A newly disclosed CVE-2026-64638, a pre-authentication cross-site scripting flaw in WordPress Core’s login screen that can be chained into full server-side remote code execution, earning a CVSS score of 8.9 and the codename XSS2Shell.
PwnAI Research found that inserting a space between an opening angle bracket and a tag name (e.g., < area) causes PHP’s strip_tags() parser to treat the string as harmless text.
The bug begins on the ordinary login page. When a nonexistent username is submitted, WordPress builds an error message by passing the username through wp_strip_all_tags().
WordPress XSS2Shell Flaw
While WordPress’s separate KSES sanitizer later reinterprets the same string as legitimate HTML elements, smuggling live, attacker-controlled <area>, <div>, and <button> elements into the rendered page with no account required.
Those injected elements match selectors that WordPress’s own user-profile.js file automatically searches for on load a leftover from password-reset functionality.
This triggers an auto-click cascade into an AJAX request; via DOM clobbering, the attacker’s injected element hijacks the request’s destination.
Pointed at the WordPress REST API with method-override and JSONP parameters, the response returns wrapped in executable JavaScript, giving the attacker script execution inside the WordPress origin entirely pre-authenticated.
PWN.ai stated that, on its own, this is a serious reflected XSS. But escalating it to RCE requires a logged-in single-site Administrator to visit an attacker-controlled page and click once.
Building on a 2022 Same Origin Method Execution (SOME) technique published by researcher Paulos Yibelo, pwn.ai’s chain uses the admin’s session to mint a WordPress Application Password.
Publish a page containing attacker JavaScript via the admin’s unfiltered_html capability, and finally upload a plugin ZIP containing a PHP web shell all through legitimate, authenticated WordPress API calls.
WordPress’s own advisory frames this escalation path cautiously, noting it depends on “conditions outside the attacker’s control” and requires successful social engineering plus explicit victim interaction, which is why the CVE didn’t receive a maximum severity score.
Affected Versions
The fix, patched into wp-includes/user.php and wp-login.php, adds esc_html(), esc_url(), and esc_attr() calls to close the parser disagreement.
WordPress 7.0.3 also bundles 11 other security fixes, and these corrections have been carried over to the WordPress 7.1 RC2 branch.
Mitigation
Site owners should update to WordPress 7.0.3 immediately; installations with automatic background updates should already have received it, though self-hosted sites often need manual intervention.
Given the severity, administrators should also treat any unexpected Application Passwords or newly uploaded plugins as potential indicators of compromise, since a successful chain could expose database credentials in wp-config.php and permit operating-system commands under the web server’s privileges.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
