Executive Summary
A critical vulnerability, designated as CVE-2026-64638 (CVSS 8.9), was identified in WordPress Core affecting versions from 4.7 up to 7.0.2. The flaw leverages a parser differential in `wp-login.php` where a specifically crafted username bypasses initial sanitization, leading to a DOM injection. When a logged-in administrator views the malicious page, the chain executes a same-origin POST request that mints an application password, ultimately allowing the attacker to upload malicious plugins and execute arbitrary PHP code.
WordPress released version 7.0.3 on August 7, 2026, to address this issue. With over 500 million sites potentially affected, the urgency for patching is high. The exploit, known as XSS2Shell, is now public with functional proof-of-concept (PoC) code and automated scanning templates, increasing the likelihood of widespread exploitation against unpatched systems.
Key Details
Threat Name
CVE-2026-64638
Affects
WordPress Core
Adversary
—
MITRE Techniques
—
Malware/Tools
None identified