Full research report

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

CVE-2026-64638 (XSS2Shell, GHSA-52p2-r8wf-jcrf) is a confirmed high-severity pre-authentication reflected XSS in WordPress Core's login screen, patched on 6 August 2026 in version 7.0.3 and all maintained branches back to 4.7. The root cause is a one-character parser differential: a space between the opening angle bracket and a tag name survives wp_strip_all_tags() but is re-interpreted as live HTML by wp_kses_post(), and the fix is a single esc_html() call at the interpolation site in wp-includes/user.php. Pwn.ai's autonomous discovery system chained this XSS through DOM clobbering, REST JSONP abuse, and Yibelo's 2022 SOME technique to demonstrate Application Password theft and plugin upload reaching PHP execution—but the full RCE path requires social engineering a logged-in Administrator, a condition WordPress's own advisory emphasises is not fully within the attacker's control. As of 7 August 2026 no public PoC and no confirmed in-the-wild exploitation have been reported; the forward risk is PoC development by third parties given the detailed public write-up, and defenders should not confuse this story with the separate wp2shell cluster (CVE-2026-63030), which is under active exploitation and relates to a distinct vulnerability chain.

What happened

On 6 August 2026, WordPress released version 7.0.3, an emergency security update addressing 12 vulnerabilities including CVE-2026-64638, a pre-authentication reflected cross-site scripting (XSS) flaw on the login screen. The flaw was discovered autonomously by pwn.ai on 26 July 2026 using an open-source multi-agent system seeded from Paulos Yibelo's 2022 Same Origin Method Execution (SOME) research, reported to WordPress on 27 July, and publicly disclosed on 7 August following a nine-day remediation window. Pwn.ai demonstrated that the flaw can be chained—through DOM clobbering, REST API JSONP abuse, and SOME—to achieve PHP remote code execution on default WordPress installations, naming the chain XSS2Shell.

Affected scope

WordPress Core versions 4.7 through 7.0.2 across all maintained release branches; security backports were issued for every branch back to 4.7. Sites running versions older than 4.7 are also affected but fall outside WordPress's current backport scope. The platform powers an estimated 43% of internet-facing websites, representing exposure across hundreds of millions of installations.

Technical assessment

The vulnerability arises from a parser differential between two sanitisation functions in WordPress's login-error rendering path. A username containing a tag-like string with whitespace after the opening angle bracket survives wp_strip_all_tags() (which relies on PHP's strip_tags()) as plain text, but is subsequently re-interpreted as permitted HTML by wp_kses_post(). This inconsistency allows attacker-controlled DOM elements to be injected into the failed-login page without any credentials. Those elements interact with WordPress's bundled user-profile.js, where two expected inputs are absent and resolve to undefined, enabling DOM clobbering of the ajaxurl variable and steering REST API calls toward attacker-selected endpoints. The researchers additionally leveraged WordPress's REST JSONP support—including the _envelope=1 bypass for 401 responses—to execute script in the site origin. The full RCE path extends this through the SOME technique to invoke the Application Password approval workflow inside an active Administrator session, creating a revocable API credential, publishing a page with attacker-controlled script, and uploading an arbitrary plugin ZIP without requiring plugin activation. WordPress's own advisory characterises escalation to RCE as requiring social engineering and explicit victim interaction outside the attacker's direct control; pwn.ai states the required Administrator interaction is a single click on an attacker-controlled page.

Recommended defensive actions

  1. Update all WordPress installations to version 7.0.3, or to the corresponding security backport release for the installed branch (minimum supported branch: 4.7); verify that automatic background updates have applied for sites with that feature enabled
  2. Audit Application Password records for all Administrator-level accounts and revoke any credential not explicitly authorised, as the demonstrated attack chain creates persistent API credentials that survive the session
  3. Monitor WordPress audit logs and server access logs for anomalous failed-login requests containing tag-like or angle-bracket characters in the username field, unexpected Application Password creation events, and plugin installation events not attributable to known administrative activity
  4. Restrict access to wp-login.php to authorised IP ranges or enforce additional authentication at the web-server layer for sites where Administrators are regularly active, reducing the social-engineering surface required for the RCE path
  5. Subscribe to WordPress security announcements and relevant national CERT advisories to receive early notification of future emergency releases, given the compressed nine-day disclosure window observed in this case

