Skip to content
WordPress Vulnerability XSS2Shell Leads to Remote Code Execution

WordPress Vulnerability XSS2Shell Leads to Remote Code Execution

First seen 4 Nov 2026, 02:48 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 4, 2026 at 02:49 UTC

A vulnerability in WordPress, identified as CVE-2026-64638, allows remote code execution via a pre-authentication cross-site scripting (XSS) attack. Disclosed by pwn.ai in August 2026, the flaw affects all versions of WordPress Core, impacting over 500 million websites. The vulnerability arises from improper handling of user input in the login error messages, which can be exploited by attackers without needing an account. WordPress has released a patch in version 7.0.3 to address this issue, which has been present since the earliest versions of the software. Administrators are urged to update their installations immediately to mitigate the risk of exploitation. The vulnerability's discovery utilized a novel exploitation technique known as Same Origin Method Execution (SOME).

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 2h ago How this analysis works

Timeline

2026-08-07
CVE-2026-64638 published
The vulnerability was disclosed with a CVSS score of 8.9, indicating a high severity level.
pwn.ai
2026-11-03
Emergency patch released
WordPress released version 7.0.3 to address the XSS to RCE vulnerability affecting all supported versions.
Tryhackme

More articles in this cluster (3)

Following this threat?

Track CVE-2026-64638 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 3

Common questions

Which versions of WordPress are affected?
All versions of WordPress Core are affected, including those as far back as version 4.7.
How urgent is the patch?
The patch is critical; all WordPress administrators are urged to update immediately to prevent exploitation.
What is the nature of the attack?
The attack exploits a reflected XSS vulnerability that can lead to remote code execution without user authentication.