CVE-2026-64638 is a reflected XSS vulnerability on the WordPress login page that requires no authentication to trigger the initial script execution. The vulnerability arises from inconsistent sanitization of the username parameter on failed login attempts, allowing attacker-controlled HTML elements to be injected into the DOM. This injected content interacts with WordPress's user-profile.js script, enabling an attacker to hijack same-origin REST requests and execute JavaScript in the site's origin. Researchers demonstrated multiple attack chains from this XSS to PHP code execution, including creating Application Password credentials and uploading malicious plugins without needing to activate them. The vulnerability was responsibly disclosed and patched in WordPress 7.0.3, with backports to versions 4.7 and later. Exploitation requires social engineering to get an administrator to click a malicious link while logged in. The flaw does not require unusual hosting configurations and affects default installations.

Successful exploitation could allow an attacker to execute arbitrary PHP code on the WordPress server with the privileges of the PHP worker. This could lead to exposure of database credentials, creation of persistent administrator accounts, modification of site content, and execution of operating system commands. The initial XSS requires no privileges but escalation to remote code execution requires a logged-in administrator's interaction with attacker-controlled content. No active exploitation in the wild has been reported as of the advisory date.

A security update fixing this vulnerability was released on August 6, 2026, in WordPress version 7.0.3 and backported to all supported versions back to 4.7. WordPress recommends immediate updating to these patched versions. Sites using automatic background updates should receive the patch automatically. Versions older than 4.7 are not supported with backports and remain vulnerable. Known WordPress hardening measures do not fully mitigate this issue, so applying the official security update is required.