CVE-2026-64638 Explained: How WordPress Pre-Auth XSS Can Lead to PHP Execution | The CyberSec Guru
thecybersecguru.com
Learn how CVE-2026-64638 affects WordPress, why the pre-authentication XSS is dangerous, how researchers chained it to PHP code execution using XSS2Shell

cross-posted from: https://lemmy.world/post/50408091

WordPress has released security updates for CVE-2026-64638, a high-severity vulnerability affecting the login page that has been patched in WordPress 7.0.3 and backported to supported branches. The bug itself is a pre-authentication reflected XSS caused by a parser differential between WordPress’s input handling and HTML sanitization pipeline. According to the published research, malformed input survives strip_tags() but is later interpreted as valid HTML by wp_kses_post(), allowing attacker-controlled DOM elements to be injected into the failed login page.