WordPress 7.0.3: Critical XSS Flaw CVE-2026-64638

Published on 7 August 2026

WordPress 7.0.3: Pre-Auth XSS (CVE-2026-64638) Enables Code Execution

A single failed login attempt – that's all an attacker needs to lay the first building block for a complete takeover of your server. What sounds harmless at first turns out to be one of the most serious WordPress vulnerabilities of the year: on 6 August 2026, WordPress released version 7.0.3, a pure security update that closes twelve vulnerabilities at once. The most dangerous of these carries the identifier CVE-2026-64638 and reaches a CVSS score of 8.9 (High) – on a scale up to 10. Practically all WordPress installations since version 4.7 are affected, roughly half a billion websites worldwide.

For the nearly 1.92 million WordPress sites in Germany, this means: urgent action is required. Because under certain conditions, the flaw can be escalated from a seemingly simple cross-site scripting weakness (that is, the injection of foreign script code into a website) to a full Remote Code Execution (RCE) – meaning the execution of arbitrary program code directly on your web server.

What happened?

The vulnerability was discovered by the AI pentesting company pwn.ai, which reproduced the flaw on 26 July 2026 and responsibly reported it to WordPress a day later – including full proof that it could be used to execute PHP code on the server. The WordPress team confirmed the risk and released the update on 6 August. On 7 August, the coordinated public disclosure followed, along with a GitHub Security Advisory (GHSA-52p2-r8wf-jcrf).

The core flaw, CVE-2026-64638, is a so-called Pre-Authentication Reflected XSS. In plain terms: the attacker needs no user account and does not have to log in to trigger the flaw at all. It sits directly in the login screen (the file wp-login.php), which every WordPress site makes publicly accessible by default.

"CVE-2026-64638 is fully pre-authenticated exploitable (no account needed). A single failed login attempt is enough to execute attacker JavaScript in the WordPress origin – and against a logged-in administrator all the way to full Remote Code Execution on the server, reliably on all standard WordPress installations." – pwn.ai (pwn.ai/blog/xss2shell)

The technical background – explained clearly

The cause is a so-called parser discrepancy, that is, a difference in interpretation between two WordPress functions that are both actually supposed to filter out dangerous HTML code:

wp_strip_all_tags() ignores HTML tags where there is a space after the opening bracket – and lets them through.
wp_kses_post(), on the other hand, interprets exactly the same constructs as valid tags.

This contradiction makes it possible to sneak malicious elements past the filtering into the error page that WordPress displays after a failed login. So far, so inconspicuous. The actual damage only occurs in the second step – the "XSS2Shell" attack chain dubbed by pwn.ai:

An attacker prepares a manipulated link.
A logged-in administrator is induced through social engineering (that is, targeted deception, such as a fake email) to click on this link.
The injected elements interact with the WordPress script user-profile.js. Using a technique called DOM clobbering, the JavaScript variable ajaxurl is overwritten.
As a result, the administrator's browser sends a so-called REST JSONP request to a server controlled by the attacker. Its response is executed as JavaScript in the context of the WordPress site.
Via "Same Origin Method Execution" (SOME), the attacker generates an application password in the background – that is, an API access key.
With these credentials, they upload a malicious plugin as a ZIP file, whose PHP files can be called directly via the web directory – the result is full Remote Code Execution.

Important for context: this is a reflected XSS, not a stored one. That makes a considerable difference.

"While this is definitely a vulnerability worth watching, one should be precise about what 'potential PHP code execution' actually requires. Reflected XSS is only triggered in the browser of whoever clicks the crafted link; it does not spread by itself the way stored XSS does. That makes this a targeted attack, not a drive-by." – Chazz Wolcott, Security Researcher at Patchstack

The WordPress Security Team likewise emphasises the necessary user interaction:

"Via a specially crafted malicious third-party website hosted by an attacker, this can be escalated to an RCE vulnerability under conditions outside the attacker's control. This requires successful social engineering and explicit interaction from the targeted victim." – WordPress Security Team (GitHub Security Advisory)

But that is only half a reassurance: the entry vector itself works without any login, and social engineering of administrators is in practice anything but hopeless.

Who is affected?

In short: almost everyone. Affected are all WordPress versions up to and including 7.0.2, with the flaw tracing back to version 4.7. WordPress has therefore not only built the fix into 7.0.3 but also backported it to older version branches (such as 6.9.6, 6.8.7 and other branches). Anyone deliberately running an older major version will therefore also receive a matching security update.

Particularly at risk are small and medium-sized enterprises without a dedicated IT security team – above all when automatic updates have been disabled on heavily customised websites in order to avoid compatibility problems with themes or plugins.

How to check whether you are affected

Log in to the WordPress backend as an administrator.
In the menu, navigate to Dashboard → Updates.
Check the WordPress version displayed. It must be at least 7.0.3 – or the patched version of your branch (for example 6.9.6).
Alternatively, query the version via the command-line tool WP-CLI with the command wp core version.

What you need to do now

Act promptly. The facts make clear why: according to Patchstack, the median time from the publication of a vulnerability to mass exploitation is now only five hours. At the time of publication, no active exploitation in the wild was known – however, a proof-of-concept (that is, a working demonstration exploit) is already publicly available.

Create a backup: Immediately back up the database and all files of your website before making any changes.
Install the core update: Update to WordPress 7.0.3 or the latest patched version of your branch.
Raise administrator awareness: Instruct all administrators and editors not to click on unexpected login or password reset links. That is exactly what the attack chain relies on.
Use a Web Application Firewall (WAF): A WAF such as Patchstack or Wordfence can block attacks at the file level. Both providers have already rolled out immediate protection rules.
Disable the file editor: Add the line define('DISALLOW_FILE_EDIT', true); to your wp-config.php. This makes it harder to inject code via the backend.
Review the user list: Check for unknown administrator accounts and review the access rights of existing users.

An important note on the WAF: it is a sensible additional layer of protection, but no substitute for the update. According to Patchstack, standard WAFs block only 26 percent of WordPress-specific attacks on average. The patch itself remains the most important measure.

Context and GDPR relevance

Why is this flaw more than a technical detail? Because a successful XSS2Shell chain gives the attacker full control over the web server. This grants them access to the database – including the wp-config.php – and thus to all stored personal data of customers, users or employees.

This has immediate data protection consequences. Under Art. 33 GDPR, such a data breach must be reported to the competent supervisory authority without undue delay, and at the latest within 72 hours of becoming aware of it. If there is a high risk to the rights and freedoms of those affected, the obligation to inform the affected individuals under Art. 34 GDPR additionally applies.

Crucial for SMEs: responsibility under data protection law pursuant to Art. 32 GDPR (appropriate technical and organisational measures) lies with the website operator – even when the technical maintenance has been outsourced to an agency. A missed security update can be assessed as an inadequate technical and organisational measure and result in substantial fines.

The threat situation is further exacerbated by the role of artificial intelligence in security research. In 2025, 11,334 new vulnerabilities were found in the WordPress ecosystem – an increase of 42 percent over the previous year. In July 2026, WordPress recorded a record figure of 450 bug bounty reports, where there had previously been only around 20 to 30 per month.

"We are deep into a completely new era of AI-assisted security research." – John Blackbourn, WordPress Security Team Rep

These tools are open to both sides – to defenders as well as to attackers. That is precisely what explains the dramatically shortened time to exploitation.

Conclusion

CVE-2026-64638 is no reason to panic, but a very good reason to act immediately. The complete takeover of the server does require active interaction from a logged-in administrator – but the initial attack runs entirely without a login, a proof-of-concept is public, and the time to widespread exploitation is getting ever shorter.

The good news: protection is easy to implement. A prompt update to WordPress 7.0.3 (or the patched version of your branch), a current backup, trained administrators and an active WAF strip this threat of most of its impact. Check your WordPress version today – and if you are unsure whether your site is properly secured, seek professional support before those five hours of lead time run out.

Sources: The Hacker News, WordPress.org Release Notes, pwn.ai Technical Blog, GitHub Security Advisory (GHSA-52p2-r8wf-jcrf), Patchstack Analysis, The Repository, Patchstack Whitepaper 2026, Barn2 Market Share Report.

Step by step

How the XSS2Shell attack unfolded

Click a phase for details – or let the animation play through.

PHASE 1/6 · Initial Access

The attacker exploits the pre-authenticated reflected XSS in the publicly accessible WordPress login.

