WordPress Core CVE-2026-64638: Parser Differential Enables Pre-Auth XSS, XSS2Shell Demonstrates Path to PHP Code Execution (thecybersecguru.com)
from UnLocoPoco@lemmy.world to cybersecurity@infosec.pub on 07 Aug 18:04
https://lemmy.world/post/50408145

cross-posted from: lemmy.world/post/50408091

WordPress has released security updates for CVE-2026-64638, a high-severity vulnerability affecting the login page that has been patched in WordPress 7.0.3 and backported to supported branches. The bug itself is a pre-authentication reflected XSS caused by a parser differential between WordPress’s input handling and HTML sanitization pipeline. According to the published research, malformed input survives strip_tags() but is later interpreted as valid HTML by wp_kses_post(), allowing attacker-controlled DOM elements to be injected into the failed login page.

#cybersecurity