WordPress has recently addressed a significant security flaw affecting all versions of its content management system. This pre-authentication reflected cross-site scripting (XSS) vulnerability, identified as CVE-2026-64638 with a CVSS score of 8.9, could potentially lead to PHP code execution on the server under certain conditions.
The vulnerability allows attackers to execute malicious scripts on the login page without requiring authentication. While the XSS flaw can be exploited without user interaction, achieving code execution necessitates additional factors. Specifically, an attacker would need a logged-in administrator to click on a malicious link, combined with specific WordPress features and deployment configurations aligning perfectly.
The issue was rectified on August 6 with the release of WordPress 7.0.3, and patches have been backported to versions as far back as 4.7. Users are strongly advised to update their installations promptly. Sites with automatic background updates enabled should receive this security release automatically. However, versions older than 4.7 remain vulnerable and are outside the current support range.
The flaw originates from how WordPress processes usernames during failed login attempts. The input undergoes sanitization functions like sanitize_user() and wp_strip_all_tags(), which rely on PHP’s strip_tags(). An attacker can craft a string that bypasses these functions, leading to the injection of malicious elements into the DOM on the failed-login page.
These injected elements interact with WordPress’s user-profile.js, a script loaded on the login page to handle password resets. Due to missing profile elements, the script’s logic can be manipulated, allowing attackers to redirect WordPress’s JavaScript to execute attacker-controlled REST requests.
By leveraging WordPress’s REST JSONP support, attackers can transform these requests into JavaScript execution within the site’s origin. Even deployments that return HTTP 401 for anonymous REST requests can be circumvented using the _envelope=1 parameter, which wraps the denial in an HTTP 200 response, enabling continued script processing.
Notably, nonce-based Content Security Policies using strict-dynamic do not block this attack path, highlighting the need for comprehensive security measures.
The escalation from XSS to PHP code execution builds upon previous research into Same Origin Method Execution (SOME) techniques. In this scenario, the XSS vulnerability is exploited to invoke the native Application Password approval mechanism within an administrator’s session. This results in the creation of API credentials, which are then redirected to an attacker-controlled URL.
Application Passwords are designed for API access and can be revoked. However, this attack chain does not require stealing the administrator’s session, making it particularly insidious.
Given WordPress’s extensive use—powering over 41% of all websites—this vulnerability poses a substantial risk. Administrators should prioritize updating their installations to the latest version to mitigate potential exploits. Additionally, reviewing and tightening security configurations, such as Content Security Policies and REST API permissions, can provide further protection against similar vulnerabilities in the future.
