WordPress Login Flaw Lets Attackers Slip Code Into Every Site Running It

Key points

• WordPress has patched a login-page flaw tracked as CVE-2026-64638, rated 8.9 out of 10 for severity.
• The bug affects every version of WordPress.
• No password or account is needed to trigger the flaw, and in some setups it can be chained into running PHP code on the server.
• Researchers at pwn.ai reported the issue; site owners should update immediately.

WordPress, the free publishing software that runs a vast share of the world's websites, has fixed a serious bug on its own login page.

The flaw is a pre-authentication reflected cross-site scripting bug, or XSS. An attacker crafts a booby-trapped link to the login screen; if a victim clicks it, malicious code runs inside their browser as though the WordPress site had sent it. "Pre-authentication" means no account or password is required first. The login page itself is the entry point.

Tracked as CVE-2026-64638, it carries a CVSS severity score of 8.9 out of 10. Every version of WordPress is affected until the patch is applied. The bug was reported by researchers at pwn.ai and first written up by The Hacker News.

This isn't WordPress's first rough stretch of the summer. We covered a pair of no-login-required WordPress takeover flaws on 20 July in "WP2Shell: Two WordPress Flaws Let Attackers Take Over Websites Without Logging In", when tens of millions of sites were at risk and exploits were already live.

How bad is this, really?

Bad enough that every WordPress site owner should update this week. On its own, the flaw lets an attacker steal a logged-in administrator's session or trick them into performing actions on the site. Under extra conditions, the same bug chains into PHP code execution, meaning the attacker gets to run their own programs on the web server. That's the point at which a website stops belonging to its owner.

How would an attack actually work?

An attacker sends a link to the WordPress login page with hidden code tacked onto the end of the web address. If a site administrator clicks it, perhaps through a phishing email dressed up as a plugin update notice, the code runs in their browser session. From there the attacker can hijack the admin's login, plant a backdoor, or push commands through to the server itself in vulnerable configurations.

No malware needs to be installed on the victim's computer. The whole attack lives in the browser and the WordPress site.

What site owners and readers should do

If you run a WordPress site, update to the latest release now. Most sites with automatic updates turned on will already have it. Check the admin dashboard to confirm.

If you're a reader who just visits WordPress-powered sites, there's nothing to install. Be wary of unexpected emails asking you to log into a site you manage, especially if the link goes straight to a login page with unusual characters in the address bar.

The fix at a glance

WordPress security fixes tend to be exploited within days of disclosure. Attackers can diff the patched code against the previous release and work out exactly what to target. The clock's already running, and if the July wp2shell episode is any guide, some sites won't patch in time.