XSS2Shell: Inside the WordPress Bug That Turns a Login Into a Web Shell

A single failed login attempt on the WordPress login page. That's all it took to trigger a vulnerability chain researchers are calling XSS2Shell — and it's a wake-up call for anyone running WordPress in 2026.

Tracked as CVE-2026–64638, this critical flaw lives in WordPress Core itself, not a plugin or theme, which is exactly what makes it a mass-market event. It affects code that has shipped since WordPress 4.7, meaning nearly every actively maintained WordPress installation was exposed before a fix landed. Given WordPress powers roughly 43% of all websites on the internet, that put an estimated 500 million-plus sites at risk.

The root cause is almost poetic in its simplicity: two of WordPress's own security sanitizers disagree with each other. When someone submits a nonexistent username at wp-login.php, WordPress runs it through a function called wp_strip_all_tags(), which wraps PHP's native strip_tags(). If an attacker inserts a space between an opening angle bracket and a tag name, PHP's parser treats it as harmless text and lets it through. But later in the pipeline, WordPress's own KSES sanitizer re-parses that same string and interprets it as a real HTML element. That parser disagreement is exactly wide enough to smuggle attacker-controlled code into the rendered login page — no account, no prior authentication required.

From there, the attack chain gets genuinely clever. The injected element matches selectors that a leftover password-reset script automatically scans for on page load, triggering an auto-click event. Through DOM clobbering, the attacker's element hijacks the destination URL of the resulting AJAX request, pointing it at WordPress's REST API with method-override and JSONP parameters. The response comes back wrapped in executable JavaScript, giving the attacker arbitrary script execution inside the WordPress origin, fully pre-authenticated.

On its own, that's already a serious bug. But if a logged-in administrator is lured to a malicious third-party page and interacts with it, even with a single ordinary click, the attacker's script can piggyback on that admin's session to mint a new Application Password, publish a page using the admin's unfiltered_html privileges, and upload a plugin ZIP containing a PHP web shell. Every one of those actions rides on legitimate, authenticated WordPress API calls the admin never knowingly approved.

WordPress moved fast. The security team shipped an emergency release, version 7.0.3, on August 6, 2026, backported all the way down to the 4.7 branch. As of disclosure, there's no confirmed in-the-wild exploitation, but a public proof-of-concept has already surfaced on GitHub, which historically shortens the window before opportunistic scanning begins.

If you manage WordPress infrastructure, this isn't a "patch when convenient" situation. I've broken down the full attack chain, SOC detection signals to hunt for, and a complete prevention checklist in the full article.

Read the full technical breakdown here: https://www.xpert4cyber.com/2026/08/wordpress-xss2shell-cve-2026-64638.html

Tags: WordPress Security, Cybersecurity, Vulnerability, CVE-2026–64638, Ethical Hacking, Web Security, SOC Analyst, Remote Code Execution