A working proof-of-concept exploit for "XSS2Shell" is now circulating publicly, raising the stakes on a WordPress Core flaw that turns a single failed login into attacker-controlled JavaScript — and, against an administrator, full server takeover.
A Python-based exploit tool that walks through the pre-auth XSS to RCE chain appeared on GitHub within a day of disclosure, so unpatched sites are now on the clock.
Tracked as CVE-2026-64638 (CVSS 8.9), the bug was found by security firm pwn.ai. The twist: it was reproduced autonomously by the company's multi-agent system, seeded with Paulos Yibelo's 2022 Same Origin Method Execution research — not by a human hunting through code.
It has shipped with WordPress since version 4.7, slipping past every audit while the CMS grew to power more than 43% of the web — an estimated 500 million-plus sites exposed before the fix.
When someone submits an unknown username, wp-login.php echoes it back into an error message. Inserting a space after the opening bracket — "< area" — makes PHP's strip_tags() treat the string as harmless text, while WordPress's own KSES sanitizer later reinterprets it as a live HTML tag.
The login page then wires those injected elements into its own scripts and fires a same-origin request that runs attacker code — no account, no cookies, no clicks needed for the XSS.
The jump to remote code execution is nastier but conditional. It requires a victim already logged in as Administrator and explicit interaction with an attacker-controlled page — which is why WordPress's advisory notes the path requires social engineering and explicit victim interaction, landing the CVE at High rather than maximum.
WordPress fixed it in version 7.0.3 on August 6, alongside eleven other patches, and backported it to every supported branch down to 4.7. The patch simply HTML-escapes the username with esc_html() before it's displayed. Update now. If you can't, block the login payload at your firewall and audit for rogue application passwords or unfamiliar plugin folders.