New WordPress Pre-Auth XSS (CVE-2026-64638) Could Lead to RCE: Have you patched your instances yet?
Source Reddit Cybersecurity
Exposed hosts seen by OffSeq Mirage · public detection template (Nuclei) · fixed in 7.0.3 : patch affected systems soon.
Data as of 5 Nov 2026, 23:24 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
- EPSS
- 0.8% chance of exploitation in 30 days – higher than 59% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 7.0.3
Exploitation evidence
Disclosed: evidence found.
Public on cve.org; its publication date is not in this record
Detectable: evidence found.
nuclei template: WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell)
Weaponized: evidence found.
Public exploit code: GitHub proofs of concept
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: evidence found.
2 exposed hosts found; no attack traffic recorded
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), GitHub proofs of concept, OffSeq Mirage (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.
What to do
AI-suggested
A security update fixing this vulnerability was released on August 6, 2026, in WordPress version 7.0.3 and backported to all supported versions back to 4.7. WordPress recommends immediate updating to these patched versions. Sites using automatic background updates should receive the patch automatically. Versions older than 4.7 are not supported with backports and remain vulnerable. Known WordPress hardening measures do not fully mitigate this issue, so applying the official security update is required.
Discussion
CVE-2026-64638 is a high-severity pre-authentication reflected cross-site scripting (XSS) vulnerability in WordPress login pages that can lead to remote code execution (RCE) under specific conditions. The flaw allows attacker-controlled JavaScript to execute in the browser of a visitor after a failed login attempt. Exploitation requires a logged-in administrator to interact with an attacker-controlled page, potentially enabling PHP code execution on the server. The vulnerability affects default WordPress installations and was patched in WordPress 7.0.3 and backported to versions back through 4.7. Versions older than 4.7 remain vulnerable. WordPress recommends immediate updating, and automatic background updates should apply the patch automatically. No in-the-wild exploitation has been reported as of the advisory date.
r/cybersecurity (opens in a new tab)u/Altruistic_Hope_25590 points0 comments
Hi everyone,
A high-severity security issue was recently fixed in WordPress 7.0.3 (and backported to older versions). The vulnerability, tracked as CVE-2026-64638, is a pre-authentication reflected XSS flaw on the login page, discovered by the team at pwn.ai. Under specific conditions, if an administrator clicks a malicious link, it could potentially lead to PHP code execution.
Given how widely WordPress is used across enterprise environments, this is definitely something sysadmins and security teams should keep on their radar.
Source / Read more here:https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html
Are you relying on automatic background updates for this, or manually patching across your environments? How are your WAFs handling login page traffic?