WordPress has patched a critical pre-authentication reflected XSS vulnerability (CVE-2026-64638) affecting all versions of the CMS. The high-severity flaw, with a CVSS score of 8.9, requires no attacker privileges and can potentially be chained to achieve PHP code execution on the server, making immediate patching essential for all WordPress installations.
WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. Under additional conditions, the bug can be chained into PHP code execution on the server. Tracked as CVE-2026-64638 (CVSS score: 8.9), the High-severity vulnerability requires no attacker privileges. According to pwn.ai,
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
