{"uuid": "94334372-fb00-4cfe-86e6-4100599e005b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117055999686008089", "content": "\ud83d\udea8 WordPress patches XSS2Shell flaw that could lead to server code execution\nCVE-2026-64638 is a CVSS 8.9 pre-authentication XSS vulnerability in the WordPress login screen.\nThe XSS itself requires no account. Researchers at pwn.ai demonstrated how it can be chained against a logged-in administrator to reach PHP code execution after social engineering the admin into interacting with an attacker-controlled page.\nA successful chain could potentially allow attackers to:\n\u2022 Create API credentials\u2022 Gain authenticated REST access\u2022 Upload malicious plugin files\u2022 Execute PHP on the server\u2022 Access WordPress secrets and database credentials\nWordPress 7.0.3 fixes the flaw, with patches backported through the 4.7 branch.\nNHS England says exploitation is likely following the release of technical details and a PoC.\nWordPress has not reported confirmed exploitation in the wild as of August 7.\nUpdate immediately.", "creation_timestamp": "2026-08-07T20:00:08.521568Z"}