WordPress <7.0.3 Preauth Reflected XSS / RCE on Login
CVE-2026-64638 Published on August 7, 2026
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-64638 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-64638
Want to know whenever a new CVE is published for WordPress? stack.watch will email you.
Affected Versions
WordPress:- Before 7.0.3 is unaffected.