WordPress XSS2Shell Flaw Enables Remote Code Execution via Login Page

These injected elements are designed to match selectors that WordPress’s user-profile.js file searches for upon page load. This triggers a click event leading to an AJAX request. Through a technique called DOM clobbering, the attacker manipulates the destination URL of this request. By targeting WordPress’s REST API with method-override and JSONP parameters, the response returns executable JavaScript, granting the attacker arbitrary script execution within the WordPress origin, all without prior authentication.

While this reflected XSS is severe on its own, it can escalate to remote code execution under certain conditions. If an administrator is tricked into interacting with a malicious page, the attacker’s script can leverage the admin’s session to create a WordPress Application Password, publish a page containing malicious JavaScript using the admin’s unfiltered_html privileges, and upload a plugin ZIP file with a PHP web shell. This sequence is executed through legitimate, authenticated WordPress API calls without the admin’s explicit approval.

WordPress released an emergency fix in version 7.0.3 on August 6, 2026, addressing this vulnerability along with eleven other security patches. The fix has been backported to version 4.7, covering all branches still receiving security updates. There is currently no evidence of active exploitation or public proof-of-concept exploits. Site administrators are urged to update to WordPress 7.0.3 or the corresponding backported patch immediately, as managed hosts may apply updates automatically, but self-hosted sites often require manual intervention.

This vulnerability underscores the importance of rigorous input sanitization and the potential risks associated with parser inconsistencies. It also highlights the need for administrators to remain vigilant against social engineering tactics that can escalate such vulnerabilities to full system compromise.