Critical WordPress XSS2Shell Flaw Allows Remote Code Execution

Key Takeaways

• A critical vulnerability, dubbed XSS2Shell (CVE-2026-64638), affects WordPress Core, enabling remote code execution.
• The flaw impacts nearly all actively maintained WordPress installations, potentially exposing over 500 million websites.
• The attack chain begins with an unauthenticated login attempt and can escalate to full server compromise under specific conditions.
• WordPress released an emergency patch in version 7.0.3 and backported fixes to all versions from 4.7 onwards.

Critical XSS2Shell Flaw Threatens WordPress Installations

A severe vulnerability chain within WordPress Core, identified as CVE-2026-64638 and known as XSS2Shell, has been discovered. This critical flaw allows an attacker to achieve full remote code execution on the underlying server through a seemingly innocuous failed login attempt.

The widespread nature of this vulnerability stems from its presence in WordPress code that has existed since version 4.7. This means virtually every actively maintained WordPress installation, powering over 43% of all websites globally, was at risk. Estimates suggest more than 500 million sites were vulnerable before a corrective patch was deployed.

Unpacking the XSS2Shell Attack Chain

The attack sequence initiates on the standard login page, wp-login.php. When a non-existent username is submitted, WordPress generates an error message using its internal sanitization function, wp_strip_all_tags.

Security researchers at pwn.ai said they discovered that inserting a space between the opening angle bracket and a tag name, for instance, “< area”, causes PHP’s fundamental strip_tags parser to interpret the string as harmless text. Conversely, WordPress’s own KSES sanitizer subsequently reinterprets the exact same string as legitimate HTML elements. This discrepancy in parsing allows an attacker to inject live, attacker-controlled elements such as <area>, <div>, and <button> directly into the rendered login page, requiring no prior authentication or an existing account.

These injected elements are not scripts themselves. However, they are meticulously crafted to align with selectors that WordPress’s user-profile.js file automatically seeks upon page load. This script is a remnant of previous password-reset functionality. This interaction triggers a browser-side click event, which then cascades into an AJAX request. Through a technique known as DOM clobbering, the attacker’s injected element can hijack the destination URL of this request.

When directed at WordPress’s REST API with specific method-override and JSONP parameters, the request returns encapsulated in executable JavaScript. This grants the attacker arbitrary script execution within the WordPress origin, all achieved pre-authentication, as pwn.ai said.

Escalation to Remote Code Execution

While this reflected XSS alone poses a significant threat, both WordPress’s official advisory and independent analyses confirm that, under specific conditions, it can escalate to full remote code execution.

If a logged-in administrator is enticed to visit and interact with a malicious third-party webpage, the attacker’s script can leverage the administrator’s active session. This allows for the creation of a WordPress Application Password, the publication of a page containing attacker-controlled JavaScript utilizing the administrator’s unfiltered_html privileges, and ultimately, the upload of a plugin ZIP file containing a PHP web shell. All these actions are executed via legitimate, authenticated WordPress API calls that the administrator never explicitly authorized.

The official WordPress advisory clarifies that this escalation path necessitates social engineering and direct victim interaction, factors outside the attacker’s immediate control. Consequently, the CVE has been assigned a CVSS score of 8.9, rather than a maximum rating.

Patch Released and Historical Context

WordPress shipped an emergency fix in version 7.0.3, which was released on August 6, 2026. This release also included eleven other security patches. Given the severity of XSS2Shell, the WordPress security team backported the fix to all versions dating back to 4.7, ensuring coverage for every branch still receiving security updates.

At present, there is no evidence of active exploitation in the wild or a publicly available proof-of-concept exploit, according to vulnerability trackers monitoring the CVE. The underlying technique builds upon the 2022 Same Origin Method Execution (SOME) research published by Paulos Yibelo, which was initially utilized to bypass Content Security Policy protections on WordPress sites and was nominated for Top Web Hacking Technique of the year.

What You Should Do

• Update Immediately: Site owners and administrators should update their WordPress installations to version 7.0.3 or the corresponding backported patch without delay.
• Verify Automatic Updates: While many managed hosting providers apply these updates automatically, self-hosted sites often require manual intervention. Verify your site’s patch status.
• Educate Users: Administrators and content editors should be vigilant against social engineering attempts, avoiding interaction with suspicious third-party links or content.
• Monitor Logs: Regularly review access and error logs for any unusual activity or failed login attempts that could indicate attempted exploitation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.