WordPress Login Flaw Lets Attackers Slip Code Into Every Site Running It

Key points

• WordPress has patched a login-page flaw tracked as CVE-2026-64638, rated 8.9 out of 10 for severity.
• The bug affects every version of WordPress, which powers roughly 43% of the world's websites.
• No password or account is needed to trigger the flaw, and in some setups it can be chained into running PHP code on the server.
• Researchers at pwn.ai reported the issue; site owners should update immediately.

WordPress, the free publishing software that runs a huge share of the world's websites, has fixed a serious bug on its own login page.

The flaw is a pre-authentication reflected cross-site scripting bug, or XSS. That means an attacker can craft a booby-trapped link to the login screen, and if a victim clicks it, malicious code runs inside their browser as if the WordPress site had sent it. "Pre-authentication" means the attacker does not need an account or a password first. The login page itself is the entry point.

It is tracked as CVE-2026-64638 and carries a severity score of 8.9 out of 10. Every version of WordPress is affected until the patch is applied.

The bug was reported by researchers at pwn.ai and first written up by The Hacker News.

How bad is this, really?

Bad enough that every WordPress site owner should update this week. On its own, the flaw lets an attacker steal a logged-in administrator's session or trick them into performing actions on the site. Under extra conditions the researchers describe, the same bug can be chained into PHP code execution, meaning the attacker gets to run their own programs on the web server. That is the point at which a website stops belonging to its owner.

WordPress powers around 43% of all websites, from corner-shop storefronts to national newspapers, so the pool of exposed targets is enormous.

How would an attack actually work?

An attacker sends a link to the WordPress login page with hidden code tacked onto the end of the web address. If a site administrator is tricked into clicking it, perhaps through a phishing email dressed up as a plugin update notice, the code runs in their browser session. From there the attacker can hijack the admin's login, plant a backdoor, or, in vulnerable configurations, push commands through to the server itself.

No malware needs to be installed on the victim's computer. The whole attack lives in the browser and the WordPress site.

What site owners and readers should do

If you run a WordPress site, update to the latest release now. Most sites with automatic updates turned on will already have it. Check the admin dashboard to confirm.

If you are a reader who just visits WordPress-powered sites, there is nothing to install. But be wary of unexpected emails asking you to log into a website you manage, especially if the link goes straight to a login page with unusual characters in the address bar.

The fix at a glance

WordPress security fixes tend to be exploited within days of disclosure, because attackers can diff the patched code against the previous release and work out exactly what to target. The clock starts now.