CVE-2026-64638highCWE-79

CVE-2026-64638: high-severity vulnerability in WordPress

Published

Follow this CVE+ Monitor WordPress+ Monitor wordpress

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

61Vexday Risk Score

Patch soon. It has an official Brazilian government alert and has a working public exploit.

ssvc Attendcvss 8.9epss 0.9%
from disclosure to weaponsame day
Published on NVDAug 7
1st PoCAug 7
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
WordPress · WordPress
public PoCs found — 31
githubgithub.com/Boreas37/CVE-2026-64638-PoC-XSS2Shell-★ 130githubgithub.com/imbas007/CVE-2026-64638-POC★ 15githubgithub.com/wordsec/XSS2Shell★ 6githubgithub.com/Linuxhackingid-official/XSS2Shell-CVE-2026-64638★ 5githubgithub.com/eh-amish/CVE-2026-64638-XSS-to-Shell-PoC★ 3githubgithub.com/0xlipon/xss2shell★ 3githubgithub.com/0xBlackash/CVE-2026-64638★ 3githubgithub.com/renzi25031469/CVE-2026-64638-WordPress-Core-XSS2Shell★ 3githubgithub.com/5yu4n/CVE-2026-64638★ 2githubgithub.com/alisalive/xss2shell★ 2githubgithub.com/g0d150ne/XSS2Shell★ 2githubgithub.com/HackSpeak/CVE-2026-64638★ 2githubgithub.com/tc4dy/CVE-2026-64638-PoC-Exploit★ 2githubgithub.com/ZSecur1ty/XSS2Shell-CVE-2026-64638★ 1githubgithub.com/madfxr/xss2shell-poc★ 1githubgithub.com/ZildanZ/CVE-2026-64638★ 1githubgithub.com/4minx/CVE-2026-64638★ 1githubgithub.com/jendmaoul/XSS2Shell-CVE-2026-64638★ 1githubgithub.com/G33l0/Cve-2026-64638★ 1githubgithub.com/yogaGymn/XSS2Shell-CVE-2026-64638★ 1githubgithub.com/MR-LeonardoGomes/XSS2Shell-CVE-2026-64638★ 1githubgithub.com/SanaullahAmanullah/xss2shell-check★ 1githubgithub.com/0xredash/CVE-2026-64638★ 1githubgithub.com/kaleth4/CVE-2026-64638★ 0githubgithub.com/HORKimhab/CVE-2026-64638★ 0githubgithub.com/686f6c61/POC-WP-XSS2Shell-CVE-2026-64638★ 0githubgithub.com/mohwahyudi/poc-CVE-2026-64638-★ 0githubgithub.com/Alixploit22/CVEX2SHEL★ 0githubgithub.com/OFRPurpose/poc-cve-2026-64638★ 0githubgithub.com/Dungsocool/CVE-2026-64638★ 0githubgithub.com/xAL6/cve-2026-64638-banner-poc★ 0
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — WordPress

In the same product, most dangerous first.

CVE-2026-87902HIGHCVE-2026-87902EPSS 95.8%KEVCVE-2026-63030CRITICALWordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code ExecutionEPSS 10.6%KEVCVE-2026-60137MEDIUMWordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_QueryEPSS 5.3%KEVCVE-2020-11027MEDIUMPassword reset links invalidation issue in WordPressEPSS 13.6%CVE-2023-5561MEDIUMWordPress < 6.3.2 - Unauthenticated Post Author Email DisclosureEPSS 4.3%CVE-2022-3590MEDIUMWP <= 6.1.1 - Unauthenticated Blind SSRF via DNS RebindingEPSS 3.4%