type: cve · created: 2026-08-09 · updated: 2026-08-09 · tags: [cve, wordpress, xss, rce, pre-auth, cms] · confidence: high · severity: high · affected_sectors: [technology, government, media, ecommerce] · au_impact: true
CVE-2026-64638 — WordPress Pre-Auth XSS Leading to PHP Code Execution
CVE-2026-64638 is a pre-authentication cross-site scripting vulnerability in WordPress, rated CVSS 8.9, affecting every version of WordPress. When chained with a logged-in admin interacting with an attacker-controlled page, it can lead to PHP code execution.
Vulnerability Details
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-64638 |
| CVSS | 8.9 (High) |
| Type | Pre-Auth Stored XSS → PHP Code Execution (chained) |
| Affected | Every version of WordPress |
| Disclosure | 2026-08-07 |
| Impact | PHP code execution when admin interacts with attacker-controlled page |
Exploitation Chain
- Attacker exploits the pre-auth XSS to inject malicious content into a WordPress instance
- Logged-in administrator visits the affected page
- The XSS payload executes in the admin's browser session
- Chained to PHP code execution via admin-level privileges
Impact
WordPress powers approximately 43% of all websites, making this one of the most broadly impactful vulnerabilities disclosed in 2026. The pre-auth nature means no credentials are required to inject the initial payload.
Mitigation
- Apply the WordPress security update corresponding to this CVE
- Consider implementing Web Application Firewall (WAF) rules to detect XSS payloads
- Educate administrators about the risk of interacting with untrusted pages while logged into WordPress
Related Pages
- Wp2Shell — WordPress core unauthenticated RCE (CVE-2026-63030 + CVE-2026-60137)