# CVE-2026-64638: WordPress Pre-Auth XSS Leads to PHP RCE

> A pre-authentication reflected XSS (CVE-2026-64638) in WordPress can be chained for PHP code execution. Patch immediately.

- Published: 2026-08-07T16:42:22.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: WordPress, XSS, RCE, Web Security, CVE-2026-64638
- CVEs: CVE-2026-64638 (CVSS 8.9)
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html
- Canonical: https://runtimerebel.com/blog/cve-2026-64638-wordpress-pre-auth-xss-leads-to-php-rce

## Key points

- Pre-authentication XSS in WordPress login screen can lead to PHP code execution.
- All WordPress versions are affected, with fixes backported to 4.7, including 7.0.3.
- Administrators must update WordPress to version 7.0.3 or a patched release immediately.

## Critical WordPress Pre-Auth [XSS](/glossary#xss) ([CVE](/glossary#cve)-2026-64638) Chained to PHP Code Execution

WordPress has addressed a high-severity pre-authentication reflected cross-site scripting (XSS) flaw in its login screen, identified as [CVE-2026-64638](https://nvd.nist.gov/vuln/detail/CVE-2026-64638). This [vulnerability](/glossary#vulnerability), assigned a [CVSS](/glossary#cvss) score of 8.9, affects every version of the widely deployed content management system and requires no attacker privileges to trigger the initial XSS. Security researchers at pwn.[ai](/glossary#ai) demonstrated how this XSS can be chained to achieve PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page, a technique they refer to as XSS2Shell. Organizations running WordPress should prioritize immediate patching.

### Technical Details of the WordPress Pre-Auth XSS [Exploit](/glossary#exploit) Chain

The root of [CVE-2026-64638](https://nvd.nist.gov/vuln/detail/CVE-2026-64638) lies in how WordPress processes usernames submitted to the failed-login error page. According to [The Hacker News](https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html), the `sanitize_user()` and `wp_strip_all_tags()` functions, which rely on PHP's `strip_tags()`, can be bypassed. A tag-like string containing whitespace after an opening `<` character can survive these sanitization routines as plain text. Later in the processing, `wp_kses_post()` interprets this same input as valid HTML, leading to attacker-controlled live DOM elements on the failed-login page.

This reflected XSS, which executes without further visitor interaction on the error page, can be escalated. The researchers observed that WordPress's `user-profile.js` script, loaded on the login page due to its role in password resets, expects certain profile elements that are absent. Specifically, two missing input values resolve to `undefined`, allowing an equality check to pass. Crucially, the otherwise undefined `ajaxurl` variable can be clobbered with an injected DOM element, steering WordPress's own JavaScript towards an attacker-selected same-origin REST request. The researchers exploited WordPress's REST JSONP support to transform this request into JavaScript execution within the site's origin. For deployments where anonymous REST requests return HTTP 401, the `_envelope=1` parameter can wrap the denial in an outer HTTP 200 response, allowing jQuery to process it as a script.

One path demonstrated by pwn.ai leverages a technique built on Paulos Yibelo's 2022 Same Origin Method Execution (SOME) research. This path uses the WordPress-origin XSS to invoke the native Application Password approval control within a logged-in Administrator's session. WordPress then generates an [API](/glossary#api) credential and redirects it to an attacker-specified `success_url`. This Application Password, intended for API access, is then used for authenticated REST access to publish a WordPress page containing additional same-origin JavaScript. When the retained administrator session accesses this page, the script obtains WordPress's plugin-upload nonce, uploads an attacker-supplied ZIP file, and subsequently requests PHP directly from the extracted plugin. This entire chain, which pwn.ai demonstrated on a clean local WordPress 7.0.2 installation, does not require the plugin to be activated.

WordPress's own advisory acknowledges that escalation to [RCE](/glossary#rce) involves conditions outside the attacker's direct control, necessitating successful [social engineering](/glossary#social-engineering) and explicit victim interaction. However, the initial pre-auth XSS is broadly exploitable against default WordPress installations, regardless of unusual hosting or deployment settings. The researchers also confirmed that a nonce-based Content Security Policy using `strict-dynamic` did not block their demonstrated path.

### Affected Systems and **WordPress 7.0.3 [Patch](/glossary#patch) Guidance for CVE-2026-64638**

The underlying XSS vulnerability affects all versions of WordPress. The fix was released on August 6 in WordPress 7.0.3, with backports extending to the 4.7 branch. This means any WordPress installation older than version 4.7 remains vulnerable and falls outside the project's current backport range. While the researchers demonstrated the cookie-less login-page XSS against WordPress 7.0.2 deployments in fresh Chrome profiles, the full PHP code execution chain was separately demonstrated on a local WordPress 7.0.2 instance. Defenders seeking to mitigate WordPress PHP code execution vulnerability should understand that a successful exploit could expose database credentials (`wp-config.php`), permit persistent administrator creation, allow content modifications, expose sensitive files, and enable operating-system commands with the PHP worker's privileges.

### Actionable Recommendations and Mitigations

Given the severity of this pre-authentication XSS and its potential for RCE, immediate action is paramount. Defenders should prioritize the following:

*   **Update Immediately**: All WordPress sites must be updated to WordPress 7.0.3 or a later patched version. Sites configured for automatic background updates should receive the security release automatically, but manual verification is recommended.
*   **Review Older Versions**: If running WordPress versions older than 4.7, these installations are outside the backport range and remain fully vulnerable. Consider upgrading to a supported, patched version or implementing strict compensating controls, recognizing that these may not fully address the underlying XSS.
*   **Security [Hardening](/glossary#hardening)**: While not a complete mitigation for this specific XSS, maintaining general WordPress security best practices remains important:
    *   Enforce strong, unique passwords for all administrative accounts.
    *   Implement multi-factor authentication ([MFA](/glossary#mfa)).
    *   Regularly back up WordPress sites and databases.
    *   Monitor WordPress access logs for unusual activity, especially failed login attempts and administrative actions.

pwn.ai's research underscores the persistent risk of chaining seemingly isolated vulnerabilities into high-impact exploits. Applying the security update is the most effective defense against this critical flaw.

**Related:** [WP2Shell: WordPress RCE via Chained CVE-2026-60137 & CVE-2026-63030](/blog/wp2shell-wordpress-rce-via-chained-cve-2026-60137-cve-2026-63030), [WP2Shell Vulnerabilities CVE-2026-60137 & CVE-2026-63030 Exploited](/blog/wp2shell-vulnerabilities-cve-2026-60137-cve-2026-63030-exploited)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2026-64638-wordpress-pre-auth-xss-leads-to-php-rce