WordPress Login Flaw Could Lead to Server Takeover

WordPress has released an urgent security update for a high-severity vulnerability affecting its login page.

Tracked as CVE-2026-64638, the flaw is a pre-authentication reflected cross-site scripting (XSS) vulnerability. An attacker does not need a WordPress account to exploit the XSS itself.

Researchers at pwn.ai demonstrated how the vulnerability could be chained into PHP code execution, potentially giving an attacker control over the affected server.

How the Attack Works

The vulnerability allows a crafted username submitted through the WordPress login page to trigger malicious JavaScript in the visitor’s browser.

The XSS does not automatically provide complete control of the website. To reach PHP code execution, an attacker would need to target someone already signed in as a WordPress administrator and convince them to interact with a malicious webpage.

In the demonstrated attack, one click could allow the attacker to create an application password, upload a malicious plugin file and execute PHP code on the server.

Why It Matters

Successful exploitation could allow attackers to:

• Create persistent administrator accounts
• Change or delete website content
• Access WordPress database credentials
• Upload malicious files or plugins
• View files and secrets available to the web server
• Execute operating-system commands with the PHP worker’s permissions

This could lead to website compromise, data theft, malware distribution or further attacks against the hosting environment.

What Businesses Should Do

• Update WordPress immediately through Dashboard → Updates
• Install WordPress 7.0.3 or the newest security release available for your branch
• Confirm that automatic background updates completed successfully
• Upgrade sites running unsupported WordPress versions
• Review administrator accounts, application passwords and recently installed plugins
• Check server and WordPress logs for unexpected login requests or file uploads
• Maintain a tested backup that is stored separately from the website

WordPress released version 7.0.3 on August 6 and began backporting the fixes to maintained branches through version 4.7. WordPress recommends that administrators update their sites immediately. WordPress security release

At the time of public disclosure, there were no confirmed reports of the vulnerability being exploited in the wild. However, technical details are now publicly available, making prompt patching especially important. Technical research from pwn.ai

Keeping WordPress Core, plugins and themes updated remains one of the most effective ways to protect a website from known vulnerabilities.

Need help securing or maintaining your business systems? Britec helps.