WordPress pre-auth login XSS can chain to full server takeover

WordPress patched a pre-authentication reflected cross-site scripting flaw in the login screen that researchers showed can chain into PHP code execution and full server takeover, naming the chain XSS2Shell. Tracked as CVE-2026-64638 and scored 8.9, the cross-site scripting bug affects all WordPress versions and needs no login to trigger. On its own it runs script in a visitor's browser, but when a logged-in administrator is lured to an attacker-controlled page, the chain can reach code execution on the server. Because WordPress runs a large share of the web, a flaw affecting every version and needing no authentication has broad reach.

Check

Update WordPress to the patched release across every site, including forgotten and staging installs, and put a web application firewall in front of internet-facing sites.

Affected

All WordPress sites on versions before the fix (CVE-2026-64638); an unauthenticated attacker can run script in the login page, and luring an administrator to a crafted page can chain to code execution.

Fix

Apply the WordPress update, confirm automatic updates ran, use a web application firewall, and remind administrators to avoid unexpected links, since the chain to code execution runs through an admin's browser.