Researchers Detail WordPress Login XSS Chain to PHP Execution
Summary
WordPress patched CVE-2026-64638, a pre-auth reflected XSS in its login screen. pwn[.]ai demonstrated a chain to PHP execution, but it requires an administrator to interact with an attacker-controlled page; WordPress says escalation depends on social engineering.
Key points
- CVE-2026-64638 is a pre-authentication reflected XSS in the WordPress login screen; the article gives it a CVSS score of 8.9.
- Researchers traced the flaw to inconsistent handling of failed-login usernames, which can leave attacker-controlled elements in the page's DOM.
- The demonstrated chain uses WordPress JavaScript behavior and REST JSONP to execute JavaScript in the site's origin.
- The PHP-execution path requires an administrator session and explicit interaction with an attacker-controlled page; WordPress says successful escalation also depends on social engineering.
- Researchers reproduced the XSS on two WordPress 7.0.2 deployments, but did not attempt the escalation there. They demonstrated the complete PHP-execution chain separately on a clean local 7.0.2 installation.
- WordPress patched the flaw in 7.0.3 on August 6 and backported fixes through the 4.7 branch. Older versions remain affected but are outside the stated backport range.
- As of August 7, WordPress's advisory did not report in-the-wild exploitation; the project recommends applying the update.
Article Details
- Attack Vectors
- An attacker supplies a crafted username that triggers reflected XSS on the WordPress failed-login page.
- To continue from XSS to PHP execution, the attacker must socially engineer a logged-in Administrator into interacting with an attacker-controlled page.
- The demonstrated chain uses WordPress REST JSONP behavior and an Application Password to publish same-origin JavaScript, then uploads an attacker-supplied ZIP as a plugin.
- Defensive Notes
- Update to WordPress 7.0.3 or an applicable backported security release; fixes extend through the 4.7 branch.
- WordPress sites with automatic background updates should receive the security release automatically.
- Versions older than 4.7 remain affected but are outside the project’s current backport range.
- The researchers said known hardening measures do not fully mitigate the underlying XSS; applying the security update is required.
MITRE ATT&CK
T1059.007 · JavaScriptInjected JavaScript executes in the WordPress site’s origin through the reflected XSS and the demonstrated REST JSONP path.T1105 · Ingress Tool TransferThe demonstrated chain uploads an attacker-supplied ZIP to WordPress as a plugin.T1190 · Exploit Public-Facing ApplicationThe attack begins by exploiting a reflected XSS flaw in the publicly accessible WordPress login screen.T1204.001 · Malicious LinkThe XSS-to-PHP chain requires a logged-in Administrator to click and interact with an attacker-controlled page.