> TritonInfoSec News
Home / Aug 08, 2026 / Story
0
#4 The Hacker News general August 07, 2026 at 12:56 UTC

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

By [email protected] (The Hacker News)

AI Summary

WordPress has patched CVE-2026-64638 (CVSS 8.9), a pre-authentication reflected XSS flaw in the login screen affecting every version of the CMS that requires no attacker privileges. Under specific conditions the bug chains into server-side PHP code execution, making it critical for the hundreds of millions of WordPress deployments worldwide to apply the patch immediately.

Read full article → https://thehackernews.com/2026/08/new-wordpress-pr…

Relevance score: 86.0/100

# More from August 08

  1. 1
    Snowflake Hacker Pleads Guilty Over Breaches Affecting at Least 100 Million People The Hacker News
  2. 2
    18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers The Hacker News
  3. 3
    Hackers Start Exploiting Recent JetBrains TeamCity Vulnerability SecurityWeek
  4. 5
    Belarusian Ransom Cartel Mastermind Gets 16 Years in Prison SecurityWeek
  5. 6
    New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs The Hacker News
  6. 7
    Metabase SQLi zero-day exploited in customer data-theft attacks BleepingComputer
  7. 8
    Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets The Hacker News
  8. 9
    Despite federal warnings, thousands of U.S. industrial controllers used in water systems remain exposed online CyberScoop
  9. 10
    New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts The Hacker News