CVE-2026-64638
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim.
This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.
Discovered and responsibly disclosed by the team at pwn.ai.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim.
This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.
Discovered and responsibly disclosed by the team at pwn.ai.
- Record
CVE-2026-64638- CVSS 4.0
- 8.9 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-54565
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim.
This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.
Discovered and responsibly disclosed by the team at pwn.ai.
- Record
EUVD-2026-54565- CVSS 4.0
- 8.9 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Updated
- 2026-11-02
NVD
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim.
This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.
Discovered and responsibly disclosed by the team at pwn.ai.
- Record
CVE-2026-64638- CVSS 4.0
- 8.9 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-64638
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by the team at pwn.ai.
- Record
DEBIAN-CVE-2026-64638- CVSS 4.0
- 8.9 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-64638
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by the team at pwn.ai.
- Record
UBUNTU-CVE-2026-64638- CVSS 4.0
- 8.9 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wordpressDebian:12 |
All versions, plus listed versions 6.1.1+dfsg1-16.1.6+dfsg1-0+deb12u16.1.9+dfsg1-0+deb12u16.2+dfsg1-16.2.1+dfsg1-1 Show 25 moreShow less6.2.2+dfsg1-16.3+dfsg1-16.3.1+dfsg1-16.3.2+dfsg1-16.4.1+dfsg1-16.4.1+dfsg1-1.16.4.2+dfsg1-16.4.3+dfsg1-16.5+dfsg1-16.5.2+dfsg1-16.5.3+dfsg1-16.5.5+dfsg1-16.6.1+dfsg1-16.7.2+dfsg1-16.7.2+dfsg1-1.16.8.1+dfsg1-16.8.3+dfsg1-16.9+dfsg1-16.9.4+dfsg1-17.0+dfsg1-17.0.2+dfsg1-17.0.3+dfsg1-17.1+dfsg1-17.1.1+dfsg1-17.1.2+dfsg1-1 |
None known |
wordpressDebian:13 |
before 6.8.7+dfsg1-0+deb13u1, plus listed versions 6.8.1+dfsg1-16.8.3+dfsg1-0+deb13u16.8.3+dfsg1-16.8.6+dfsg1-0+deb13u1 |
6.8.7+dfsg1-0+deb13u1 |
wordpressDebian:14 |
before 7.0.3+dfsg1-1, plus listed versions 6.8.1+dfsg1-16.8.3+dfsg1-16.9+dfsg1-16.9.4+dfsg1-17.0+dfsg1-17.0.2+dfsg1-1 |
7.0.3+dfsg1-1 |
wordpressUbuntu:16.04:LTS |
All versions, plus listed versions 4.3+dfsg-14.3.1+dfsg-14.4+dfsg-14.4.1+dfsg-14.4.2+dfsg-14.4.2+dfsg-1ubuntu1 |
None known |
wordpressUbuntu:18.04:LTS |
All versions, plus listed versions 4.8.2+dfsg-24.8.3+dfsg-14.9.1+dfsg-14.9.2+dfsg-14.9.4+dfsg-14.9.5+dfsg1-1 |
None known |
wordpressUbuntu:20.04:LTS |
All versions, plus listed versions 5.2.2+dfsg1-15.2.4+dfsg1-15.3.2+dfsg1-15.3.2+dfsg1-1ubuntu1 |
None known |
wordpressUbuntu:22.04:LTS |
All versions, plus listed versions 5.7.1+dfsg1-2ubuntu15.8.1+dfsg1-2ubuntu15.8.2+dfsg1-1ubuntu15.8.3+dfsg1-1ubuntu15.8.3+dfsg1-1ubuntu1.1 |
None known |
wordpressUbuntu:24.04:LTS |
All versions, plus listed versions 6.2+dfsg1-1ubuntu16.4.3+dfsg1-1ubuntu1 |
None known |
wordpressUbuntu:26.10 |
All versions, plus listed versions 6.7.2+dfsg1-1.1ubuntu2 |
None known |
wordpressUbuntu:26.04:LTS |
All versions, plus listed versions 6.7.2+dfsg1-1.1ubuntu16.7.2+dfsg1-1.1ubuntu2 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | 0xBlackash/CVE-2026-64638 | 2026-08-07 |
| PoC in GitHub | 5yu4n/CVE-2026-64638 | 2026-08-07 |
| PoC in GitHub | 686f6c61/POC-WP-XSS2Shell-CVE-2026-64638 | 2026-08-07 |
| PoC in GitHub | Boreas37/CVE-2026-64638-PoC-XSS2Shell- | 2026-08-07 |
| PoC in GitHub | HORKimhab/CVE-2026-64638 | 2026-08-07 |
| PoC in GitHub | ZSecur1ty/XSS2Shell-CVE-2026-64638 | 2026-08-07 |
| PoC in GitHub | renzi25031469/CVE-2026-64638-WordPress-Core-XSS2Shell | 2026-08-07 |
| PoC in GitHub | wordsec/XSS2Shell | 2026-08-07 |
| PoC in GitHub | 4minx/CVE-2026-64638 | 2026-08-08 |
| PoC in GitHub | Dungsocool/CVE-2026-64638 | 2026-08-08 |
Show 16 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | HackSpeak/CVE-2026-64638 | 2026-08-08 |
| PoC in GitHub | imbas007/CVE-2026-64638-POC | 2026-08-08 |
| PoC in GitHub | mohwahyudi/poc-CVE-2026-64638- | 2026-08-08 |
| PoC in GitHub | tc4dy/CVE-2026-64638-PoC-Exploit | 2026-08-08 |
| PoC in GitHub | yogaGymn/XSS2Shell-CVE-2026-64638 | 2026-08-08 |
| PoC in GitHub | 0xlipon/xss2shell | 2026-08-09 |
| PoC in GitHub | eh-amish/CVE-2026-64638-XSS-to-Shell-PoC | 2026-08-09 |
| PoC in GitHub | g0d150ne/XSS2Shell | 2026-08-09 |
| PoC in GitHub | jendmaoul/XSS2Shell-CVE-2026-64638 | 2026-08-09 |
| PoC in GitHub | ZildanZ/CVE-2026-64638 | 2026-08-12 |
| PoC in GitHub | Alixploit22/CVEX2SHEL | 2026-08-15 |
| PoC in GitHub | SanaullahAmanullah/xss2shell-check | 2026-08-16 |
| PoC in GitHub | kaleth4/CVE-2026-64638 | 2026-08-18 |
| PoC in GitHub | xAL6/cve-2026-64638-banner-poc | 2026-08-24 |
| PoC in GitHub | madfxr/xss2shell-poc | 2026-09-21 |
| Nuclei | WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell) |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, exploits_more | ||
| exploits | ||
| first indexed | CVE List, EUVD, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-64638 is a high vulnerability (CVSS 8.9) in Wordpress, published August 7, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in wordpress 6.8.7+dfsg1-0+deb13u1.
References
The full exploit list has 2 more links.