WordPress CVE-2026–64638 Exposes a Path from Login XSS to Code Execution

In August 2026, a pre-authentication XSS vulnerability, CVE-2026–64638, was disclosed in the WordPress Core login screen. Dubbed XSS2Shell, the vulnerability originates from a Reflected XSS in the input-handling process of wp-login.php and can potentially be chained with the WordPress REST API, Application Passwords, and administrator sessions to ultimately execute PHP code on the server.

While the vulnerability itself can be triggered without authentication, escalating the attack to server-side code execution requires an additional step in which a logged-in WordPress administrator interacts with a page controlled by the attacker. WordPress released WordPress 7.0.3 on August 6, 2026, as a security release that addressed the issue, with security fixes also backported to supported maintenance branches.

This article examines the root cause of CVE-2026–64638 and how the attack can progress from XSS to RCE. It also uses Criminal IP Asset Search to analyze Internet-exposed WordPress assets and the exposure of WordPress REST APIs.

A Technical Look at the CVE-2026–64638 Vulnerability

CVE-2026–64638 is a pre-authentication Reflected XSS vulnerability in the WordPress login page caused by differences in how separate input-filtering mechanisms interpret user-supplied input. Attackers can potentially chain the vulnerability with an administrator session to escalate the attack to privilege theft and server-side code execution.

Tracing the Attack Chain from XSS to Server-Side Execution

1. Delivering a Crafted Input to the Login Page The attacker sends a specially crafted username to the WordPress login page, /wp-login.php. This input exploits the way different WordPress filtering functions interpret the same string differently.

2. Triggering Reflected XSS When the input is reflected in the login error message, attacker-controlled HTML elements can be inserted into the page DOM. This creates the conditions necessary to trigger a Reflected XSS vulnerability without authentication.

3. JavaScript Execution Through DOM Clobbering The injected DOM elements interact with WordPress's user-profile.js, which is loaded on the login page. The attacker manipulates the ajaxurl value through DOM Clobbering and uses a JSONP response from the REST API to execute JavaScript within the WordPress origin.

4. Abusing the Administrator Session and Creating an Application Password When a logged-in administrator visits a page prepared by the attacker, the XSS can be used to abuse the administrator's browser session. The attacker can then create an Application Password with administrator privileges and obtain the resulting credentials.

5. Abusing Administrator Privileges Through the REST API Using the obtained Application Password, the attacker accesses the WordPress REST API with administrator privileges. The attacker can then create content with administrative permissions and inject JavaScript into publicly accessible pages to facilitate further attacks.

6. Uploading a Malicious Plugin JavaScript executed in the administrator's browser can abuse WordPress's plugin upload functionality to upload a plugin containing a malicious PHP file to the server. This extends the attack from client-side XSS to server-side file upload.

7. RCE Through PHP File Execution The attacker directly accesses the uploaded PHP file under wp-content/plugins/ to execute code on the server. As a result, the pre-authentication XSS on the login page can escalate through administrator privilege abuse and malicious file upload to remote code execution.

Finding Exposed WordPress Assets Using Criminal IP Asset Search

CVE-2026–64638 leverages externally exposed WordPress login pages and REST APIs as part of the attack chain. Organizations should therefore identify Internet-facing WordPress assets and assess both the versions in use and REST API exposure.

Using Criminal IP Asset Search, Internet-exposed WordPress assets and REST API paths relevant to the attack chain were examined sequentially.

1. Locating Internet-Facing WordPress Systems

Criminal IP Search Query: product: wordpress

A search for internet-exposed WordPress assets in Criminal IP Asset Search identified a total of 26,807 WordPress-related assets as of August 2026. The search results also included assets where WordPress version information, such as (5.2.18), was identified. By comparing the detected version with the version containing the patch for CVE-2026–64638, it is possible to identify assets that should be prioritized for patch verification.

However, version information identified by Criminal IP is based on externally collected HTTP responses and service information. Therefore, it should not be considered definitive evidence that an asset is vulnerable, but rather used as an indicator for verifying its patch status.

