Security Alert Summary
A reflected cross-site scripting (XSS) vulnerability has been identified on the WordPress login screen that can be exploited without authentication. An attacker hosting a specially crafted third-party website can induce a victim to interact with the site; under those conditions and with successful social engineering, the issue can be escalated to remote code execution (RCE). A fix is available in WordPress 7.0.3 and has been backported to branches back to 4.7.
CVE Details
- CVE ID: CVE-2026-64638
- Affected component: WordPress (login screen)
- Affected versions: All affected versions prior to 7.0.3. Fix introduced in 7.0.3 and backported to branches back to 4.7 (per advisory).
- Published: August 7, 2026 at 6:17:20 PM UTC
- Last modified: August 7, 2026 at 7:18:51 PM UTC
- CVSS (version 4.0): Base score 8.9, Severity: HIGH
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Authentication required: None (pre-auth)
- Privileges required: None
- User interaction: Required (active interaction by target)
- Impact: Confidentiality: High; Integrity: High; Availability: High
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
The vulnerability is a reflected XSS on the WordPress login screen that can be triggered without authentication. Because the vulnerable input is reflected to the page, an attacker can host a specially crafted third-party webpage that, when a site user visits and interacts with it, causes malicious script to execute in the context of the WordPress site.
According to the disclosure, this reflected XSS can be escalated to remote code execution in specific scenarios that depend on factors outside the attacker’s control and require explicit user interaction and successful social engineering of the target. The disclosure does not name specific functions or endpoints beyond the login screen. A code-level fix was released in WordPress 7.0.3 and backported to older branches as noted in the advisory.
How This Could Impact Your Website
Consider a realistic scenario: a site owner manages a team that includes an editor and an external contractor who occasionally logs into the site. If an editor or contractor visits a malicious third-party page and is tricked into interacting with it, a reflected XSS payload could run in the context of the WordPress login, potentially exposing session data or performing actions the user is permitted to do. This can lead to exposure of internal user details such as email addresses and increase the risk of targeted phishing or social engineering against staff or contributors.
The immediate practical consequences include disclosure of user-visible data, unauthorized actions performed with the victim’s session, and elevated risk of follow-on attacks that target specific users. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update WordPress to 7.0.3 or later as soon as possible to obtain the fix.
- Apply any backported fixes provided for older branches if you are on a maintained backport branch (advisory indicates backports to branches back to 4.7).
- Review and reduce unnecessary user roles and capabilities, especially for contributors and contractors.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes to reduce the attack surface.
- Monitor site activity and access logs for unusual behavior following updates or suspicious user reports.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
