{"id":12034,"date":"2026-08-07T14:49:04","date_gmt":"2026-08-07T20:49:04","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-85-pre-authenticated-xss-with-chain-to-php-rce-in-wordpress-cms\/"},"modified":"2026-09-29T15:59:48","modified_gmt":"2026-09-29T21:59:48","slug":"alert-2026-85-pre-authenticated-xss-with-chain-to-php-rce-in-wordpress-cms","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-85-pre-authenticated-xss-with-chain-to-php-rce-in-wordpress-cms\/","title":{"rendered":"Alert 2026-85 Pre-Authenticated XSS with Chain to PHP RCE in WordPress CMS"},"content":{"rendered":"\n
Affected Product(s):<\/h2>\n\n
WordPress Core \u2014 Content Management System (CMS)<\/p>\n\n
Versions prior to 4.7 are also affected but fall outside the project’s official backport range.<\/p>\n\n
Description<\/h2>\n\n
A critical pre-authenticated reflected XSS vulnerability has recently been reported on the login screen (wp-login.php) in WordPress CMS, tracked as CVE-2026-64638 with a CVSS score of 8.9 \u2014 High. Researchers demonstrated that this flaw can be chained to achieve remote code execution (RCE) in PHP on the server when an authenticated administrator interacts with an attacker-controlled page, turning a browser-side bug into a full server compromise.<\/p>\n\n
The issue lies in how WordPress processes the username field during failed login attempts. The input passes through sanitize_user() and wp_strip_all_tags() (which internally uses strip_tags()), where a string with HTML tag structure that includes a space after the opening < survives as plain text. Then, when passing through wp_kses_post(), the content is interpreted as allowed HTML, generating attacker-controlled DOM elements.<\/p>\n\n<\/figure>\n\n
Figure 1 <\/strong>WordPress Exploitation Chain \u2014 CVE-2026-64638: From Pre-Authenticated XSS to Remote PHP Code Execution<\/p>\n\n
Solution<\/h2>\n\n
Update immediately to the fixed versions:<\/p>\n\n
Current version Update to Method WordPress 7.0.x 7.0.3 Dashboard \u2192 Updates \u2192 Update now WordPress 6.9.x 6.9.6 Dashboard \u2192 Updates \u2192 Update now WordPress 4.7 \u2013 6.8.x Backport applied Automatic or manual updates<\/p>\n\n
Official download:<\/strong> \u2022 https:\/\/wordpress.org\/download\/releases\/<\/p>\n\n
Sites with automatic background updates enabled should have already received the security update automatically. It is recommended to verify the installed version.<\/p>\n\n
To verify the installation you can:<\/p>\n\n
Via WP-CLI<\/strong><\/p>\n\n
wp core version wp core update # update if necessary<\/p>\n\n
Version 7.0.3 release notes:<\/strong> \u2022 https:\/\/wordpress.org\/news\/2026\/08\/wordpress-7-0-3-release\/<\/p>\n\n
Mitigation<\/h2>\n\n
\n
Implement a WAF (Web Application Firewall) with XSS filtering rules on wp-login.php. Pantheon has already applied virtual patching at the network level on its platform.pantheon<\/li>\n\n\n\n
Restrict access to wp-login.php by IP through .htaccess or web server configuration (NGINX\/Apache), allowing only known administrator IPs.<\/li>\n\n\n\n
Disable the Application Passwords functionality if not used, in order to cut the RCE chain vector:<\/li>\n<\/ul>\n\n
Monitor access logs for requests to wp-login.php with usernames containing characters such as or similar.<\/li>\n<\/ul>\n\n
Note: Researchers explicitly warned that standard WordPress hardening measures should not be considered complete mitigation for the underlying XSS. The only definitive solution is to update.<\/p>\n\n
Additional information:<\/h2>\n\n
\n
The Hacker News \u2014 CVE-2026-64638: https:\/\/thehackernews.com\/2026\/08\/new-wordpress-pre-auth-xss-could-lead.html<\/li>\n\n\n\n
![\"\"](\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/08\/visualization-995x1024.png\")
<\/figure>\n\n