WordPress patches CVE-2026-64638, a pre-authentication reflected XSS vulnerability affecting all WordPress versions. The flaw exists on the login screen and carries a CVSS score of 8.9.
Security researchers at pwn.ai demonstrated a critical attack chain. An attacker crafts a malicious link containing XSS payload. When an administrator visits the link and then accesses their WordPress dashboard, the vulnerability allows execution of arbitrary PHP code on the server. This escalates from reflected XSS to remote code execution, giving attackers complete control over the compromised WordPress installation.
The pre-authentication nature means attackers need no login credentials to trigger the initial XSS. They simply need to trick an administrator into clicking a specially crafted link. Once the administrator interacts with their dashboard afterward, the payload executes with full privileges.
For WordPress site operators, this vulnerability demands immediate patching. The attack requires social engineering to work, but the severity justifies treating it as critical. Administrators should update WordPress to the latest version containing the fix without delay.
Organizations running WordPress should also implement additional mitigations. Web application firewalls can block requests containing suspicious XSS patterns. Restricting PHP execution in upload directories and enforcing content security policies limits damage if exploitation occurs. Regular security audits help identify whether sites were compromised before patching.
The combination of pre-auth access and PHP execution capability makes this flaw particularly dangerous. Unlike vulnerabilities requiring valid credentials, attackers can attempt this attack against any WordPress installation. The demonstrated proof-of-concept from pwn.ai confirms the risk is not theoretical.
WordPress users running outdated versions face elevated risk. Automated scanners can identify vulnerable installations, making them targets for mass exploitation. Hosting providers should prioritize forcing updates for customers running affected versions.