WordPress administrators should treat the login page as a patch priority. A pre-authentication flaw fixed in version 7.0.3 can be chained all the way to PHP code execution, and the fix has been backported to every maintained branch down to 4.7. The vulnerability is tracked as CVE-2026-64638 with a CVSS score of 8.9.
The chain needs almost nothing from the victim, according to researchers at pwn.ai. A crafted username typed into the login form survives the first sanitization pass because PHP’s strip_tags() and WordPress’s wp_kses_post() parse the same string differently. The injected element then becomes window.ajaxurl in the browser’s eyes, a DOM clobbering move that makes WordPress’s own script fire the attacker’s request.
From there the attack walks a JSONP callback across browser windows, lands a click inside a logged-in administrator’s session, and gets that admin to approve a fresh application password. The credential unlocks the REST API. The final steps are publishing a page with attacker JavaScript and uploading a plugin stuffed with arbitrary PHP.
No authentication is needed and no interaction beyond following a link. The researchers reported the chain on July 27, and WordPress shipped the fix on August 6.
