordPress’s authenticated REST interface. The plugin does not even need to be activated for the attacker to execute arbitrary PHP code on the server.
WordPress’s own security advisory takes a more cautious stance on the exploitability of the full chain, noting that escalation to code execution requires conditions outside the attacker’s control and successful social engineering. However, the pwn.ai team demonstrated the vulnerability on default WordPress installations without any unusual hosting configuration, and said it found multiple independent paths from XSS to code execution.
A successful code execution would expose database credentials stored in wp-config.php, allow persistent administrator account creation, enable content manipulation, and grant access to any files readable by the PHP worker process. The researchers emphasized that known WordPress hardening measures should not be treated as a substitute for applying the security update.
WordPress site administrators should update to version 7.0.3 immediately. Sites configured for automatic background updates should receive the security release automatically. Versions older than 4.7 remain affected but fall outside the project’s current backport range. As of August 7, WordPress reports no evidence of in-the-wild exploitation.
The discovery is notable because pwn.ai’s autonomous system identified the vulnerability chain after being given prior research on Same Origin Method Execution techniques as a starting point. The company said the work took nearly four days using open-source models and a multi-agent workflow, with the vulnerability chain first reproduced on July 26.
Sources: The Hacker News, pwn.ai, WordPress Security Advisory
discussion