WordPress shipped a security release on August 6 fixing 12 vulnerabilities, the most serious a login screen bug that can be escalated to full code execution. Every version of WordPress is affected. Update now.
What happened
The headline flaw is a pre-authentication reflected cross-site scripting (XSS) bug on the login screen, tracked as CVE-2026-64638. Reflected XSS means malicious code runs in a victim’s browser after they click a crafted link, it doesn’t spread on its own. WordPress’s advisory says the flaw can be escalated to remote code execution, but only “with conditions outside of the attacker’s control” and after successfully tricking a logged-in user into clicking that link. Security firm Patchstack, which published its own technical analysis, notes this makes it a targeted attack aimed at one specific person on one specific site, not a drive-by that scans the web for vulnerable installs.
The other 11 fixes are lower severity but still worth knowing about. Several are stored XSS bugs that need at least a Contributor-level account to exploit, in the Post Content block, the Post Date block, Quick Edit, and the emoji settings. There’s also a privilege escalation bug on multisite networks with user registration enabled, letting a registered user spin up a new site without permission. An information disclosure bug in the Latest Comments block could expose comments left on password-protected posts. Rounding out the list: a CSS injection filter bypass, an email confirmation bypass, disclosure of private notes in comment feeds, post slug enumeration, and a server-side request forgery bug that could let your server be tricked into reaching internal network addresses it shouldn’t.
This isn’t the mass-exploitable RCE that hit WordPress last month. WP2Shell could be triggered by anyone, no account or trickery required, and racked up more than 11 million attack attempts. Today’s flaws all need either an existing account or a successfully phished admin, which makes them harder to weaponize at scale.
Who is at risk
Every WordPress site is affected, since the login screen bug touches all versions. WordPress has backported the fixes to every branch going back to 4.7, so there’s a patched release no matter how old your install is.
What to do
Check your Dashboard → Updates page and confirm you’re running 7.0.3, or the matching patched release for your branch (7.0.3, 6.9.x, 6.8.x, and so on back to 4.7). Sites with automatic background updates enabled should already be updated, don’t assume, check. If you’re testing WordPress 7.1, a second release candidate landed alongside 7.0.3 yesterday, carrying the same fixes. We covered RC1 two days ago; the final release is still on track for August 19.
End of article