2. Finding Internet-Facing WordPress REST API Interfaces

Next, externally exposed assets with WordPress REST API-related paths were identified.

Criminal IP Search Query: /wp-json/wp/v2/

A search for /wp-json/wp/v2/ in Criminal IP Asset Search identified a total of 3,970 assets as of August 2026. /wp-json/wp/v2/ is a path used by the WordPress REST API to access major resources such as posts and pages. Assets where this string is observed in HTTP responses may indicate that the WordPress REST API is externally accessible.

Because the REST API is used for JavaScript execution and subsequent privilege abuse in the CVE-2026–64638 attack chain, organizations assessing Internet-exposed WordPress assets should also check whether the REST API is publicly accessible.

3. Tracing the REST API Request Method Behind the Exploit

In addition to the /wp-json/ path, the WordPress REST API can also be accessed using the ?rest_route=/ parameter. This method is also used in the XSS2Shell attack chain.

Criminal IP Search Query: /?rest_route=/ product: "wordpress"

A search for /?rest_route=/ product: "wordpress" in Criminal IP Asset Search identified 114 related assets as of August 2026.

?rest_route= is an alternative method of accessing the WordPress REST API. This query can be used to identify WordPress assets where this REST API access path is observable in external HTTP responses.

Insights Obtained from Individual WordPress Assets

Further examination of several WordPress assets from the search results showed that /wp-login.php returned an HTTP 200 response, with the WordPress login interface directly exposed to the Internet prior to authentication.

The same asset was also examined to determine how a username supplied in a login request was reflected in the error response. When an arbitrary string, TESTUSER_XYZ, was submitted, the same string was observed in the response. A string containing quotation marks, TEST"QUOTE, was also returned as provided.

This confirms that user-supplied input included in the login request is reflected back in the error response. Since CVE-2026–64638 also originates from the reflection of user input in error messages on /wp-login.php, this response behavior can serve as an additional indicator for determining whether a WordPress instance requires further verification of its patch status.

A PoC and detailed exploitation techniques for CVE-2026–64638 have also already been publicly disclosed. Although the individual assets examined here represent only a subset of the exposed environment, Criminal IP identified more than 20,000 Internet-exposed WordPress-related assets. Organizations should therefore prioritize verifying the actual WordPress versions in use across their managed assets and confirming whether the latest security updates have been applied.

Steps to Reduce Security Risks

CVE-2026–64638 can begin at the WordPress login page and escalate to abuse of administrator sessions, the REST API, and the plugin upload functionality. Therefore, in addition to applying the security patch, organizations should review external exposure and administrator access paths.

The following mitigation measures should be prioritized:

1. Apply the latest security updates
2. Review Internet-exposed assets and administrator pages
3. Check administrator accounts and Application Passwords
4. Review logs and plugin modification history

In particular, Internet-exposed WordPress assets should be reviewed not only for patch status, but also for administrator access paths, authentication credentials, and plugin modification history to reduce the likelihood of exploitation across the attack chain.

Conclusion

CVE-2026–64638 warrants attention because an XSS vulnerability originating from differences in input handling on the WordPress login page can extend beyond a browser-side attack and ultimately lead to server-side code execution through Application Passwords, the REST API, and plugin upload functionality.

The Criminal IP analysis identified not only Internet-exposed WordPress assets, but also assets where REST API-related paths and the ?rest_route=/ access method were observable in external responses. Individual assets were also found to expose the login interface directly to the Internet and reflect submitted usernames in error responses.

Therefore, WordPress environments should go beyond simply reviewing vulnerability advisories. Organizations should first identify their Internet-exposed assets and then verify whether the appropriate security patch for the currently deployed WordPress branch has been applied. Criminal IP Asset Search can be used in this process to quickly identify publicly exposed assets and relevant response characteristics, helping organizations narrow down their priority targets for further investigation.

In relation to this, you can refer to Unauthenticated Server File Read in Gitea: CVE-2026–59774 Analysis.