WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. pwn.ai demonstrated how the flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page.
Tracked as CVE-2026-64638 (CVSS score: 8.9), the High-severity vulnerability requires no attacker privileges. According to pwn.ai, which discovered the flaw and shared technical details with The Hacker News, the login-page XSS can execute without an account or additional victim interaction once the crafted request is delivered.
The code-execution path requires a victim already logged in as an Administrator and explicit interaction with an attacker-controlled page. In pwn.ai's demonstration, that interaction is one ordinary click. The researchers told THN that no special WordPress deployment or hosting configuration is required to reach code execution.
The issue was patched on August 6 in WordPress 7.0.3, with fixes backported through the 4.7 branch. WordPress recommends updating immediately, and sites that support automatic background updates should receive the security release automatically. Versions older than 4.7 remain affected but fall outside the project's current backport range. WordPress powers 41.2% of all websites, according to W3Techs.
