FHN 
Security researchers have uncovered a serious vulnerability chain in WordPress Core, tracked as CVE-2026-64638 and known as XSS2Shell. The flaw could allow attackers to escalate from a simple login page attack to remote code execution (RCE) under specific conditions.
Because the vulnerable code has been part of WordPress since version 4.7, millions of websites using one of the world’s most popular content management systems were potentially exposed before security updates were released.
How the Vulnerability Works
The attack begins on WordPress’s standard login page (wp-login.php).
When someone attempts to log in with an invalid username, WordPress displays an error message. Researchers discovered that specially crafted input can bypass the platform’s HTML filtering due to differences in how PHP and WordPress process certain characters.
This allows malicious HTML elements to appear within the login page even though no authentication is required.
Although these injected elements do not contain JavaScript themselves, they can interact with existing WordPress scripts already loaded in the browser.
From XSS to Code Execution
The injected content takes advantage of WordPress’s built-in JavaScript files, which automatically process specific page elements.
By manipulating these interactions, attackers can trigger unauthorized browser requests and eventually execute JavaScript within the WordPress website.
On its own, this reflected Cross-Site Scripting (XSS) vulnerability is already a serious security concern. However, researchers demonstrated that the attack can become far more dangerous when combined with social engineering.
If a logged-in administrator visits a specially crafted website and interacts with it, an attacker may abuse the administrator’s active session to perform privileged WordPress actions without their knowledge.
Potential Impact
Successful exploitation could allow attackers to:
- Execute malicious JavaScript.
- Create new WordPress application passwords.
- Publish unauthorized content.
- Upload malicious plugins.
- Deploy PHP web shells.
- Achieve remote code execution on the server.
Since these actions are performed using legitimate administrator privileges, detecting the attack can be more challenging.
Who Is Affected?
The vulnerability affects WordPress Core versions dating back to 4.7, making it one of the broadest WordPress security issues disclosed in recent years.
Given WordPress powers a significant portion of websites worldwide, organizations running outdated installations should review their environments immediately.
Security Update Available
The WordPress security team addressed the issue in WordPress 7.0.3 and also released security updates for older supported branches.
The vulnerability was assigned a CVSS score of 8.9 (High) due to its potential impact. While the full attack chain requires administrator interaction, the possibility of remote code execution makes prompt patching essential.
At the time of disclosure, researchers reported no confirmed evidence of active exploitation in real-world attacks.
How to Protect Your WordPress Site
Website owners and administrators should take the following steps:
- Update WordPress to the latest supported version.
- Apply all available security patches.
- Restrict administrator access to trusted users.
- Review installed plugins and themes regularly.
- Enable multi-factor authentication (MFA) for administrator accounts.
- Monitor login activity and unexpected administrative actions.
- Use a Web Application Firewall (WAF) to help block suspicious requests.
Conclusion
The XSS2Shell vulnerability demonstrates how a seemingly minor login page weakness can evolve into a much more serious attack when combined with browser behavior and administrator interaction.
Although exploitation requires specific conditions, the potential for remote code execution makes this vulnerability a high priority for WordPress administrators. Keeping WordPress updated and following security best practices remain the most effective ways to reduce the risk of compromise.
About the Author
