MEDIUMVulnerability
Global

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

·Source: The Hacker News

Updated:

Executive Summary

WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. Under additional conditions, the bug can be chained into PHP code execution on the server. Tracked as CVE-2026-64638 (CVSS score: 8.9), the High-severity vulnerability requires no attacker privileges. According to pwn.ai,

Analysis

WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. Under additional conditions, the bug can be chained into PHP code execution on the server. Tracked as CVE-2026-64638 (CVSS score: 8.9), the High-severity vulnerability requires no attacker privileges. According to pwn.ai,

Indicators of Compromise (1)

CVE (1)
CVE-2026-64638
NVDMITRE CVE
Source Attribution

Originally published by The Hacker News on Aug 7, 2026.

Related Threats

MEDIUMVulnerabilityNEW

Military device manufacturer discloses cyber incident to SEC

IEH Corporation — which produces specialized products used in military satellites, missiles and fighter jets — said it discovered a cyberattack on Tuesday and immediately tried to contain it.

The Record
MEDIUMVulnerabilityNEW

AI-Generated Patches Fail Half the Time

A study of more than 6,000 patches found that even working patches can introduce new bugs, break something else, or are open to bypass.

Dark Reading
MEDIUMVulnerability

Levi Strauss & Co. says hackers stole corporate data in cyberattack

Levi Strauss & Co. (Levi's) says that hackers used social engineering on three of its employees to gain access to and steal corporate data stored on their machines. [...]

BleepingComputer