Description
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim.
This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.
Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WordPress | WordPress | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 7.0.3+dfsg1-1 | — |
| Debian 13 | wordpress | 6.8.7+dfsg1-0+deb13u1 | — |
| Debian 12 | wordpress | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | wordpress | No fix yet | — |
| Ubuntu 26.04 LTS | wordpress | No fix yet | — |
| Ubuntu 24.04 LTS | wordpress | No fix yet | — |
| Ubuntu 22.04 LTS | wordpress | No fix yet | — |
| Ubuntu 20.04 LTS | wordpress | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | wordpress | No fix yet | — |
| Ubuntu 16.04 LTS | wordpress | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 27 repositories · most starred shown
-
Boreas37/CVE-2026-64638-PoC-XSS2Shell- ★ 130 · Aug 7, 2026
XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE chain — PoC exploit + defensive audit tool + nuclei template
-
imbas007/CVE-2026-64638-POC ★ 15 · Aug 8, 2026
CVE-2026-64638: WordPress Pre-auth XSS → RCE (XSS2Shell) PoC
-
wordsec/XSS2Shell ★ 6 · Aug 7, 2026
Wordpress Pre-auth XSS to RCE exploit PoC (xss2shell & CVE-2026-64638)
-
0xlipon/xss2shell ★ 3 · Aug 9, 2026
🔥 XSS2Shell — CVE-2026-64638 Scanner & PoC Toolkit
-
eh-amish/CVE-2026-64638-XSS-to-Shell-PoC ★ 3 · Aug 9, 2026
-
ashrafzaryouh/CVE-2026-64638 ★ 3 · Aug 7, 2026
CVE-2026-64638
-
renzi25031469/CVE-2026-64638-WordPress-Core-XSS2Shell ★ 3 · Aug 7, 2026
Template Nuclei para detecção não-intrusiva do XSS2Shell, um parser differential pré-autenticado no WordPress Core que permite injeção de elementos DOM na página de login, servindo de base para uma c…
-
HackSpeak/CVE-2026-64638 ★ 2 · Aug 8, 2026
XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE PoC mirror — WordSec, MIT; for authorized security testing
-
tc4dy/CVE-2026-64638-PoC-Exploit ★ 2 · Aug 8, 2026
CVE-2026-64638 - WordPress Security Assessment Suite (CVSS 8.9) | WordPress 4.7.0-7.0.2 pentest toolkit. Includes vulnerability assessment & advanced analysis modules. Safe Check & Exploit, 2 mode. A…
-
5yu4n/CVE-2026-64638 ★ 2 · Aug 7, 2026
CVE-2026-64638
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell) http/cves/2026/CVE-2026-64638.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- WID-SEC-2026-2701 WordPress: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 21, 2026