T1190 – Exploit Public-Facing Application

CVE-2026-64638, CVSS 8.9 (High) in wp-login.php
No user account required – fully pre-authenticated
A single failed login attempt is sufficient
Affects all versions 4.7.0 to 7.0.2, ~500M websites

PHASE 2/6 · Defense Evasion

A parser discrepancy between two filter functions allows bypassing HTML sanitization.

T1211 – Exploitation for Defense Evasion

wp_strip_all_tags() ignores tags with a space after the bracket
wp_kses_post() interprets the same constructs as valid tags
Malicious elements slip into the login error page
Standard WAFs block only ~26% of WordPress-specific attacks

PHASE 3/6 · Execution

A logged-in admin is lured via social engineering to click, executing attacker JavaScript in the WordPress origin.

T1059.007 – JavaScript T1204.001 – Malicious Link

Crafted link sent to logged-in administrator (e.g. via spoofed email)
DOM clobbering overwrites the ajaxurl variable in user-profile.js
REST-JSONP request to attacker server, response executed as JS
Reflected XSS – targeted attack, not self-spreading stored XSS

PHASE 4/6 · Privilege Escalation

Via Same Origin Method Execution the attacker generates an Application Password in the admin's context.

T1078 – Valid Accounts T1098.001 – Additional Cloud Credentials

Technique: Same Origin Method Execution (SOME)
An API access key (Application Password) is created in the background
The attacker obtains valid admin credentials for the REST API

PHASE 5/6 · Persistence & Code Execution

Using the Application Password the attacker uploads a malicious plugin and achieves full remote code execution.

T1505.003 – Web Shell T1059 – Command and Scripting Interpreter

Upload of a malicious plugin as a ZIP file
PHP files directly callable via the web directory (web shell)
Result: full remote code execution (RCE) on the server
Complete XSS2Shell chain by pwn.ai

PHASE 6/6 · Impact

The attacker gains full server control including access to the database and personal data.

T1005 – Data from Local System T1486 – Data Encrypted for Impact

Access to the database and wp-config.php
All personal data of customers and users at risk
GDPR breach notification under Art. 33 (72 hours) may apply
Median time-to-exploit in the WP ecosystem: only 5 hours

Short & clear answers

Frequently asked questions about this incident

Am I affected by the WordPress vulnerability CVE-2026-64638?

All WordPress versions up to and including 7.0.2 are affected, with the flaw tracing back to version 4.7 – meaning virtually every WordPress installation is at risk. To check your version, log into the backend and go to 'Dashboard → Updates', or use the WP-CLI command 'wp core version'. If your version is lower than 7.0.3 (or the patched version of your branch, such as 6.9.6), you are affected.

What should I do right now to protect my website?

First, create a backup of your database and files, then immediately update to WordPress 7.0.3 or the patched version of your branch. Instruct all administrators not to click unexpected login or password-reset links, as this is exactly what the attack chain relies on. Additionally, consider using a Web Application Firewall and disabling the file editor by adding 'define('DISALLOW_FILE_EDIT', true);' to your wp-config.php.

How dangerous is the flaw really if an attacker needs no account?

The entry point (reflected XSS) is exploitable without login and is triggered by a single failed login attempt. However, full server takeover (Remote Code Execution) requires a logged-in administrator to be tricked via social engineering into clicking a crafted link. Unlike stored XSS, the attack does not spread on its own – it is a targeted attack, not an automatic drive-by, yet experts still rate the overall risk as high with a CVSS score of 8.9.

Is a firewall (WAF) enough, or do I still need to install the update?

A Web Application Firewall such as Patchstack or Wordfence is a useful additional layer of protection, but it is not a substitute for the update. According to Patchstack, standard WAFs block only 26 percent of WordPress-specific attacks on average. The patch itself remains the most important and effective measure.

Do I have to report an incident to the data protection authority (GDPR)?

If the attack chain is successfully exploited, the attacker gains full control of the server and access to all personal data in the database. Such a data breach must be reported to the competent supervisory authority without undue delay under Article 33 GDPR, and no later than 72 hours after becoming aware of it. If there is a high risk to affected individuals, you must also inform them under Article 34 GDPR – and the website operator remains responsible even if technical maintenance is outsourced.