A critical WordPress flaw (XSS2Shell), update to 7.0.3 immediately
On 6 August 2026 the WordPress team released an urgent update, 7.0.3, that patches a serious security flaw tracked as CVE-2026-64638 and named by its discoverers "XSS2Shell". In short: it is a bug on the login screen that, under favourable conditions, can be escalated all the way to PHP code execution on the server, that is, a full site takeover. If you run a WordPress site, this article tells you plainly whether it affects you and what to do.
What kind of flaw it is
It is a so-called reflected XSS, cross-site scripting, on the login page, working without logging in (pre-auth). The attacker prepares a crafted, foreign page and lures the victim into opening it. In an unfavourable combination of circumstances this leads to injecting code that, using the "same origin" technique, can steal a so-called Application Password, upload a plugin and finally run PHP code (RCE) on the server.
It sounds serious and is rated that way: high level, CVSS 8.9/10. But two things must honestly be added that reduce the risk of a mass attack:
- It requires victim interaction: the attack does not happen "by itself". Someone has to be fooled into opening a link/page prepared by the attacker while logged in as an administrator.
- High complexity: full escalation to code execution depends on conditions the attacker does not fully control.
As of the fix's release, no attacks in the wild were recorded. That is good news, but the flaw is public, so time is against you. With bugs of this type, exploitation attempts usually appear soon after disclosure.
Who it affects
Practically every WordPress version in use, vulnerable branches run from 6.4 to 7.0.2, and the fix was backported even to very old releases, down to 4.7. In other words: if your site has not been updated yet, it is most likely vulnerable.
The fix is in:
- 7.0.3 (the latest branch),
- and in the patched versions of older branches: 6.9.6, 6.8.7, 6.7.6, 6.6.6, 6.5.9, 6.4.9 and later.
Important: 7.0.3 is the safe version, it contains the patch. If you see 7.0.3 on your site, you have already updated.
What to do: now
- Update the WordPress core to 7.0.3 (or the patched version of your branch). It is the only real protection, the flaw is in the system itself, not in a plugin.
- Make a backup before updating: core updates are usually trouble-free, but the "backup first" rule always applies.
- Be careful as an administrator: do not click suspicious links, especially while logged in to the panel. This attack preys precisely on a logged-in admin's interaction.
- Enable two-factor login: an extra layer that makes account takeover harder even if data leaks.
If you have several or a dozen sites, it is crucial that none is missed, a single outdated installation is enough to become a target. You will find the full list of protections in our WordPress security guide, and we track current flaws on the current threats page.
Not sure which WordPress version your site has, or whether an update will break something? That is normal, and it is exactly what we are here for.
We will update it for you: safely
A core update sounds simple, until something "breaks": a plugin conflict, a white screen, a shop that stops taking orders. We do it with a backup and a rollback plan, checking the site afterwards, so that it is safe and still works. If your site has already gone down or you suspect a break-in, we will handle the post-hack repair and close the door.
Write to us through the contact form, we will diagnose the situation for free and tell you plainly what needs to be done. With flaws like this, time matters.