August 12, 2026 · by CLIQHOST
⚠️ ACTIVE THREAT — Published August 7, 2026 | Severity: HIGH | CVSS: 8.9
Executive summary: A pre-authentication reflected Cross-Site Scripting (XSS) vulnerability has been identified in all versions of WordPress, targeting the login page (/wp-login.php) directly. Scoring CVSS 8.9 (HIGH), this flaw can — under specific external conditions — be escalated to Remote Code Execution (RCE). If you're running any version of WordPress prior to 7.0.3, updating immediately is not optional.
CVE-2026-64638 is a Reflected Cross-Site Scripting (XSS) vulnerability, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The defining characteristic of this flaw is that it can be triggered without any prior authentication on the target WordPress site (pre-auth).
WordPress fails to properly sanitize a URL parameter passed to the login page. An attacker can craft a malicious link which, when visited by a victim, injects and executes arbitrary JavaScript code within the victim's browser session.
Attack chain:
1. The attacker sets up a malicious third-party website or phishing message containing a specially crafted URL pointing to the login page of a target WordPress site.
2. The victim is lured via social engineering (phishing email, social media message, etc.) into clicking the link.
3. The injected JavaScript executes in the victim's browser, within the context of their active session.
4. Under specific external conditions (beyond the attacker's direct control), the attack can be escalated to Remote Code Execution (RCE).
Context matters: The RCE escalation requires external conditions and explicit victim interaction — this is not a fully automated, one-click exploit. However, the CVSS score of 8.9 accurately accounts for the maximum potential damage in worst-case scenarios.
The vulnerability was responsibly disclosed by the team at pwn.ai. Full technical details are available in the HackerOne report #3877102.
If you host WordPress sites on a WordPress-optimized hosting plan or on an NVMe VPS, you need to take action right now.
| WordPress Version | Status |
|---|---|
| < 4.7 | Not covered by official backport |
| 4.7 – 7.0.2 | VULNERABLE — patch available via backport |
| 7.0.3 | ✅ PATCHED — safe version |
All WordPress versions are affected. The WordPress team has released version 7.0.3 containing the fix and has backported the patch to all active branches going back to version 4.7.
Official announcement: wordpress.org/news/2026/08/wordpress-7-0-3-release/
If you manage multiple WordPress installations — a common setup on cPanel shared hosting or dedicated servers — make sure to audit and update each instance individually.
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-64638 |
| CVSS Score | 8.9 (HIGH) |
| Attack Type | Reflected XSS, pre-authentication |
| Attack Vector | Network |
| User Interaction | Required (social engineering) |
| Possible Escalation | RCE (under external conditions) |
| CWE | CWE-79 |
What a successful attacker can achieve:
- Steal the victim's session cookies
- Redirect the victim to phishing or malware distribution pages
- Visually modify the page content seen by the victim
- Hijack the victim's WordPress account, including full admin takeover
- In advanced scenarios (under external conditions): execute arbitrary code on the server (RCE)
High-traffic websites and installations with active administrator sessions are high-priority targets. Clients running WordPress on a managed dedicated server should contact our server management team for a proactive security audit.
EN
RO — Română
RU — Русский
# Check the currently installed WordPress version
wp core version
# If the output is below 7.0.3, your site is vulnerable
# For WordPress Multisite installations
wp core version --allow-root
Dashboard → Updates# Via SSH or cPanel Terminal
cat /home/USER/public_html/wp-includes/version.php | grep wp_version
Expected output for a safe version:
$wp_version = '7.0.3';
If you manage multiple sites through cPanel hosting, check each hosting account individually. For a full security audit, reach out via the CLIQHOST contact page.
# Database backup
wp db export backup-$(date +%Y%m%d).sql
# WordPress file backup
tar -czf wordpress-backup-$(date +%Y%m%d).tar.gz /home/USER/public_html/
Alternatively, use cPanel's Backup Wizard for a full account snapshot.
Option A — WP-CLI:
wp core update --version=7.0.3
wp core update-db
Option B — Via WordPress Dashboard:
1. Go to Dashboard → Updates
2. Click Update Now under "WordPress 7.0.3 is available"
3. Wait for the success confirmation message
Option C — Manual Update (FTP/SSH):
1. Download WordPress 7.0.3 from wordpress.org
2. Replace the wp-admin/ and wp-includes/ directories (do not touch wp-content/)
3. Replace wp-login.php in the installation root
# Confirm the updated version
wp core version
# Expected output: 7.0.3
# Verify file integrity
wp core verify-checksums
/wp-login.php via IP whitelist or HTTP Basic Authentication at the server levelwp-login.phpAs a Moldova-based hosting provider with extensive experience in WordPress infrastructure, CLIQHOST offers multiple layers of protection against vulnerabilities like CVE-2026-64638.
On our WordPress hosting plans, our team actively monitors CMS versions and can proactively apply critical security updates — so you don't have to track every CVE manually.
All cPanel shared hosting plans include free Let's Encrypt SSL certificates, reducing the risk of session interception that XSS attacks can facilitate.
If you're running WordPress on an NVMe VPS or a managed dedicated server, our server management service includes:
- Continuous monitoring of installed package and CMS versions
- Priority emergency patching for critical vulnerabilities
- Firewall configuration and custom WAF rule setup
- Regular security audit reports
All CLIQHOST plans include automatic daily/weekly backups — a critical safety net for fast recovery in case of compromise.
Stay up to date with the latest security advisories by following the CLIQHOST blog.
CVE-2026-64638 is a HIGH-severity vulnerability with a credible escalation path. Do not delay updating to WordPress 7.0.3.
If you need technical assistance applying the patch, running a security audit, or configuring additional protective measures on your server, the CLIQHOST team is ready to help:
👉 Request WordPress Server Management & Security
👉 Explore Optimized WordPress Hosting Plans
This advisory is based on publicly available information as of August 7, 2026. CLIQHOST recommends monitoring the official WordPress security channel for any further updates.
Real reviews from customers who trust CLIQHOST for performance, reliability and expert technical support.
"We moved our online shop from a foreign host and the difference is night and day — pages load instantly and support replies in minutes, in Romanian."
"Migrated 12 client sites to CLIQHOST. Free migration, zero downtime, and the cPanel setup is exactly what my team needed. Highly recommend."
"Our NVMe VPS handles traffic spikes without a sweat. Full root, local datacenter, and billing in MDL — everything we wanted from a provider."
