WordPress Core Pre-Auth Reflected XSS in wp-login.php via strip_tags/KSES Parser Differential (XSS2Shell)

CVE-2026-64638 is a reflected cross-site scripting vulnerability in WordPress Core's wp-login.php, caused by a parser differential between PHP's strip_tags() and WordPress's wp_kses_post() sanitizer. Malformed tag-like input POSTed as the username in a failed login attempt survives strip_tags() as text but is reconstructed as executable HTML by the KSES layer inside wp_admin_notice() (introduced in WordPress 6.4). The result is attacker-controlled JavaScript executing in the WordPress origin — no authentication required. All WordPress versions before 7.0.3 are affected. Backported security fixes are available for every supported branch back to 4.7. The research team at pwn.ai discovered the flaw on July 26, 2026, reported it to WordPress on July 27, and WordPress shipped 7.0.3 on August 6, 2026 — an 11-day turnaround.

Third-party CVSS assessments diverge dramatically: v3.1 scores it at 5.4 (Medium) for the XSS in isolation, while CVSS v4.0 scores it at 8.9 (High) when the full XSS-to-RCE chain ('XSS2Shell') is considered. Neither score fully captures the real-world risk profile. The v3.1 score underweights the demonstrated RCE chain and the 500M+ site attack surface. The v4.0 score overweights the theoretical maximum impact without adequately discounting the social-engineering friction: the full RCE chain requires a logged-in administrator to visit an attacker-controlled page, which is a non-trivial prerequisite even at WordPress scale. With 80% of WordPress installations auto-updating minor security releases, the real exposure window is narrower than the raw install base suggests — but the remaining 20% (roughly 100M+ sites) represents an enormous long-tail attack surface. One confirmed in-the-wild exploitation was documented as of September 17, 2026, and 60+ public PoC repositories exist. noisgate assesses this at HIGH (7.2) — the XSS is trivially reachable and the RCE chain is fully weaponized, but per-target social engineering prevents mass autonomous exploitation.

Sources.

1. op-c.net — XSS2Shell: WordPress CVE-2026-64638 Pre-Auth XSS Can Lead to RCE
2. Hadrian — WordPress XSS2Shell: Unauthenticated Login-Screen XSS to PHP Code Execution
3. SecurityOnline — WordPress Security Update 7.0.3
4. SecurityArsenal — CVE-2026-64638: Detection, Chaining Risk, and Remediation Guide
5. GitHub — imbas007/CVE-2026-64638-POC (XSS2Shell PoC toolkit)
6. Sploitus — 60+ exploits for CVE-2026-64638
7. HivePro — Threat Advisory: CVE-2026-64638 XSS2Shell
8. Patrowl — XSS2Shell: Critical WordPress Login Vulnerability

Run this script on each WordPress host (or via SSH/Ansible across your fleet). Pass the WordPress installation path as the first argument. Requires read access to wp-includes/version.php and wp-includes/user.php — no root needed. Example: bash check_cve_2026_64638.sh /var/www/html

#!/usr/bin/env bash
# CVE-2026-64638 Checker — WordPress Pre-Auth Reflected XSS (XSS2Shell)
# Verifies whether the esc_html() fix is present at the interpolation
# site in wp-includes/user.php, independent of branch/backport version.
#
# Usage:  bash check_cve_2026_64638.sh [/path/to/wordpress]
# Exit:   0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -uo pipefail

WP_PATH="${1:-/var/www/html}"
VERSION_FILE="$WP_PATH/wp-includes/version.php"
USER_FILE="$WP_PATH/wp-includes/user.php"

# --- Locate WordPress ---
if [[ ! -f "$VERSION_FILE" ]]; then
  echo "UNKNOWN — cannot find WordPress at $WP_PATH"
  exit 2
fi

WP_VERSION=$(grep -oP "\\\$wp_version\s*=\s*'\K[^']+" "$VERSION_FILE" 2>/dev/null)
if [[ -z "$WP_VERSION" ]]; then
  echo "UNKNOWN — could not parse WordPress version from $VERSION_FILE"
  exit 2
fi
echo "[*] WordPress version detected: $WP_VERSION"

# --- Primary check: look for the esc_html() fix in user.php ---
# The patch adds esc_html() around the \$username variable at the
# interpolation site that feeds wp_admin_notice(). This check is
# branch-agnostic and works for all backported releases.
if [[ ! -f "$USER_FILE" ]]; then
  echo "UNKNOWN — cannot find $USER_FILE"
  exit 2
fi

if grep -qE 'esc_html\s*\(\s*\$username' "$USER_FILE" 2>/dev/null; then
  echo "PATCHED — WordPress $WP_VERSION contains the esc_html() fix for CVE-2026-64638"
  exit 0
fi

# --- Fallback check: version comparison for 7.0.x branch ---
IFS='.' read -r MAJOR MINOR PATCH <<< "$WP_VERSION"
PATCH="${PATCH:-0}"

if [[ "$MAJOR" -gt 7 ]]; then
  echo "PATCHED — WordPress $WP_VERSION is newer than the affected range"
  exit 0
elif [[ "$MAJOR" -eq 7 && "$MINOR" -eq 0 && "$PATCH" -ge 3 ]]; then
  echo "PATCHED — WordPress $WP_VERSION >= 7.0.3"
  exit 0
elif [[ "$MAJOR" -eq 7 && "$MINOR" -gt 0 ]]; then
  echo "PATCHED — WordPress $WP_VERSION is on a branch released after the fix"
  exit 0
fi

echo "VULNERABLE — WordPress $WP_VERSION is missing the esc_html() fix for CVE-2026-64638"
echo "[!] Update to 7.0.3+ or the latest security release for your branch."
exit 1