A critical vulnerability chain in WordPress Core, tracked as CVE-2026-64638 and nicknamed XSS2Shell, that turns a single failed login attempt into full remote code execution on the underlying server.
Because the flaw sits in code that has shipped with WordPress since version 4.7, it touched effectively every actively maintained installation of the world’s most popular content management system, which powers more than 43% of all websites on the internet, putting an estimated 500 million-plus sites at risk before a fix landed.
The chain begins on the ordinary login page, wp-login.php. When a username that does not exist is submitted, WordPress builds an error message using a sanitization function called wp_strip_all_tags.
Security researchers at pwn.ai have disclosed that inserting a space between the opening angle bracket and a tag name, such as “< area”, causes PHP’s underlying strip_tags parser to treat the string as harmless text while WordPress’s own KSES sanitizer later reinterprets that same string as legitimate HTML elements.
That parser disagreement lets an attacker smuggle live, attacker-controlled elements like <area>, <div>, and <button> directly into the rendered login page, with no account and no prior authentication required.
WordPress XSS2Shell Vulnerability
Those injected elements are not scripts themselves, but they are crafted to match selectors that WordPress’s own user-profile.js file automatically searches for on page load, a script left over from password-reset functionality.
This causes the browser to auto-trigger a click event that cascades into an AJAX request, and through a technique called DOM clobbering, the attacker’s injected element hijacks the destination URL of that request.
Pointed at WordPress’s REST API with method-override and JSONP parameters, the request comes back wrapped in executable JavaScript, giving the attacker arbitrary script execution inside the WordPress origin, purely pre-authenticated, pwn.ai said.
On its own, this reflected XSS is already serious, but WordPress’s advisory and independent analysis confirm that under specific conditions it can escalate to remote code execution.
If a logged-in administrator is lured to a malicious third-party page and interacts with it, the attacker’s script can piggyback on the admin’s session to mint a WordPress Application Password, publish a page containing attacker JavaScript using the admin’s unfiltered_html privileges, and finally upload a plugin ZIP file containing a PHP web shell, all through legitimate, authenticated WordPress API calls the admin never explicitly approved.
WordPress’s official advisory notes that this escalation path requires social engineering and explicit victim interaction, factors outside the attacker’s direct control, which is why the CVE carries a CVSS score of 8.9 rather than a maximum rating.
WordPress shipped an emergency fix in version 7.0.3, released on August 6, 2026, alongside eleven other security patches. Given the severity, the WordPress security team backported the fix all the way to version 4.7, covering every branch still receiving security updates.
There is currently no evidence of active in-the-wild exploitation or a public proof-of-concept exploit, according to vulnerability trackers monitoring the CVE. Site owners and administrators should update to WordPress 7.0.3 or the corresponding backported patch immediately, since most managed hosts apply this automatically but self-hosted sites often require manual intervention.
The underlying technique builds on a 2022 Same Origin Method Execution (SOME) research technique published by Paulos Yibelo, which was originally used to bypass Content Security Policy protections on WordPress sites and was nominated for Top Web Hacking Technique of the year.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
The post WordPress XSS2Shell Flaw Chains Pre-Auth Login XSS to PHP Remote Code Execution appeared first on Cyber Security News.
