A newly disclosed vulnerability chain in WordPress Core shows how a single failed login attempt can, under the right conditions, be turned into complete remote code execution on the server hosting the site. The flaw, tracked as CVE-2026-64638 and nicknamed XSS2Shell by the researchers at pwn.ai who found it, has existed in WordPress since version 4.7, meaning it has quietly shipped with the platform for close to a decade and touched nearly every actively maintained WordPress install. Given that WordPress powers well over 40% of all websites, researchers estimate the exposure at more than 500 million sites before a fix became available.

A Parser Disagreement on the Login Page

The chain starts somewhere almost every visitor has encountered: the ordinary wp-login.php form. When someone submits a username that doesn’t exist, WordPress builds an error message using a sanitization function called wp_strip_all_tags. Researchers found that inserting a stray space between an opening angle bracket and a tag name, for example writing < area instead of <area, causes PHP’s underlying tag-stripping parser to treat the string as harmless text. WordPress’s separate KSES sanitizer, however, later reinterprets that same string as legitimate HTML. That disagreement between two layers of sanitization lets an attacker smuggle live, attacker-controlled HTML elements straight into the rendered login page, with no account and no authentication required at all.

From Injected HTML to Hijacked Requests

On their own, those injected elements aren’t scripts. But they’re deliberately shaped to match selectors that a leftover WordPress script, part of the password-reset functionality, automatically scans for when the login page loads. That causes the browser to fire a click event that cascades into an AJAX request. Using a technique known as DOM clobbering, the attacker’s injected element then hijacks the destination of that request, redirecting it toward WordPress’s own REST API with parameters that cause the response to come back wrapped in executable JavaScript. The end result is arbitrary script execution inside the WordPress site’s own origin, achieved entirely pre-authentication.

Escalating to a Web Shell

That reflected cross-site scripting bug would already be serious on its own, but researchers and WordPress’s own advisory confirmed a path to full remote code execution under specific conditions. If a logged-in site administrator can be lured to a malicious external page and interacts with it, the attacker’s script can ride along on that admin’s active session. From there it can mint a WordPress Application Password, publish a page containing attacker-controlled JavaScript using the administrator’s unfiltered HTML privileges, and finally upload a plugin package containing a PHP web shell, all through legitimate, authenticated WordPress API calls the administrator never knowingly approved.

Because this final escalation step depends on social engineering and direct victim interaction, factors outside an attacker’s full control, WordPress’s security team assigned the flaw a CVSS score of 8.9 rather than a maximum rating. Even so, the pre-authentication XSS component alone is dangerous enough to warrant urgent attention.

Patch Status and Exposure

WordPress shipped an emergency fix in version 7.0.3, released August 6, 2026, alongside eleven other security patches bundled into the same release. Given the severity and the age of the flaw, the WordPress security team took the unusual step of backporting the fix all the way back to version 4.7, covering every branch still receiving security updates. As of the disclosure, there is no confirmed evidence of active exploitation in the wild, and no public proof-of-concept has surfaced from vulnerability trackers monitoring the CVE.

What Site Owners Should Do

• Update to WordPress 7.0.3, or the corresponding backported patch for older branches, as soon as possible.
• Check whether your host applies WordPress core updates automatically; many managed hosting providers do, but self-hosted installations often require manual action.
• Administrators should be cautious about interacting with unfamiliar third-party pages while logged into the WordPress dashboard, since the most severe escalation path relies on tricking an authenticated admin.
• Review recently installed plugins and application passwords for anything unrecognized, particularly on sites that have not yet applied the patch.

Interestingly, the underlying technique builds on a 2022 research method called Same Origin Method Execution, originally developed to bypass Content Security Policy protections and previously nominated for a top web hacking technique award. It’s a reminder that creative reuse of older research can still surface serious new vulnerabilities in software used by half the web, and that layered sanitization logic, if the layers don’t agree with each other, can become a vulnerability in its own right.