A critical pre-authentication reflected Cross-Site Scripting (XSS) vulnerability has been identified in **WordPress**, impacting all versions of the popular Content Management System. The flaw, designated **CVE-2026-64638** with a CVSS score of 8.9, requires no attacker privileges and allows for potential PHP code execution. ### The XSS2Shell Attack Chain Security researchers at **pwn.ai** discovered and demonstrated how this XSS vulnerability, present on the login screen, can be escalated into a full Remote Code Execution (RCE) chain. The attack, which they've named **XSS2Shell**, requires a logged-in administrator to interact with an attacker-controlled page, typically via a single click. **pwn.ai** reported that the XSS component itself requires no authentication. A specially crafted username, when used in a failed login attempt, triggers JavaScript execution on the resulting error page without further user interaction. According to the researchers, the exploit works against default **WordPress** installations and does not rely on unusual hosting configurations. They detailed multiple paths from the initial XSS to code execution, including methods involving plugin installation or arbitrary ZIP file uploads. ### WordPress's Stance on Exploitability **WordPress** acknowledged the vulnerability but offered a more conservative assessment of its exploitability, noting that RCE escalation depends on conditions outside an attacker's control and necessitates successful social engineering coupled with explicit victim interaction. ### Immediate Patching Recommended The issue was addressed on August 6 with the release of **WordPress 7.0.3**. Fixes have been backported to versions as far back as the 4.7 branch. **WordPress** strongly recommends immediate updates for all users. Sites configured for automatic background updates should receive the security release without manual intervention. Versions older than 4.7 remain vulnerable and are outside the project's current backport scope. ### How the Flaw Works The vulnerability originates in how **WordPress** processes usernames from failed login attempts. The username value passes through `sanitize_user()` and `wp_strip_all_tags()`, which relies on PHP's `strip_tags()`. A tag-like string containing whitespace after the opening `<` character can bypass these sanitization functions, surviving as plain text. Crucially, when the same value is later processed by `wp_kses_post()`, its separate parser interprets this input as permitted HTML, leading to attacker-controlled live DOM elements on the failed-login page. These injected elements then interact with `user-profile.js`, a profile-management script inadvertently loaded on the login page due to its role in password resets. The script's expectation of certain profile elements, which are absent on the login page, can be manipulated. Specifically, two missing inputs resolve to `undefined`, allowing an equality check to pass, and the `ajaxurl` variable can be clobbered with an injected DOM element. This redirection steers **WordPress**'s own JavaScript towards an attacker-selected same-origin REST request. To execute JavaScript within the site's origin, the researchers leveraged **WordPress**'s REST JSONP support. For deployments where anonymous REST requests typically return an HTTP 401, the `_envelope=1` parameter can wrap the denial in an outer HTTP 200 response, enabling **jQuery** to continue processing the response as script. Notably, the researchers found that even a nonce-based Content Security Policy (CSP) using `strict-dynamic` did not block the demonstrated attack path. ### Escalation to PHP Execution The path from XSS to PHP code execution builds upon **Paulos Yibelo**'s 2022 Same Origin Method Execution (SOME) research. One method demonstrated by **pwn.ai** uses the **WordPress**-origin XSS to invoke the native Application Password approval control within a logged-in Administrator's session. This process creates an API credential and redirects it to an attacker-specified HTTPS `success_url`. **Application Passwords** are designed for API access and are revocable, meaning this attack does not require stealing the administrator's primary password. The researchers then used this newly generated credential for authenticated REST access to publish a **WordPress** page containing same-origin JavaScript. When the retained administrator session opened this page, the embedded script obtained **WordPress**'s plugin-upload nonce and uploaded an attacker-supplied ZIP file. PHP could then be requested directly from the extracted plugin, even without activation. ### Responsible Disclosure and Impact **pwn.ai**'s autonomous system discovered and reproduced this vulnerability chain after being seeded with **Paulos Yibelo**'s SOME research. The process took approximately four days using open-source models and a multi-agent workflow. The chain was reproduced on July 26 and reported to **WordPress** the following day. Successful PHP execution could lead to the exposure of **WordPress** database credentials in `wp-config.php`, enable persistent administrator creation and content modifications, expose files and secrets readable by the PHP worker, and permit operating-system commands with the worker's privileges. **WordPress** has credited the **pwn.ai** team for their discovery and responsible disclosure. As of August 7, there are no reports of in-the-wild exploitation.