XSS2Shell Turns a Failed WordPress Login Into Remote Code Execution on 500 Million Sites

On August 6, 2026, the WordPress security team shipped an emergency 7.0.3 release, patching CVE-2026-64638 — a vulnerability now called XSS2Shell. The bug sits in a line of code present in WordPress Core since version 4.7, which means it touched every actively maintained installation of the CMS powering 43% of the web — over 500 million sites. The chain turns a failed login on wp-login.php into full PHP remote code execution with no prior authentication.

Discovered by researchers at pwn.ai, the flaw exploits a years-old disagreement between two HTML parsers that coexist inside WordPress.

A Parser Disagreement at the Core

When a user submits a non-existent username on wp-login.php, WordPress builds an error message using the wp_strip_all_tags function. That is where the trap closes.

By inserting a space between the opening angle bracket and the tag name — < area> instead of <area> — the attacker tricks PHP’s native strip_tags parser into seeing harmless text. But KSES (Kses Strips Evil Scripts), WordPress’s historical sanitizer, reinterprets that same string as legitimate HTML containing interactive elements such as <area>, <div>, and <button>.

The result: attacker-controlled HTML elements land directly on the login page, with no account, no cookie, no authentication required.

From HTML Injection to RCE in Three Steps

The injected elements contain no JavaScript. But they are crafted to match selectors that WordPress’s own user-profile.js file automatically searches for on page load — a leftover from password-reset functionality.

This match triggers an automatic click that cascades into an AJAX request. Through a DOM clobbering technique, the injected element hijacks the destination URL, pointing it at WordPress’s REST API with method-override and JSONP parameters. The response comes back wrapped in executable JavaScript — giving the attacker arbitrary script execution inside the WordPress origin, purely pre-auth.

Escalating to full PHP remote code execution requires an additional step, which is why the CVSS score sits at 8.9 rather than maximum. If a logged-in administrator is lured to a malicious third-party page and interacts with it, the attacker’s script can:

1. Mint a WordPress Application Password using the admin’s legitimate session
2. Publish a page containing arbitrary JavaScript through the unfiltered_html privilege
3. Upload a plugin ZIP containing a PHP webshell

All through legitimate, authenticated REST API calls the administrator never explicitly approved.

The 2022 Technique That Came Back

The underlying method builds on 2022 research by Paulos Yibelo on Same Origin Method Execution (SOME), a technique originally used to bypass Content Security Policy protections on WordPress sites. It was nominated for Top Web Hacking Technique of the year. Four years later, it found a far more devastating application.

WordPress backported the fix all the way to version 4.7, covering every branch still receiving security updates. No active in-the-wild exploitation or public proof-of-concept has been reported at the time of publication, according to vulnerability trackers.

Verdict

XSS2Shell is a brutal reminder that a CMS’s attack surface does not stop at third-party plugins. A sanitization function written a decade ago, a forgotten JavaScript leftover, and a parser disagreement are enough to expose half the web. If you manage a WordPress site, the question is not whether you will patch — it’s whether you already have.

References

• WordPress.org — Version 7.0.3 Security Release (August 6, 2026)
• pwn.ai — XSS2Shell: From Failed Login to RCE (August 7, 2026)
• Cyber Security News — WordPress XSS2Shell Vulnerability (August 7, 2026)