Every version of WordPress has been exposed by a reflected XSS bug on the login screen that needs no authentication to trigger. The project shipped a fix in 7.0.3 on August 6, backported through the 4.7 branch. The flaw is tracked as CVE-2026-64638 with a CVSS score of 8.9.
Security firm pwn.ai demonstrated how the flaw chains into PHP code execution when a logged-in administrator interacts with an attacker-controlled page. The attack works against default installations and requires no unusual hosting settings.
The root cause is a parsing discrepancy: a crafted username passes through sanitize_user() and wp_strip_all_tags() as plain text, but wp_kses_post() later interprets the same input as permitted HTML. The researchers used DOM clobbering and WordPress’s own user-profile.js to trigger a cross-window click inside an admin session, obtaining an application password that the REST API accepts from any origin. From there, an attacker can upload a plugin containing arbitrary PHP.
pwn.ai said its autonomous system reproduced the chain in nearly four days using open-source models, reporting it to WordPress on July 27. Versions older than 4.7 remain affected but fall outside the project’s backport range. Sites should update immediately.
