A critical vulnerability chain in WordPress Core, tracked as CVE-2026-64638 and nicknamed XSS2Shell, that turns a single failed login attempt into full remote code execution on the underlying server. Because the flaw sits in code that has shipped with WordPress since version 4.7, it touched effectively every actively maintained installation of the world’s most popular content management system, which powers more than 43% of all websites on the internet, putting an estimated 500 million-plus sites at risk before a fix landed. The chain begins on the ordinary login page, wp-login.php. When a username that does not exist is submitted, WordPress builds an error message using a sanitization function called...
Read the full article at the source.
Comments (0)
No comments yet. Be the first to comment!