WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. (CVE-2026-64638)

CVE-2026-64638 describes a pre-authentication reflected XSS vulnerability in WordPress's login screen. An attacker can craft a malicious website that, when visited by a target user, may escalate to remote code execution if the victim interacts with the content as manipulated by the attacker. The vulnerability affects all WordPress versions before 7.0.3. The fix was introduced in WordPress 7.0.3 and backported to all supported branches back to 4.7. The vulnerability requires explicit user interaction and social engineering to be exploited.

Successful exploitation can lead to remote code execution on the affected WordPress installation, but only after the victim is tricked into interacting with malicious content. This elevates the risk from a reflected XSS to a potentially critical impact, though exploitation depends on user action and social engineering.

A fix is available in WordPress version 7.0.3 and has been backported to all supported branches back to 4.7. Users should update their WordPress installations to version 7.0.3 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.