EUVD-2026-54565Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H for required social engineering and non-deterministic RCE conditions; S:C because XSS crosses into victim browser scope; PR:N as login page is pre-auth.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
3DescriptionCVE.org
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim.
This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.
Discovered and responsibly disclosed by the team at pwn.ai.
AnalysisAI
Reflected XSS on the WordPress login page allows remote unauthenticated attackers to inject and execute malicious scripts in a victim's browser via specially crafted URLs, with a conditional escalation path to remote code execution. All WordPress versions are affected; exploitation requires active social engineering and explicit victim interaction, and the RCE escalation pathway depends on conditions outside the attacker's direct control. No public exploit has been identified at time of analysis; WordPress 7.0.3 and backported branch releases resolve the vulnerability.
Technical ContextAI
The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - XSS), specifically a reflected variant. WordPress's login page (wp-login.php) is publicly accessible without authentication and processes URL query parameters that are reflected into the HTML response without adequate output encoding or sanitization. This is a pre-authentication surface, meaning no valid session or credentials are required to reach the vulnerable parameter. The potential RCE escalation is not inherent to the XSS itself but depends on secondary factors - likely involving script execution context, browser capabilities, or downstream server interaction - described by the researcher as conditions outside the attacker's control. WordPress is a PHP-based CMS; the affected codebase spans all releases from 4.7 onward.
RemediationAI
Upgrade WordPress to version 7.0.3 or the latest patched release for your maintained branch (backports are available for all branches back to 4.7). Refer to the official release announcement at https://wordpress.org/news/2026/08/wordpress-7-0-3-release/ for update instructions and changelog details. As an interim compensating control for installations that cannot be immediately patched, deploy a Web Application Firewall rule targeting reflected script-injection patterns in login page request parameters - note that WAF rules may require tuning to avoid blocking legitimate traffic and should not be treated as a permanent substitute for patching. Additionally, user awareness around phishing attempts targeting WordPress login URLs reduces the social engineering precondition required for exploitation.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today