Loading story…
WordPress has released 7.0.3 as a security update to fix multiple vulnerabilities, led by a high-severity pre-authentication reflected XSS flaw in the login screen tracked as CVE-2026-64638 and GHSA-52p2-r8wf-jcrf. The issue affects all WordPress versions and is being backported through the supported 4.7 security branch, while 7.1 RC2 also includes the fixes. WordPress said site owners should update immediately; versions older than 4.7 remain affected and are outside the current backport range.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
On August 10, the Canadian Centre for Cyber Security published advisory AV26-792 warning that WordPress versions prior to 7.0.3 are affected by CVE-2026-64638. The advisory said open-source reporting indicated the vulnerability was being exploited in the wild as of August 7 and urged administrators to review WordPress guidance and apply updates.
A ProjectDiscovery Nuclei template was published for CVE-2026-64638 to detect the pre-authentication reflected XSS in WordPress Core versions before 7.0.3 via crafted POST requests to /wp-login.php. The accompanying material described a Docker-based proof of concept and reported successful detection against a local test instance, with the issue also said to have been validated against live targets.
As of August 7, WordPress said it had no evidence that CVE-2026-64638 had been exploited in the wild. The company also noted that the demonstrated RCE path depends on successful social engineering and conditions outside the attacker's control.
On August 6, WordPress released version 7.0.3 as a security update and urged site owners to update immediately. The release fixed multiple vulnerabilities, including the pre-auth login-screen XSS tracked as CVE-2026-64638, several stored XSS issues, a multisite privilege escalation bug, an SSRF flaw, and information disclosure weaknesses.
pwn.ai reported the full XSS2Shell exploitation chain for CVE-2026-64638 to WordPress with proof of exploitation, and WordPress acknowledged the report the same day. The acknowledgment preceded the 7.0.3 security release and later public disclosure.
pwn.ai reported that the login-screen XSS could be chained into server-side PHP code execution under additional conditions, including a logged-in administrator and social engineering. The researchers described multiple escalation paths, including plugin installation and arbitrary ZIP upload, using DOM injection, same-origin REST requests, and JSONP-based script execution.
WordPress said the security fixes in 7.0.3 were being backported where necessary to all supported branches eligible for security fixes, currently through version 4.7. Versions older than 4.7 remain affected and are outside the current backport range.
Researchers at pwn.ai discovered a pre-authentication reflected XSS flaw in the WordPress login screen and responsibly disclosed it to WordPress. The issue was later tracked as CVE-2026-64638.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourceacn.gov.it
Open sourceboho.or.kr
Open sourcepwn.ai
Open sourcegithub.com
Open sourcegithub.com
Open sourcewordpress.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WordPress released **7.0.2** to fix two core vulnerabilities that can be chained into unauthenticated remote code execution, including **CVE-2026-63030** and **CVE-2026-60137**. The flaws affect default WordPress installations without plugins, with the RCE path impacting **6.9.0 through 6.9.4**, **7.0.0 through 7.0.1**, and **7.1 beta**, while the SQL injection issue also affects the **6.8** branch. WordPress issued backported fixes in **6.9.5**, **6.8.6**, and **7.1 Beta 2**, enabled forced auto-updates for affected sites, and said the attack chain abuses the REST API batch endpoint to trigger route confusion, bypass request handling restrictions, and reach SQL injection that can lead to full site compromise. Security vendors moved quickly to contain exposure as public technical details began to emerge. Cloudflare deployed WAF protections for both CVEs for all customers and Wordfence added firewall coverage for premium users, but both stressed that filtering is only a temporary mitigation and that patching is the primary remediation. Researchers attributed the discovery to Adam Kues of Searchlight Cyber's Assetnote team, and while early reporting said no in-the-wild exploitation had been confirmed, a public GitHub proof of concept later demonstrated unauthenticated access to the vulnerable batch endpoint and blind SQL injection against affected versions, increasing the likelihood of rapid attacker weaponization.
Aug 11, 2026
WordPress released security updates for two core vulnerabilities, **CVE-2026-63030** and **CVE-2026-60137**, that can be chained to make a blind SQL injection remotely reachable without authentication and, in some cases, lead to **remote code execution**. The issue, dubbed **`wp2shell`**, stems from REST API batch-route confusion in the `/wp-json/batch/v1` endpoint combined with SQL injection, affecting WordPress versions **6.9.0 through 6.9.4** and **7.0.0 through 7.0.1**. Researchers said the route-confusion flaw carries a **CVSS 9.8** rating, while the second SQL injection bug is rated **CVSS 5.9**. WordPress fixed the flaws in **6.9.5** and **7.0.2**, and also backported the SQL injection fix to **6.8.6**. The vulnerabilities were reported by Adam Kues of Assetnote through the WordPress HackerOne program, and while exploitation had not been confirmed at the time of disclosure, a public proof of concept later became available, increasing the risk of rapid weaponization. Administrators were urged to verify that forced automatic updates succeeded and, if immediate patching was not possible, to apply mitigations such as blocking the REST batch endpoint with a WAF.
Jul 31, 2026
Threat actors are actively exploiting critical vulnerabilities in popular WordPress plugins and themes, enabling the hijacking of administrator accounts and full site compromise. The Post SMTP plugin, installed on over 400,000 WordPress sites, is affected by CVE-2025-11833, a flaw that allows unauthenticated attackers to read arbitrary logged emails, including password reset messages, due to missing authorization checks. This exposure enables attackers to reset admin passwords and take over sites. Wordfence has observed over 4,500 exploit attempts since November 1, and a patch was released in version 3.6.1, but a significant number of sites remain unpatched and vulnerable. Similarly, the JobMonster WordPress theme is being targeted via CVE-2025-5397, an authentication bypass vulnerability that allows attackers to hijack admin accounts when social login is enabled. The flaw arises from improper verification in the `check_login()` function, letting attackers fake admin access if they know the username or email. The issue is fixed in version 4.8.2, and users are urged to update, disable social login, and enable two-factor authentication. These incidents highlight the ongoing risk posed by unpatched WordPress components and the need for immediate mitigation to prevent site compromise.
Jun 29, 2026