Uncertainties and evidence gaps

  • Pwn.ai stated that multiple paths from XSS to RCE were identified beyond the Application Password chain described publicly; the nature and feasibility of those additional paths has not been independently confirmed
  • The precise lower bound of the affected version range differs across sources—some report WordPress 6.4 as the lower limit while the official backport list extends to 4.7—and the NVD record for CVE-2026-64638 could not be independently verified during this investigation
  • Whether a nonce-based Content Security Policy using strict-dynamic reliably blocks the demonstrated path has not been independently tested; pwn.ai reported it did not block their approach, but this claim has not been corroborated
  • The WordPress.org news release references 13 security fixes while the documentation page lists 12, a minor discrepancy that could reflect a late-added fix or a counting difference and has not been resolved against a single authoritative source

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessNo authentication required to trigger the login-screen XSS; the full RCE path additionally requires a logged-in Administrator to interact with one attacker-controlled page via social engineering
ComponentWordPress login screen error-message rendering path (wp-login.php, wp-includes/user.php, wp-includes/kses.php) and the bundled user-profile.js script loaded on the login page
MechanismParser differential between wp_strip_all_tags() and wp_kses_post() allows a crafted username to survive the first sanitiser as text and be re-interpreted as live HTML by the second, injecting attacker-controlled DOM; those elements are manipulated via DOM clobbering and REST API JSONP abuse to execute script in the WordPress origin
ImpactUnauthenticated DOM injection enabling JavaScript execution in the site origin; when chained against an active Administrator session through social engineering, enables Application Password creation, arbitrary plugin upload, and PHP code execution on the server
DetectionFailed-login requests with malformed or tag-like usernames in server logs; unexpected Application Password creation events in WordPress admin; REST API JSONP requests from unrecognised origins; plugin installation events without corresponding administrator action
MitigationApply WordPress 7.0.3 or the corresponding branch security release; the fix applies esc_html() to the failed-login username at the interpolation site in wp-includes/user.php
Exploitation status

No confirmed active exploitation in the wild as of public disclosure on 7 August 2026; no public proof-of-concept exploit released, though pwn.ai demonstrated the full XSS-to-RCE chain internally on default installations

Research process

The investigation began with the stated CVE number and the claim of a pre-auth WordPress XSS chained to code execution. Primary sources—the official WordPress 7.0.3 release notes and the discoverer's technical write-up at pwn.ai—confirmed the vulnerability's existence, scope, fix, and GHSA identifier. Independent corroboration from Patchstack, Hadrian, and Cybersecurity News validated the core technical claims and provided a consistent picture of exploitation status. The key finding is that no public PoC exploit code and no confirmed in-the-wild exploitation have been reported as of 7 August 2026, despite the high CVSS score and the broad affected surface; the primary forward risk is rapid independent PoC development given the detailed public write-up.

  1. Does CVE-2026-64638 exist as described and what are its basic parameters?
    Searched for CVE-2026-64638 WordPress XSS vulnerability

    Multiple credible security outlets confirmed the CVE as a pre-auth reflected XSS in WordPress Core with CVSS 8.9, patched in 7.0.3 on 6 August 2026, affecting all maintained versions from 4.7 to 7.0.2

    why Established baseline existence and severity; framed the scope and exploitation questions for deeper investigation

  2. What does the official WordPress release say, and which GHSA identifier applies?
    Fetched the WordPress 7.0.3 documentation page
    wordpress.org ↗

    Official release notes confirmed 12 security fixes, credited pwn.ai for the pre-auth login XSS, listed security backport releases for all branches back to 4.7, and surfaced the GHSA-52p2-r8wf-jcrf identifier

    why This is the authoritative primary source; it confirmed patch availability and scope, and provided the GHSA identifier needed for advisory tracking

