The Hacker News (Security) Aug 7, 2026 · 12:56 PM · 1 min read

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. Under additional conditions, the bug can be chained into PHP code execution on the server. Tracked as CVE-2026-64638 (CVSS score: 8.9), the High-severity vulnerability requires no attacker privileges. According to pwn.ai,

This is a summary aggregated from The Hacker News (Security). Read the complete article on the original site:

Read full article at The Hacker News (Security)

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

More Cybersecurity News

Apple Testing iOS 26.6.1 Update for iPhones

This 'classic' decades-old SQL injection flaw could let hackers take over entire Windows servers, thanks to a nifty database trick

Real emails, hijacked payments: Two H1 2026 attack chains

How to combat the new threats in open-source libraries

The White House’s plan to vet potentially dangerous AI is cloaked in secrecy

Iran’s grip on trade is a potent weapon, but it has an expiry date