XSS-уязвимость в WordPress приводит к выполнению PHP-кода

Researchers from pwn.ai have published a proof-of-concept demonstrating that an unauthenticated reflected cross-site scripting vulnerability in WordPress can be escalated to execute arbitrary PHP code on the server. Identified as CVE-2026-64638 with a CVSS score of 8.9, this flaw affects all standard installations due to inconsistent parsing of user input fields during authentication failures. While the initial XSS requires no special privileges, achieving remote code execution depends on specific conditions where a logged-in administrator interacts with attacker-controlled content.

The issue was resolved in the release of WordPress 7.0.3 on August 6, 2026, with backports available for older branches down to version 4.7. Administrators are advised to update their systems immediately, although developers note that full exploitation relies heavily on social engineering factors.