WordPress has corrected a high-severity vulnerability in its core that can transform a simple malicious login attempt into remote PHP code execution on the server.
The issue, registered as CVE-2026-64638 and assigned a CVSS score of 8.9, has been named XSS2Shell. It originates as a reflected cross-site scripting flaw on the authentication screen. An attacker without an account can submit a specially prepared username that evades sanitization filters and is interpreted as HTML content by the browser.
The exploit chain relies on a difference in how certain PHP functions and WordPress itself handle specific characters. This allows the attacker to insert controlled elements into the login page and progress to JavaScript execution within the site domain.
The impact escalates when an already authenticated administrator visits a page prepared by the attacker. In this scenario, the technique can abuse the existing session to authorize application credentials and proceed to uploading malicious PHP code to the server.
WordPress addressed the problem in version 7.0.3, released on August 6. Patches were also made available for earlier branches, extending back to the 4.7 line. At the time of disclosure, no confirmed exploitation in real-world attacks had been observed, although the availability of technical details makes the update a priority for site administrators.
