A vulnerability in WordPress can, in the worst case, lead to a complete server takeover. Victims do have to play along and click a crafted link. The developers have since closed the flaw, and there are indications that attackers are already exploiting it. WordPress 7.0.3 is protected against the attacks.
What's behind the flaw
The vulnerability, rated high, carries the identifier CVE-2026-64638 and is called XSS2Shell. The bug lies in WordPress's own HTML filter functions. For an attack to succeed, a victim has to cooperate. The attacker creates a harmless-looking HTML page with a hidden form that targets the victim's WordPress login page. Via a phishing email, they get the victim to open the crafted page.
Once that happens, a script automatically submits the form in the victim's browser, without any click or input. Because the form is sent to the target site's wp-login.php file, a crafted username with disguised HTML snippets lands on the server and gets built into the login error page. The victim's browser then displays this genuine login page along with the injected elements. Since all of this happens within the origin of the real WordPress site, the malicious code runs with the victim's privileges and cookies.
From cross-site scripting to server takeover
The pure code execution in the browser (cross-site scripting) works for every victim, regardless of their privileges. It gets critical when the victim is logged in as an administrator. In that case, the attacker can use an additional trick to automatically grab an API access token and, in the next step, upload and run their own PHP code on the server. From that point on, the WordPress instance is considered fully compromised. If you run WordPress, you should update to version 7.0.3 promptly, especially since exploitation attempts have already been observed.