What is CVE-2026-64638?
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).
Timeline
- 2026-08-07Published to the U.S. National Vulnerability Database (NVD)
- 2026-09-03NVD record last updated
Affected product
See advisory
Remediation Steps
- Update WordPress to the latest patched version immediately
- Review administrator browsing activity and access logs for suspicious activity
- If administrators visited untrusted links, audit server-side code changes and logs
- Implement content security policy (CSP) headers to mitigate XSS impact
- Restrict administrative access to trusted networks where feasible
References
Referenced in our briefings & reports
- Vulnerability Priority Report – Week 1 of August 2026 (August 3 – 9)
Related vulnerabilities
- CVE-2026-93836 (same weakness: CWE-79)
- CVE-2026-94504 (same weakness: CWE-79)
- CVE-2026-42897 – Microsoft Exchange Server (same weakness: CWE-79)
- CVE-2024-42009 – Roundcube Webmail (same weakness: CWE-79)
Browse all tracked CVEs in the defend.network CVE database →
🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.