Bug#1143844: wordpress: CVE-2026-64638 pre-auth reflected XSS on login screen leads to RCE

Package: wordpress
Version: 7.0.2+dfsg1-1
Severity: grave
Tags: security
Justification: user security hole

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.

Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim.

This issue affects all versions of WordPress.

References:
 https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-52p2-r8wf-jcrf
 https://wordpress.org/news/2026/08/wordpress-7-0-3-release/


-- System Information:
Debian Release: 13.6
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable-debug'), (500, 'stable'), (50, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.12.100+deb13-amd64 (SMP w/12 CPU threads; PREEMPT)
Locale: LANG=en_AU.UTF-8, LC_CTYPE=en_AU.UTF-8 (charmap=UTF-8), LANGUAGE=en_AU:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages wordpress depends on:
ii  apache2 [httpd]                         2.4.68-1~deb13u1
ii  ca-certificates                         20250419
pn  default-mysql-client | virtual-mysql-c  <none>
    lient
pn  libapache2-mod-php | php                <none>
pn  libjs-cropper                           <none>
ii  libjs-lodash                            4.17.21+dfsg+~cs8.31.198.20210220-9
ii  libjs-underscore                        1.13.4~dfsg+~1.11.4-3
pn  php-gd                                  <none>
pn  php-getid3                              <none>
pn  php-mysql | php-mysqlnd                 <none>

Versions of packages wordpress recommends:
pn  wordpress-l10n                    <none>
pn  wordpress-theme-twentytwentyfive  <none>

Versions of packages wordpress suggests:
pn  default-mysql-server | virtual-mysql-server  <none>
pn  php-curl                                     <none>
pn  php-imagick                                  <none>
pn  php-mbstring                                 <none>
pn  php-ssh2                                     <none>
ii  php-xml                                      2:8.4+96
pn  php-zip                                      <none>
ii  php8.4-xml [php-xml]                         8.4.24-1~deb13u1