WordPress XSS2Shell Flaw Enables Attackers to Achieve Remote Code Execution

WordPress has patched a high-severity vulnerability, tracked as CVE-2026-64638 and nicknamed XSS2Shell, that begins as an unauthenticated cross-site scripting bug on the login screen and can be chained into full remote code execution.

Researchers at pwn.ai discovered the flaw, which carries a CVSS score of 8.9 and affects every actively maintained WordPress branch, a codebase that powers more than 43% of websites globally.

The root cause is a parser disagreement inside WordPress’s own sanitization pipeline. When a visitor submits a nonexistent username at wp-login.php, WordPress echoes it back into an error message after running it through wp_strip_all_tags(), which wraps PHP’s strip_tags().

Critical WordPress Vulnerability

Inserting a space between an opening angle bracket and a tag name, such as < area, causes strip_tags() to treat the string as inert text, while WordPress’s separate KSES sanitizer later reinterprets the identical string as live HTML elements like <area>, <div>, and <button>.

Those injected elements don’t execute anything on their own, but they’re crafted to match selectors that user-profile.js, a script left over from the password-reset flow, automatically scans for on page load.

That triggers an auto-click cascade into an AJAX request, and through DOM clobbering, the attacker’s injected element hijacks the destination URL via jQuery’s ajaxurl variable.

Pointed at WordPress’s REST API with method-override and JSONP parameters, the response returns wrapped in executable JavaScript, granting the attacker script execution inside the WordPress origin entirely pre-authenticated, no account and no victim interaction required for this stage.

Escalating to RCE requires a logged-in single-site Administrator to visit an attacker-controlled page and click once. Building on a 2022 Same Origin Method Execution technique by researcher Paulos Yibelo, the chain uses the admin’s session to mint a WordPress Application Password.

Publish a page containing attacker JavaScript via the admin’s unfiltered_html capability, and finally upload a plugin ZIP containing a PHP web shell, all through legitimate, authenticated WordPress API calls.

PWN.ai stated that a successful chain could expose database credentials in wp-config.php and permit operating-system commands under the web server’s privileges.

WordPress’s own advisory frames the escalation cautiously, noting it depends on “conditions outside the attacker’s control” and requires successful social engineering plus explicit victim interaction.

WordPress shipped an emergency fix in version 7.0.3 on August 6, 2026, adding esc_html(), esc_url(), and esc_attr() calls in wp-includes/user.php and wp-login.php to close the parser disagreement.

The fix was backported to the 4.7 branch, bundled with 11 other security patches, and carried into the WordPress 7.1 RC2 branch. As of disclosure, there is no confirmed evidence of in-the-wild exploitation.

Site owners should update to 7.0.3 immediately; installations with automatic background updates should already have received it, though self-hosted sites often need manual intervention.

Administrators should also treat any unexpected Application Passwords or newly uploaded plugins as potential indicators of compromise.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world