XSS2Shell Vulnerability Puts 500 Million WordPress Sites at Risk of RCE

WordPress released patches for CVE-2026-64638 (“XSS2Shell”), a pre-auth reflected XSS on wp-login.php that can be chained to server-side PHP execution if an authenticated administrator is tricked into interacting with a malicious page; updates (including WordPress 7.0.3 and maintenance releases back to 4.7) should be applied immediately. The flaw was disclosed and demonstrated by pwn.ai, which estimated some 500M+ sites were vulnerable prior to the fixes, but neither pwn.ai nor WordPress reported evidence of active exploitation in the wild.