Ethical Hacking News
Researchers at pwn.ai have identified a critical pre-authentication reflected cross-site scripting (XSS) vulnerability in WordPress that affects every version of the CMS and could potentially lead to remote code execution. The issue was patched on August 6, but older versions of the software remain vulnerable until updates are applied.
The recent discovery by pwn.ai researchers has identified a critical vulnerability in WordPress, a popular CMS that affects every version and potentially leads to remote code execution (RCE). The vulnerability is a pre-authentication reflected cross-site scripting (XSS) flaw that can be chained into PHP code execution on the server. The issue begins with how WordPress handles user input from failed login attempts, which can be tricked by attacker-controlled input and passed through to PHP's `strip_tags()` function. The vulnerability allows for the creation of attacker-controlled live DOM elements, interacting with WordPress's own scripts and enabling PHP code execution on the server. The issue does not require unusual hosting or deployment settings and is effective against default WordPress installations. A patch was released on August 6 in WordPress version 7.0.3, with fixes backported through the 4.7 branch, and updates are recommended immediately. Versions of WordPress older than 4.7 fall outside the project's current backport range and are considered vulnerable but not currently patchable by the regular update process.
A recent discovery by cybersecurity researchers at pwn.ai has shed light on a critical vulnerability in the popular content management system (CMS) WordPress, which could potentially lead to remote code execution (RCE). The identified flaw is a pre-authentication reflected cross-site scripting (XSS) vulnerability that affects every version of WordPress, rendering it vulnerable to exploitation by attackers.
The vulnerability was discovered by pwn.ai's researchers, who used an open-source model and multi-agent workflow to reproduce the attack chain. They demonstrated how the XSS could be chained into PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page. The research team utilized Paulos Yibelo's 2022 Same Origin Method Execution (SOME) research as a starting point for their investigation.
According to the researchers, the vulnerability begins in the way WordPress handles user input from failed login attempts. When a username is entered incorrectly, it passes through `sanitize_user()` and `wp_strip_all_tags()`, relying on PHP's `strip_tags()` function. However, this parser can be tricked by a tag-like string containing whitespace after the opening `<` character, allowing the attacker-controlled input to survive as text. Later, WordPress passes this value through `wp_kses_post()`, which interprets it as permitted HTML.
This allows for the creation of attacker-controlled live DOM elements on the failed-login page, interacting with WordPress's own `user-profile.js` script that is also loaded on the login page due to password resets being handled on the same page. Specifically, certain profile elements are absent from this script, resulting in undefined variables that can be clobbered with injected DOM elements.
The injected DOM element steers the JavaScript toward an attacker-selected same-origin REST request using WordPress's REST JSONP support. For deployments where anonymous REST requests return HTTP 401, a specially crafted `envelope=1` parameter allows for wrapping the denial of service response in an outer HTTP 200 response, enabling jQuery to continue processing the response as script.
This demonstrates how the attack chain can reach PHP code execution on the server. The researchers found that the vulnerability does not require unusual hosting or deployment settings and is effective against default WordPress installations.
The issue was patched on August 6 in WordPress version 7.0.3, with fixes backported through the 4.7 branch. WordPress recommends updating immediately, particularly for sites that support automatic background updates, which should receive the security release automatically.
Versions of WordPress older than 4.7 fall outside the project's current backport range and are considered vulnerable but not currently patchable by the regular update process. The researchers emphasized the need to apply the security update promptly as a best practice.
The researchers at pwn.ai were credited with discovering and responsibly disclosing the vulnerability, which was assigned the CVE-2026-64638 identifier and carries a CVSS score of 8.9 for its severity. At this time, there are no reported instances of in-the-wild exploitation of this vulnerability.
In conclusion, this newly discovered XSS flaw highlights the importance of applying security updates to content management systems promptly, as it could lead to remote code execution if exploited by an attacker.
Related Information:
https://www.ethicalhackingnews.com/articles/New-Vulnerability-Discovered-in-WordPress-Login-Screen-Could-Allow-Remote-Code-Execution-ehn.shtml
https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html
https://nvd.nist.gov/vuln/detail/CVE-2026-64638
https://www.cvedetails.com/cve/CVE-2026-64638/
Published: Fri Aug 7 09:53:25 2026 by llama3.2 3B Q4_K_M
