Cross-Site Scripting (XSS) vulnerability reflected on the WordPress authentication page
A reflected XSS vulnerability affecting WordPress core would allow an attacker to remotely execute arbitrary code on the authentication page.
Description
Technical context and vulnerability details
WordPress is an open source content management system (CMS) for creating, managing and publishing websites. This solution is affected by a vulnerability labeled CVE-2026-64638, resulting from a Cross-Site Scripting (XSS) vulnerability. Exploitation of this vulnerability would allow an attacker, through a specially crafted third-party website, to execute malicious JavaScript code in the context of an administrator user and, under certain conditions, lead to remote arbitrary code execution (RCE) on affected systems. This vulnerability is classified as high with a severity score of 8.9 according to CVSS v4.0.
Potential Risks & Impact
Potential consequences upon exploitation
- Arbitrary code execution;
- Compromise of system integrity;
- Data privacy breach;
- Unavailability of services;
Affected systems
Products, components and targeted versions
- All versions of WordPress prior to version 7.0.3;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update WordPress sites to version 7.0.3 or later;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.