🔴 Critical | Source: The Hacker News
A pre-authentication reflected XSS vulnerability (CVE-2026-64638, CVSS 8.9) has been discovered in the WordPress login screen, affecting all versions of the CMS. Researchers at pwn.ai demonstrated that the flaw can be chained to achieve remote PHP code execution on the server, requiring only that a logged-in administrator visits an attacker-controlled page. WordPress has released a patch and organisations should treat this as an urgent update given the low barrier to initial exploitation.
Security Architect’s Take: Prioritise patching all WordPress instances immediately — particularly those hosted on cloud infrastructure or serving as entry points to wider environments. In the interim, consider deploying a WAF rule to block reflected XSS payloads targeting the WordPress login endpoint, and restrict wp-login.php access by IP where operationally feasible.
Original advisory: New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP