CVE-2026-64638
Published:August 07, 2026
Updated:September 01, 2026
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by "the team at pwn.ai" (https://pwn.ai/).
Affected Packages
https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=5.0 <5.0.26Fix Suggestion:
Update to version 5.0.26https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=5.8 <5.8.14Fix Suggestion:
Update to version 5.8.14https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=5.7 <5.7.16Fix Suggestion:
Update to version 5.7.16https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=5.9 <5.9.15Fix Suggestion:
Update to version 5.9.15https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=4.8 <4.8.29Fix Suggestion:
Update to version 4.8.29https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=5.5 <5.5.19Fix Suggestion:
Update to version 5.5.19https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=6.1 <6.1.11Fix Suggestion:
Update to version 6.1.11https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=4.7 <4.7.34Fix Suggestion:
Update to version 4.7.34https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=7.0 <7.0.3Fix Suggestion:
Update to version 7.0.3https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=5.4 <5.4.20Fix Suggestion:
Update to version 5.4.20https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=6.4 <6.4.9Fix Suggestion:
Update to version 6.4.9https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=6.0 <6.0.13Fix Suggestion:
Update to version 6.0.13https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=6.6 <6.6.6Fix Suggestion:
Update to version 6.6.6https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=6.9 <6.9.6Fix Suggestion:
Update to version 6.9.6https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=6.7 <6.7.6Fix Suggestion:
Update to version 6.7.6https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=5.1 <5.1.23Fix Suggestion:
Update to version 5.1.23https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=5.6 <5.6.18Fix Suggestion:
Update to version 5.6.18https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=6.8 <6.8.7Fix Suggestion:
Update to version 6.8.7https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=4.9 <4.9.30Fix Suggestion:
Update to version 4.9.30https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=5.3 <5.3.22Fix Suggestion:
Update to version 5.3.22https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=6.5 <6.5.9Fix Suggestion:
Update to version 6.5.9https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=6.3 <6.3.9Fix Suggestion:
Update to version 6.3.9https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=5.2 <5.2.25Fix Suggestion:
Update to version 5.2.25https://github.com/WordPress/WordPress.git (GITHUB):
Affected version(s) >=6.2 <6.2.10Fix Suggestion:
Update to version 6.2.10roots/wordpress (PHP):
Affected version(s) >=5.8 <5.8.14Fix Suggestion:
Update to version 5.8.14roots/wordpress (PHP):
Affected version(s) >=5.4 <5.4.20Fix Suggestion:
Update to version 5.4.20roots/wordpress (PHP):
Affected version(s) >=6.7 <6.7.6Fix Suggestion:
Update to version 6.7.6roots/wordpress (PHP):
Affected version(s) >=5.1 <5.1.23Fix Suggestion:
Update to version 5.1.23roots/wordpress (PHP):
Affected version(s) >=4.9 <4.9.30Fix Suggestion:
Update to version 4.9.30roots/wordpress (PHP):
Affected version(s) >=6.2 <6.2.10Fix Suggestion:
Update to version 6.2.10roots/wordpress (PHP):
Affected version(s) >=5.5 <5.5.19Fix Suggestion:
Update to version 5.5.19roots/wordpress (PHP):
Affected version(s) >=6.4 <6.4.9Fix Suggestion:
Update to version 6.4.9roots/wordpress (PHP):
Affected version(s) >=4.7 <4.7.34Fix Suggestion:
Update to version 4.7.34roots/wordpress (PHP):
Affected version(s) >=5.7 <5.7.16Fix Suggestion:
Update to version 5.7.16roots/wordpress (PHP):
Affected version(s) >=6.9 <6.9.6Fix Suggestion:
Update to version 6.9.6roots/wordpress (PHP):
Affected version(s) >=5.0 <5.0.26Fix Suggestion:
Update to version 5.0.26roots/wordpress (PHP):
Affected version(s) >=6.3 <6.3.9Fix Suggestion:
Update to version 6.3.9roots/wordpress (PHP):
Affected version(s) >=6.8 <6.8.7Fix Suggestion:
Update to version 6.8.7roots/wordpress (PHP):
Affected version(s) >=5.2 <5.2.25Fix Suggestion:
Update to version 5.2.25roots/wordpress (PHP):
Affected version(s) >=4.8 <4.8.29Fix Suggestion:
Update to version 4.8.29roots/wordpress (PHP):
Affected version(s) >=5.3 <5.3.22Fix Suggestion:
Update to version 5.3.22roots/wordpress (PHP):
Affected version(s) >=6.5 <6.5.9Fix Suggestion:
Update to version 6.5.9roots/wordpress (PHP):
Affected version(s) >=7.0 <7.0.3Fix Suggestion:
Update to version 7.0.3roots/wordpress (PHP):
Affected version(s) >=6.0 <6.0.13Fix Suggestion:
Update to version 6.0.13roots/wordpress (PHP):
Affected version(s) >=6.1 <6.1.11Fix Suggestion:
Update to version 6.1.11roots/wordpress (PHP):
Affected version(s) >=5.6 <5.6.18Fix Suggestion:
Update to version 5.6.18roots/wordpress (PHP):
Affected version(s) >=6.6 <6.6.6Fix Suggestion:
Update to version 6.6.6roots/wordpress (PHP):
Affected version(s) >=5.9 <5.9.15Fix Suggestion:
Update to version 5.9.15Additional Notes
The description of this vulnerability differs from MITRE.
Related Resources (2)
Do you need more information?
Contact UsCVSS v4
Base Score:
8.9
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
ACTIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
HIGH
Subsequent System Availability
HIGH
CVSS v3
Base Score:
8.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS
Base Score:
31.20