{"uuid": "b36f3e17-b362-4203-95c4-0621dd95d51c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64638", "type": "seen", "source": "https://t.me/pphm_HackerNews/2525", "content": "\ud83d\udd34 New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP\n\nWordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. pwn.ai demonstrated how the flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page.\n\nTracked as CVE-2026-64638 (CVSS score: 8.9), the high-severity vulnerability requires no attacker privileges. According to pwn.ai, which discovered the flaw, the login-page XSS requires no authentication. Once a crafted username reaches the failed-login error page, the resulting JavaScript executes in the visitor's browser with no further interaction required on that page.", "creation_timestamp": "2026-08-21T23:00:07.062572Z"}