  3. What technical detail does the discoverer publish, and has a PoC been released?
    Fetched the pwn.ai XSS2Shell research blog post
    pwn.ai ↗

    Pwn.ai published a detailed write-up describing the five-stage chain (parser differential, DOM clobbering, JSONP abuse, SOME technique, plugin upload) with discovery on 26 July and disclosure on 7 August; no weaponisable PoC code was released

    why Confirmed the technical narrative and established that, while a working chain was demonstrated internally, no public exploit code accompanied the disclosure

  4. What does an independent security specialist say about scope, severity, and exploitation status?
    Fetched the Patchstack analysis of WordPress 7.0.3
    patchstack.com ↗

    Patchstack confirmed 12 CVEs, characterised CVE-2026-64638 as the most critical issue in the release, and noted no confirmed exploitation or public PoC; added context about AI-accelerated research compressing the exploit development window

    why Independent specialist corroboration of exploitation status and patch scope from a source that tracks WordPress vulnerabilities professionally

  5. Is there any evidence of active in-the-wild exploitation or threat actor activity related to this CVE?
    Searched for CVE-2026-64638 GHSA active exploitation in the wild August 2026

    No exploitation or threat actor chatter identified for CVE-2026-64638; results also surfaced a separate vulnerability cluster (wp2shell, CVE-2026-63030) with confirmed active exploitation—explicitly a different story that must not be conflated

    why Exploitation status confirmed as 'not confirmed'; the wp2shell cluster is excluded from this report as it relates to a distinct CVE and campaign

  6. Does a third-party technical analysis independently corroborate the fix mechanism and GHSA reference?
    Fetched the Hadrian technical analysis of XSS2Shell
    hadrian.io ↗

    Confirmed GHSA-52p2-r8wf-jcrf, corroborated the fix as esc_html() applied in wp-includes/user.php, confirmed no in-the-wild exploitation as of 7 August 2026, and validated the affected version range

    why Second independent technical source confirming both the fix mechanism and exploitation status, providing sufficient corroboration across multiple independent domains to support high confidence

Named in this story
Actorspwn.ai
TargetsWordPress Core installations versions 4.7 through 7.0.2WordPress-hosted websites globally (estimated 43% of internet-facing sites)
Related CVEs CVE-2026-64638

Research coverage

All 68 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 59 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
The Hacker Newsnews ok12 records Primary evidence1 matched items Published the source report used to frame and date the event.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
BleepingComputernews ok5 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1662 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5322 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok676 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1008 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok7541 records Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok13 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok5 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1588 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 10 opened outside the registered collection
References & evidence
PoC & exploit code1
XSS2Shell: WordPress Preauth XSS to RCE Chain (CVE-2026-64638) | PWN.AI Security Research pwn.ai ↗

Discoverer's full technical write-up detailing the five-stage attack chain; no weaponisable exploit code published alongside the disclosure

Vendor & gov advisories2
Version 7.0.3 – WordPress Documentation wordpress.org ↗

Official release notes crediting pwn.ai, listing all 12 CVEs fixed, backport scope to branch 4.7, and referencing GHSA-52p2-r8wf-jcrf

WordPress 7.0.3 Security Release – WordPress News wordpress.org ↗

Official WordPress announcement confirming this is a security-only release requiring immediate update

Analysis & research3
WordPress XSS2Shell: Unauthenticated Login-Screen XSS to PHP Code Execution (CVE-2026-64638) hadrian.io ↗

Independent third-party analysis confirming GHSA-52p2-r8wf-jcrf, fix mechanism (esc_html in user.php), and no in-the-wild exploitation as of 7 August 2026

WordPress 7.0.3 Released: 12 Vulnerabilities Found and Fixed – Patchstack patchstack.com ↗

Security-specialist breakdown of all 12 CVEs; notes AI-accelerated research compresses the disclosure-to-exploit window

WordPress XSS2Shell Flaw Chains Pre-Auth Login XSS to PHP Remote Code Execution cybersecuritynews.com ↗

Independent corroboration confirming no public PoC and no in-the-wild exploitation as of disclosure date