Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: WordPress website administrators
Incident: A high-severity pre-authentication XSS vulnerability in WordPress allows for potential remote code execution.
Impact: Attackers could steal database credentials, create persistent admin accounts, and execute operating-system commands.
Attacker: Unidentified threat actors
Analysis: The vulnerability, tracked as CVE-2026-64638, results from inconsistent sanitization of usernames on the login screen. By chaining this XSS with the site’s REST JSONP support, attackers can steer administrative sessions toward executing arbitrary server-side code. This attack chain, discovered by pwn.ai, demonstrates how minor input flaws can lead to complete system takeover.
Recommendations: Update WordPress to version 7.0.3 or the latest patched version immediately.; Enable automatic background updates to ensure critical security fixes are applied without delay.; Audit administrative account logs for any unauthorized user creation or unexpected configuration changes.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source