## https://sploitus.com/exploit?id=FB2615B4-8EAD-57A1-85A4-8DC9057C2E9A
# 🛡️ CVE-2026-64638 - `XSS2Shell`
### WordPress Pre-Authentication Reflected XSS
**with potential escalation to PHP Code Execution**
---
## 📌 Overview
**CVE-2026-64638** is a high-severity **pre-authentication reflected Cross-Site Scripting (XSS)** vulnerability affecting the WordPress login screen.
Under specific conditions, the flaw can be chained into **Remote Code Execution (RCE)** on the server (researchers call the chain **XSS2Shell**).
| Attribute | Details |
|------------------------|----------------------------------------------|
| **CVE ID** | CVE-2026-64638 |
| **Severity** | High (CVSS 8.9) |
| **Attack Vector** | Network |
| **Privileges Required**| None |
| **User Interaction** | Required (for full RCE chain) |
| **Impact** | Confidentiality • Integrity • Availability |
---
## 🔍 Technical Summary
The vulnerability exists in the way WordPress handles the **username** on a failed login attempt.
- Input passes through `sanitize_user()` and `wp_strip_all_tags()` (which relies on PHP’s `strip_tags()`).
- Later processing with `wp_kses_post()` allows certain tag-like payloads containing whitespace to survive and become **live DOM elements**.
- These elements interact with WordPress’s own JavaScript (`user-profile.js`) loaded on the login page.
- Attackers can leverage REST API / JSONP behavior and same-origin techniques to escalate further.
**Full RCE path** requires:
1. A victim already logged in as a **single-site Administrator**
2. Explicit interaction (typically one click) with an attacker-controlled page
3. Specific WordPress features aligned (Application Passwords, plugin upload capability, etc.)
> ⚠️ WordPress notes that successful escalation to RCE depends on conditions **outside the attacker’s full control** and requires social engineering.
---
## 📦 Affected & Patched Versions
| Branch | Affected Versions | Patched Version |
|------------|-----------------------|-----------------|
| 7.0.x | 7.0.0 – 7.0.2 | **7.0.3** |
| 6.9.x | 6.9.0 – 6.9.5 | 6.9.6 |
| 6.8.x | 6.8.0 – 6.8.6 | 6.8.7 |
| … | … | … |
| 4.7.x | 4.7.0 – 4.7.33 | **4.7.34** |
- All versions from **4.7.0 through 7.0.2** are affected.
- Versions older than 4.7 remain vulnerable but fall outside current backport support.
---
## ✅ Mitigation & Recommendations
### 🚨 Update Immediately
- Upgrade to **WordPress 7.0.3** (or the corresponding security release on your branch).
- Sites with **automatic background updates** enabled should receive the fix automatically.
- Do **not** rely solely on hardening plugins or CSP as complete mitigation — the core patch is required.
- Advise administrators to avoid clicking unsolicited links while logged into the WordPress dashboard.
---
## 📎 Official References
- **GitHub Security Advisory**
[GHSA-52p2-r8wf-jcrf](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-52p2-r8wf-jcrf)
- **WordPress 7.0.3 Release**
[wordpress.org/news/2026/08/wordpress-7-0-3-release/](https://wordpress.org/news/2026/08/wordpress-7-0-3-release/)
- **Technical Analysis**
[The Hacker News – New WordPress Pre-Auth XSS](https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html)
---
**Stay safe. Patch early. Verify your WordPress version today.**
`wp core version` · Check for updates in the admin dashboard