New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

Kurzinfo

Metadaten

  • Original (extern): Link oeffnen
  • Veroeffentlicht: 2026-08-07 12:56 UTC
  • Importiert: 2026-08-17 10:37 UTC
  • CVSS: 8.9
  • Quelle-ID: thn_global
  • uid_hash: ff5c633fd12de93f0aedd30ebb121d46bac1bf4c5a19c4bfeb1c7cedd25bc5cc
The Hacker News

Inhalt

WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. pwn.ai demonstrated how the flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page.

Tracked as CVE-2026-64638 (CVSS score: 8.9), the high-severity

Verknuepfte CVEs

CVE-ID Severity (Quelle) CVSS (Quelle) Severity (CVE.org) CVSS (CVE.org) EPSS EPSS-Pctl Veroeffentlicht (CVE.org)

CVE-2026-64638

HIGH

8.9

HIGH

8.9

2026-08-07

Quellen-Details

Bezeichnung Name Kategorie Tags Zielgruppe Sprache Feed-URL
The Hacker News

thn_global

 security_news - de https://feeds.feedburner.com/TheHackersNews
Zurueck zur Eintrags-Liste