CVE-2026-64638highCWE-79

CVE-2026-64638: falha de alta gravidade em WordPress

Publicada em

Seguir esta CVE+ Monitorar WordPress+ Monitorar wordpress

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

61Vexday Risk Score

Corrija em breve. Ela tem alerta oficial do governo brasileiro e tem exploit funcional público.

ssvc Attendcvss 8.9epss 0.9%
da publicação à armano mesmo dia
Publicada no NVD7 de ago.
1ª PoC7 de ago.
Alerta oficial no Brasil

O governo federal publicou alerta, recomendação ou boletim que cita esta vulnerabilidade.

Fonte: CTIR Gov (GSI) e CISC Gov.br, sob licença CC BY-ND 3.0.
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
WordPress · WordPress
PoCs públicas encontradas — 31
githubgithub.com/Boreas37/CVE-2026-64638-PoC-XSS2Shell-★ 130githubgithub.com/imbas007/CVE-2026-64638-POC★ 15githubgithub.com/wordsec/XSS2Shell★ 6githubgithub.com/Linuxhackingid-official/XSS2Shell-CVE-2026-64638★ 5githubgithub.com/eh-amish/CVE-2026-64638-XSS-to-Shell-PoC★ 3githubgithub.com/0xlipon/xss2shell★ 3githubgithub.com/0xBlackash/CVE-2026-64638★ 3githubgithub.com/renzi25031469/CVE-2026-64638-WordPress-Core-XSS2Shell★ 3githubgithub.com/5yu4n/CVE-2026-64638★ 2githubgithub.com/alisalive/xss2shell★ 2githubgithub.com/g0d150ne/XSS2Shell★ 2githubgithub.com/HackSpeak/CVE-2026-64638★ 2githubgithub.com/tc4dy/CVE-2026-64638-PoC-Exploit★ 2githubgithub.com/ZSecur1ty/XSS2Shell-CVE-2026-64638★ 1githubgithub.com/madfxr/xss2shell-poc★ 1githubgithub.com/ZildanZ/CVE-2026-64638★ 1githubgithub.com/4minx/CVE-2026-64638★ 1githubgithub.com/jendmaoul/XSS2Shell-CVE-2026-64638★ 1githubgithub.com/G33l0/Cve-2026-64638★ 1githubgithub.com/yogaGymn/XSS2Shell-CVE-2026-64638★ 1githubgithub.com/MR-LeonardoGomes/XSS2Shell-CVE-2026-64638★ 1githubgithub.com/SanaullahAmanullah/xss2shell-check★ 1githubgithub.com/0xredash/CVE-2026-64638★ 1githubgithub.com/kaleth4/CVE-2026-64638★ 0githubgithub.com/HORKimhab/CVE-2026-64638★ 0githubgithub.com/686f6c61/POC-WP-XSS2Shell-CVE-2026-64638★ 0githubgithub.com/mohwahyudi/poc-CVE-2026-64638-★ 0githubgithub.com/Alixploit22/CVEX2SHEL★ 0githubgithub.com/OFRPurpose/poc-cve-2026-64638★ 0githubgithub.com/Dungsocool/CVE-2026-64638★ 0githubgithub.com/xAL6/cve-2026-64638-banner-poc★ 0
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — WordPress

No mesmo produto, das mais perigosas para as menos.

CVE-2026-87902HIGHCVE-2026-87902EPSS 95.8%KEVCVE-2026-63030CRITICALWordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code ExecutionEPSS 10.6%KEVCVE-2026-60137MEDIUMWordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_QueryEPSS 5.3%KEVCVE-2020-11027MEDIUMPassword reset links invalidation issue in WordPressEPSS 13.6%CVE-2023-5561MEDIUMWordPress < 6.3.2 - Unauthenticated Post Author Email DisclosureEPSS 4.3%CVE-2022-3590MEDIUMWP <= 6.1.1 - Unauthenticated Blind SSRF via DNS RebindingEPSS 3.4%