New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

WordPress has addressed a severe pre-authentication cross-site scripting (XSS) vulnerability affecting all versions of the platform, which could lead to remote code execution under specific conditions. Tracked as CVE-2026-64638 with a CVSS score of 8.9, this flaw allows an unauthenticated attacker to inject malicious JavaScript into the login screen, triggering execution in any user’s browser upon visiting a crafted link. If an administrator then interacts with a malicious page, the XSS can escalate to PHP code execution on the server, enabling attackers to upload plugins or modify sensitive data. The issue was resolved in WordPress 7.0.3, with patches applied retroactively to the 4.7 branch. Sites running older versions are still at risk and should upgrade immediately.