WordPress core login page has been hit by a high-severity reflected XSS vulnerability tracked as CVE-2026-64638, dubbed XSS2Shell by researchers. The issue affects every supported version and requires no credentials to trigger, enabling attackers to execute JavaScript in the site origin and potentially seize full server control.
At 2 a.m., a cross-border e-commerce operator was awakened by monitoring alerts after an unknown administrator account appeared on his three-year-old WordPress site alongside an unrecognized plugin file. Despite using a 16-character random password and IP whitelisting, the attacker had bypassed all defenses through the daily login page itself.
Vulnerability Mechanics
On August 6, WordPress released version 7.0.3 containing the fix for CVE-2026-64638 (CVSS 8.9). The root cause lies in inconsistent HTML filtering on the login form: when a nonexistent username is submitted, the entered value is reflected in the error message. One sanitization pass treats a crafted tag as cleaned, while the second pass renders it as executable HTML, allowing the payload to persist and run.
Imperva telemetry shows organized automated attacks targeting more than 11,000 sites across 67 countries, generating hundreds of thousands of requests. 95 percent of observed tooling is written in Go; 75 percent of victims are U.S.-based, with gaming (32 percent), education (26 percent), and finance (24 percent) sectors hit hardest.
Attack Chain: From XSS to Shell
The exploit begins with a crafted username that triggers the reflected XSS. Once JavaScript executes under the site origin, the attacker leverages loaded WordPress scripts and the REST API to interact with the application. If an administrator session is active, the attacker can obtain an application password, create a malicious page, and upload a PHP backdoor plugin, completing server takeover.
Researchers note that the full chain benefits from social engineering, such as phishing emails disguised as official security notices. The attack path was assembled in roughly four days using open-source AI models and multi-agent workflows, highlighting the accelerating role of AI in exploit development.
Self-Check Steps for Administrators
- Verify version: Check the footer in the dashboard; upgrade 7.0.x to 7.0.3 and apply backports (6.9.6, 6.8.7, 6.7.6) down to the 4.7 branch.
- Audit accounts: Review the user list for unknown administrators and inspect Application Passwords for unauthorized entries.
- Inspect files: Examine the wp-content/plugins directory for unexpected additions and monitor file modification timestamps.
Organizations using Cloudflare or other WAF solutions should confirm that virtual patching rules for CVE-2026-64638 are active. The advisory reference is GHSA-52p2-r8wf-jcrf.
