importantSYS.SOURCE: The Hacker News• 2026-08-07T18:26:23+05:30

WordPress Pre-Auth XSS Vulnerability (CVE-2026-64638) Enables PHP Code Execution – Urgent Patch Required

#vulnerability #wordpress #xss #php #security

A pre-authentication reflected XSS vulnerability in WordPress login pages (CVE-2026-64638) enables remote code execution through chained attacks requiring admin interaction. The vulnerability was patched in WordPress 7.0.3, with urgent updates recommended for all affected versions.

WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. pwn.ai demonstrated how the flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page.

Tracked as CVE-2026-64638 (CVSS score: 8.9), the

Read original article

*** END OF TRANSMISSION ***

> DEEPSEEK V4 FLASH 0731 ARC-AGI PERFORMANCE RESULTS > ORACLE PROHIBITS AI-GENERATED CODE IN OPENJDK CONTRIBUTIONS AMID INTERNAL AI USAGE > ECONOMIC ANALYSIS OF TAX CUTS FOR THE WEALTHY AND THEIR IMPACT ON INEQUALITY > ADDRESSING ADVANCED CYBER THREATS AND INFRASTRUCTURE SECURITY > CLOUDFLARE INTRODUCES KITESURF: A SPECIALIZED BROWSER FOR AI AGENTS > AUSTRALIA'S TUNGSTEN MINE LINKED TO GEOPOLITICAL CONFLICT FORECASTING > FRAMEWORK DATA BREACH AFFECTS ALL CUSTOMERS DUE TO METABASE CYBERATTACK > TECHCRUNCH DISRUPT 2026 TICKET DISCOUNT ENDS AUGUST 7, 2026 > SDSS-V DATA RELEASE 20 UNVEILS ALL-SKY MAP OF 500,000 SUPERMASSIVE BLACK HOLES > TRUMP ADMINISTRATION ALLOCATES $4B TO ABANDON OFFSHORE WIND PROJECTS, REDIRECT FUNDS TO NATURAL GAS> DEEPSEEK V4 FLASH 0731 ARC-AGI PERFORMANCE RESULTS > ORACLE PROHIBITS AI-GENERATED CODE IN OPENJDK CONTRIBUTIONS AMID INTERNAL AI USAGE > ECONOMIC ANALYSIS OF TAX CUTS FOR THE WEALTHY AND THEIR IMPACT ON INEQUALITY > ADDRESSING ADVANCED CYBER THREATS AND INFRASTRUCTURE SECURITY > CLOUDFLARE INTRODUCES KITESURF: A SPECIALIZED BROWSER FOR AI AGENTS > AUSTRALIA'S TUNGSTEN MINE LINKED TO GEOPOLITICAL CONFLICT FORECASTING > FRAMEWORK DATA BREACH AFFECTS ALL CUSTOMERS DUE TO METABASE CYBERATTACK > TECHCRUNCH DISRUPT 2026 TICKET DISCOUNT ENDS AUGUST 7, 2026 > SDSS-V DATA RELEASE 20 UNVEILS ALL-SKY MAP OF 500,000 SUPERMASSIVE BLACK HOLES > TRUMP ADMINISTRATION ALLOCATES $4B TO ABANDON OFFSHORE WIND PROJECTS, REDIRECT FUNDS TO NATURAL GAS