CVE-2026-64638
Received Received - Intake

Pre-auth reflected XSS in WordPress login screen

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: HackerOne

Description
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-64638
EUVD
EUVD-2026-54565

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
wordpress wordpress From 4.7 (inc)
wordpress wordpress 7.0.3
wordpress wordpress to 7.0.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a pre-authentication reflected XSS vulnerability on WordPress's login screen. An attacker can trick a victim into clicking a malicious link, which executes arbitrary JavaScript in the victim's browser. Under specific conditions, this could escalate to remote code execution (RCE) if the victim interacts with the crafted site.

Detection Guidance

Detecting this vulnerability requires checking WordPress version and monitoring for unusual login screen behavior. Check your WordPress version via Dashboard > Updates or by viewing the readme.html file. Commands like curl -s https://yoursite.com/wp-login.php | grep -i 'wordpress' can help identify the version. Monitor network traffic for suspicious requests targeting the login page.

Impact Analysis

An attacker could steal session cookies, perform actions on your behalf, or redirect you to malicious sites. If the XSS escalates to RCE, the attacker could gain full control over your WordPress site without needing authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Immediately update WordPress to version 7.0.3 or later. This can be done via the WordPress Dashboard under Updates or by downloading the latest version from WordPress.org. Enable automatic background updates if not already configured. If using older branches, apply the backported fixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64638. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart