CVE-2026-64638

WordPress core contains a reflected cross-site scripting (CWE-79) vulnerability on the login screen that can be triggered without authentication. An attacker must socially engineer a victim into clicking a crafted link or interacting with an attacker-hosted third-party website, so explicit user interaction is required for exploitation. If successful, the attacker can run malicious script in the victim's browser on the targeted WordPress site, and — under conditions outside the attacker's direct control — escalate the XSS to remote code execution (PHP code execution). Every version of WordPress is affected; version 7.0.3 fixes the flaw and the fix has been backported to all branches back to 4.7. No public proof-of-concept is known and the issue is not yet in CISA's KEV catalog, though EPSS assigns a 31.2% probability of exploitation within 30 days (98th percentile), indicating elevated near-term risk.

What to do: Update to WordPress 7.0.3, or apply the backported security update on your branch (backports are available for all branches back to 4.7). Until patched, exercise caution with unsolicited login-page links and consider monitoring authentication and admin-action logs for suspicious activity, since exploitation depends on user interaction. Because the RCE escalation depends on environmental conditions, treat all unpatched WordPress sites as exposed even if no in-the-wild exploitation is yet confirmed.