WordPress 7.0.3 Fixes Login XSS That Can Lead to RCE via Social…

CVE-2026-64638 is a pre-authentication reflected XSS in the WordPress login screen, discovered by pwn.ai using AI-assisted systems. Exploitation requires an authenticated administrator to interact with attacker-controlled content through social engineering, enabling PHP code execution on the server.

Source limitation statement: This article is based primarily on The Hacker News as the primary structured source. No vendor WordPress advisory with a directly verifiable URL is available.

CVE-2026-64638 is a pre-authentication reflected XSS vulnerability in the WordPress login screen, with a CVSS score of 8.9 (high severity). The demonstrated attack chain requires an already-authenticated administrator to interact with attacker-controlled content through social engineering to achieve PHP code execution on the server. The flaw was discovered by the pwn.ai team using open-source models and a multi-agent workflow with human input, which reproduced the full attack chain in approximately four days starting from Paulos Yibelo's 2022 academic research. WordPress released the patch on August 6, 2026, with version 7.0.3, including extensive backports to the 4.7 branch.

Key Takeaways

CVE-2026-64638 is a pre-authentication reflected XSS in the WordPress login screen, with CVSS 8.9 (high severity).
Escalation to RCE always requires social engineering and explicit interaction by an already-authenticated administrator; it is not a direct exploit.
The demonstrated chain exploits an inconsistency between two WordPress parsers to inject JavaScript, then manipulates REST requests to upload a ZIP plugin containing PHP.
pwn.ai discovered and reproduced the vulnerability in approximately four days using AI-assisted systems with human input, reporting it to WordPress on July 27, 2026.
Patch 7.0.3 is available as of August 6, 2026, with backports to the 4.7 branch; versions prior to 4.7 no longer receive security updates.

The Bypass Born from Two Parsers Reading the Same String Differently

The injection mechanism hinges on a parsing discrepancy between two WordPress sanitization functions. When a user submits incorrect credentials, the username field value first passes through wp_strip_all_tags(), which internally calls the PHP strip_tags() function. This interprets a string containing "<" followed by whitespace as harmless text, allowing it to pass. WordPress then applies wp_kses_post(), whose separate parser reads the same string as permitted HTML, exposing the error page to JavaScript injection.

Once injected, the payload interacts with user-profile.js, an internal script loaded on the login page. WordPress JavaScript depends on the ajaxurl variable, normally undefined in that context. The attacker-injected DOM element overwrites this variable, diverting REST requests to an attacker-controlled but same-origin endpoint. For configurations where anonymous REST requests return HTTP 401, researchers used the _envelope=1 parameter, which wraps the rejection in an outer HTTP 200 response, allowing jQuery to process it as a script.

From Admin Click to PHP Execution: The Demonstrated RCE Chain

The escalation phase to remote code execution relies on the SOME (Same Origin Method Execution) technique developed by researcher Paulos Yibelo in 2022. Through the injected JavaScript, the attacker invokes WordPress's native Application Password approval check. The system creates valid API credentials, which are immediately used for authenticated REST access.

With these credentials, the attacker publishes a WordPress page containing further JavaScript, obtains the nonce for plugin upload, and uploads a ZIP archive. The PHP contained in the archive can be requested directly from the extracted files, without needing to activate the plugin through the administrative interface. This path was successfully reproduced on a clean WordPress 7.0.2 installation, not on wordpress.com hosted systems, which researchers explicitly excluded from the test scope.

According to The Hacker News, researchers mentioned alternative RCE variants not detailed publicly. Per the same source, a more restrictive assessment considers RCE escalation subordinate to conditions outside the attacker's control and requiring social engineering with explicit victim interaction.

Four-Day Discovery-to-Disclosure Cycle: The Role of Artificial Intelligence

The distinctive contribution of this case lies in the discovery method. pwn.ai's AI-assisted system with human input reproduced the entire attack chain in approximately four days, employing open-source models and a multi-agent workflow. The starting point was Yibelo's 2022 academic paper on the SOME technique. Reproduction was completed on July 26, 2026, with disclosure to WordPress the following day.

"The nastiest one is a login screen XSS, which via some social engineering could lead to Remote Code Execution." Oliver Sild, CEO of Patchstack (WordPress security company), quoted by Search Engine Journal

Editor's analysis: The speed of the discovery-to-disclosure cycle, compressed into approximately four days, highlights a tension in the current vulnerability disclosure model: the technical identification phase accelerates, while patch distribution remains bound to human release cycles.

What to Do Now

Immediately update all self-managed installations to WordPress 7.0.3, verifying that the backport applies to the version in use.
Identify installations running versions prior to 4.7, which no longer receive security patches and require migration or isolation.
Evaluate restrictions on the JSONP REST endpoint and the _envelope=1 parameter as possible unverified countermeasures, as the source does not confirm their effectiveness.

As of August 7, 2026, no in-the-wild exploitation is reported. Researchers deliberately withheld certain technical details, so the full exploit is not publicly available.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references