What happened
WordPress released a security update on August 7 for a high-severity vulnerability on its login screen. Tracked as CVE-2026-64638 and rated 8.9 on the CVSS scale, the bug is a reflected cross-site scripting flaw discovered by the research team at pwn.ai. A specially crafted username slips past WordPress's sanitization functions and causes JavaScript to run in a visitor's browser, with no login required. On its own that is bad; the researchers went further and showed the flaw can be chained, using WordPress's user-profile script and REST JSONP support, into approving application passwords and uploading a malicious plugin, which means full PHP code execution on the server. The fix ships in WordPress 7.0.3, with backported patches reaching all the way to the 4.7 branch. As of the disclosure, there were no reports of exploitation in the wild, and sites with automatic background updates should receive the patch on their own.
Why it matters for your business
WordPress powers a large share of small-business websites in the DMV, and the login page is the one URL every WordPress site exposes. A flaw that starts there and can end in code execution is exactly the kind attackers automate at scale once a working exploit circulates. A hijacked site does not just embarrass you; it can serve malware to your customers, tank your search rankings, and get your domain blocklisted.
What to do about it
- Check your WordPress version today; you want 7.0.3 or a patched backport for your branch
- If your site is managed by an agency or hosting company, ask them to confirm in writing that core updates are applied automatically
- Very old sites on versions before 4.7 will not receive this fix and should be migrated
- Keep working: strong admin passwords, two-factor authentication, and limiting login-page exposure are still worth doing, but they are not substitutes for this update