Tag: CVE-2026-64638
WordPress ships emergency fix for pre-auth XSS to RCE chain
WordPress ships an emergency fix for a pre-auth XSS chain that ends in PHP code execution.
Login page quirk lets attackers seize WordPress servers remotely
A pre-auth XSS chain that needs only a crafted username ends in PHP code execution on stock installs.