Every version of WordPress has been exposed by a reflected XSS bug on the login screen that needs no authentication to trigger. WordPress released the patch in 7.0.3 on August 6, with fixes carried back to the 4.7 branch. The flaw is tracked as CVE-2026-64638 with a CVSS score of 8.9.
pwn.ai showed the bug chaining into server-side PHP code execution once a logged-in administrator touches a page the attacker controls. Out-of-the-box WordPress installs are vulnerable, with no special hosting configuration required.
The root cause is a parsing discrepancy: a crafted username passes through sanitize_user() and wp_strip_all_tags() as plain text, but wp_kses_post() later interprets the same input as permitted HTML. The researchers used DOM clobbering and WordPress’s own user-profile.js to trigger a cross-window click inside an admin session, obtaining an application password that the REST API accepts from any origin. From there, an attacker can upload a plugin containing arbitrary PHP.
pwn.ai said its autonomous system reproduced the chain in nearly four days using open-source models, reporting it to WordPress on July 27. Releases before 4.7 are still vulnerable but sit beyond the project’s backport window. Sites should update immediately.
