What happened
Security firm Imperva published research on August 10 on CVE-2026-64638, a high-severity flaw in WordPress core that researchers call XSS2Shell. The bug lives in how the WordPress login page sanitizes HTML: two parsers disagree about malformed markup, letting an attacker slip script code past the filter. On its own that produces a reflected cross-site scripting attack that requires no login. Chained against a site administrator who is signed in, it can be escalated through legitimate WordPress features into PHP code execution — meaning the attacker ends up running code on the server itself. The flaw scores 8.9. WordPress fixed it in version 7.0.3 and backported patches across maintained branches, including 6.9.6, 6.8.7, and 6.7.6, reaching all the way down to the 4.7 line. This is not theoretical: Imperva says it observed automated probing against more than 11,000 distinct websites in 67 countries, generating hundreds of thousands of requests.
Why it matters for your business
WordPress powers a huge share of small-business websites in the DC, Maryland, and Virginia market — firm sites, restaurants, medical practices, nonprofits. A takeover does not just deface a page; it can turn your site into a phishing host, steal customer data, or quietly poison your search rankings. Because the scanning is automated, small sites are just as likely to be probed as big ones.
What to do about it
- Check your WordPress version today and update to 7.0.3 or the patched release for your branch
- Confirm automatic background updates actually completed — do not assume
- Review administrator accounts for changes you do not recognize
- Avoid clicking unfamiliar links while signed in to your site's admin, since the attack chain targets logged-in admins
- If an agency or freelancer maintains your site, forward them this CVE number