WordPress XSS2Shell Pre-authentication RCE Vulnerability Chain (CVE-2026-64638)

In August 2026, a critical vulnerability chain named XSS2Shell (CVE-2026-64638) was disclosed affecting WordPress Core versions 6.4 through 7.0.2. The vulnerability originates from a parser differential between PHP's strip_tags() and WordPress's wp_kses_post() functions, allowing attackers to inject malicious DOM elements into the login error page without authentication.

Technically, the exploit chains a reflected XSS into a full server takeover by using DOM clobbering to hijack the 'ajaxurl' variable. This enables Same-Origin Method Execution (SOME) to trick an authenticated administrator's browser into creating an Application Password. With this credential, attackers can perform authenticated REST API calls to upload a malicious plugin and execute arbitrary PHP code as the web server user.

This is a high-impact event given WordPress powers over 40% of all websites. While the initial XSS is unauthenticated, the full RCE chain requires an administrator session. Immediate patching to version 7.0.3 is required for all affected instances to mitigate the risk of server compromise.