#Wordpress: A Critical pre-auth #XSS to RCE vulnerability chain (CVE-2026-64638) dubbed #XSS2Shell is affecting all versions of WordPress Core. This vulnerability was discovered by AI (@pwn_ai). Patch to v7.0.3 ASAP - older versions backported:
👇
https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html
Sam Stepanyan :verified: 🐘
npub1gr…9gp67
2026-08-07 18:57:23 UTC
Author Public Key
npub1gr8f0c2al23r8wpv2v7vt2na36g3xnpz06pceqhrysmlg8gahyjqp9gp67Seen on
wss://relay.momostr.pinkPublished at
2026-08-07 18:57:23 UTCEvent JSON
{
"id": "75190076f9cb3014da2dc13feb6d98638fa450f7386ae67732855c390bb46614",
"pubkey": "40ce97e15dfaa233b82c533cc5aa7d8e91134c227e838c82e32437f41d1db924",
"created_at": 1786129043,
"kind": 1,
"tags": [
[
"t",
"xss"
],
[
"proxy",
"https://infosec.exchange/@securestep9/117055752968330233",
"web"
],
[
"t",
"wordpress"
],
[
"t",
"xss2shell"
],
[
"proxy",
"https://infosec.exchange/users/securestep9/statuses/117055752968330233",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/securestep9/statuses/117055752968330233",
"pink.momostr"
],
[
"-"
]
],
"content": "#Wordpress: A Critical pre-auth #XSS to RCE vulnerability chain (CVE-2026-64638) dubbed #XSS2Shell is affecting all versions of WordPress Core. This vulnerability was discovered by AI (@pwn_ai). Patch to v7.0.3 ASAP - older versions backported:\n👇\nhttps://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html",
"sig": "89a3f490e2865e32dcfde143e580a502308a2382a5b1b1e2ac7ecccce6b5de1d5ea8d3c08184eb52ed3511489dd34cd4f7f6c3c45d6d5a05a10f8cb1a60627ee"
}