WordPress login error parsing permits pre-auth reflected XSS and conditional administrator-to-RCE chaining
WordPress fails to safely encode an attacker-supplied log username when a failed POST to /wp-login.php references a nonexistent account. A parser mismatch lets specially spaced tag-like text survive sanitize_user() and wp_strip_all_tags(), then become live HTML when login_header() and wp_admin_notice() render the invalid_username error through wp_kses_post(). This enables unauthenticated JavaScript execution in the WordPress origin. The published chain uses the login-page scripts, REST JSONP, Application Password authorization and plugin upload to reach PHP code execution, but it requires social engineering, active victim interaction and a suitably privileged Administrator who is already logged in. Patched releases call esc_html() before placing reflected usernames or email addresses into authentication errors.
- Component
- WordPress
- Plugin slug
Core- Affected
- See vendor advisory
- Safe version
7.0.3, 6.9.6, 6.8.7, 6.7.6, 6.6.6, 6.5.9, 6.4.9, 6.3.9, 6.2.10, 6.1.11, 6.0.13, 5.9.14, 5.8.14, 5.7.16, 5.6.18, 5.5.19, 5.4.20, 5.3.22, 5.2.25, 5.1.23, 5.0.26, 4.9.30, 4.8.29, 4.7.34- Published
- Aug 07, 2026
This CVE was published Aug 07, 2026 and is one of 50 known issues for WordPress core.
Update, patch or deactivate.
Update immediately to WordPress 7.0.3 or the listed patched release for the site's maintained branch; upgrade installations older than 4.7 to a supported patched branch. If a privileged user may have followed an attacker-controlled link while logged in, revoke unexpected Application Passwords, inspect recently created or modified users, posts, plugins and files, invalidate privileged sessions and rotate affected credentials.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).
CVE / CNA vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X