WordPress patches critical login-related cross-site scripting vulnerability

WordPress has released security update 7.0.3 to address a critical "XSS2Shell" vulnerability, a cross-site scripting (XSS) flaw affecting core website login functions. The vulnerability, identified as CVE-2026-64638, has reportedly been exploited by attackers impacting over 11,000 websites in 67 countries.

The XSS2Shell vulnerability exploits a weakness in WordPress's login workflow. When a user attempts to log in with a non-existent username, the system generates an error message that incorporates the user's input. Due to how filtering mechanisms handle unusual tags, malicious code could be retained and interpreted by the browser as valid HTML, enabling an XSS attack.

Exploiting this vulnerability alone does not grant direct server control. Attackers must combine it with other methods, such as leveraging existing JavaScript and REST API functionalities within WordPress, along with browser mechanisms that allow same-origin policy interactions.

If an administrator is logged in, an attacker could potentially hijack the existing session to perform administrative actions. This might involve obtaining WordPress application passwords and using them to publish pages containing malicious JavaScript. In more sophisticated attacks, an attacker could use administrative privileges to install malicious plugins with PHP code, leading to server-side code execution.

WordPress urges all users to update to version 7.0.3 immediately. Administrators are also advised to review their systems for unusual administrator accounts, application passwords, or plugin installations to detect potential compromises.