New WordPress Pre-Auth XSS Could Lead to PHP Code Execution – Patch ASAP

WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. Under additional conditions, the bug can be chained into PHP code execution on the server.

Tracked as CVE-2026-64638 (CVSS score: 8.9), the High-severity vulnerability requires no attacker privileges. According to pwn.ai,

Source: The Hacker News

Tags:

Leave a Reply

Your email address will not be published. Required fields are marked *

Explore More

Microsoft Can Track Users via a Windows Device ID

Microsoft Can Track Users via a Windows Device ID Source: Hacker News

Read More

System call instrumentation on Linux/x86‑64 using memory‑indirect calls, part I

System call instrumentation on Linux/x86‑64 using memory‑indirect calls, part I Source: Hacker News

Read More

Born Against, or why hobby programming communities are against LLM usage

Born Against, or why hobby programming communities are against LLM usage Source: Hacker News

Read More