Catalogo CVE
CVE-2026-64638
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be esc
- Gravità
- High · CVSS 8.9
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.89% · Oct 22, 2026
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | wordpress | sid | 7.1.3+dfsg1-1 | fixed |
| Debian | wordpress | forky | 7.1.3+dfsg1-1 | fixed |
| Debian | wordpress | trixie | 6.8.7+dfsg1-0+deb13u1 | fixed |
| Debian | wordpress | trixie-security | 6.8.10+dfsg1-0+deb13u1 | fixed |
| Debian | wordpress | bookworm | 6.1.9+dfsg1-0+deb12u1 | vulnerable |
| Debian | wordpress | bookworm-security | 6.1.9+dfsg1-0+deb12u1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | wordpress | source | sid | 7.0.3+dfsg1-1 | not yet assigned | Not reported | [1143843] |
| Debian | wordpress | source | forky | 7.0.3+dfsg1-1 | not yet assigned | Not reported | [1143843] |
| Debian | wordpress | source | trixie | 6.8.7+dfsg1-0+deb13u1 | not yet assigned | Not reported | [1143843] |
| Debian | wordpress | source | bookworm | (unfixed) | not yet assigned | Not reported | [1143843] |
OpenFactory catalog packages
L’associazione dei pacchetti è in corso.
[Debian 12 (Bookworm)]
- [wordpress]Sconosciuto
Dettagli (4)
6.1.9+dfsg1-0+deb12u1· all · bookwormInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookwormInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
- [wordpress-l10n]Sconosciuto
Pacchetto sorgente: [wordpress]
Dettagli (4)
6.1.9+dfsg1-0+deb12u1· all · bookwormInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookwormInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
- [wordpress-theme-twentytwentyone]Sconosciuto
Pacchetto sorgente: [wordpress]
Dettagli (4)
6.1.9+dfsg1-0+deb12u1· all · bookwormInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookwormInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
- [wordpress-theme-twentytwentythree]Sconosciuto
Pacchetto sorgente: [wordpress]
Dettagli (4)
6.1.9+dfsg1-0+deb12u1· all · bookwormInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookwormInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
- [wordpress-theme-twentytwentytwo]Sconosciuto
Pacchetto sorgente: [wordpress]
Dettagli (4)
6.1.9+dfsg1-0+deb12u1· all · bookwormInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookwormInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityInteressata
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
[Debian 13 (Trixie)]
- [wordpress]Sconosciuto
Dettagli (6)
6.8.3+dfsg1-0+deb13u1· all · trixieInteressata · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.3+dfsg1-0+deb13u1· all · trixieInteressata · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.10+dfsg1-0+deb13u1· all · trixie-securityCorretta · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.6+dfsg1-0+deb13u1· all · trixie-security · Historical versionInteressata · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-security · Historical versionCorretta · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-securityCorretta · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
- [wordpress-l10n]Sconosciuto
Pacchetto sorgente: [wordpress]
Dettagli (6)
6.8.3+dfsg1-0+deb13u1· all · trixieInteressata · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.3+dfsg1-0+deb13u1· all · trixieInteressata · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.10+dfsg1-0+deb13u1· all · trixie-securityCorretta · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.6+dfsg1-0+deb13u1· all · trixie-security · Historical versionInteressata · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-security · Historical versionCorretta · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-securityCorretta · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
- [wordpress-theme-twentytwentyfive]Sconosciuto
Pacchetto sorgente: [wordpress]
Dettagli (6)
6.8.3+dfsg1-0+deb13u1· all · trixieInteressata · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.3+dfsg1-0+deb13u1· all · trixieInteressata · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.10+dfsg1-0+deb13u1· all · trixie-securityCorretta · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.6+dfsg1-0+deb13u1· all · trixie-security · Historical versionInteressata · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-securityCorretta · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-security · Historical versionCorretta · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
- [wordpress-theme-twentytwentyfour]Sconosciuto
Pacchetto sorgente: [wordpress]
Dettagli (6)
6.8.3+dfsg1-0+deb13u1· all · trixieInteressata · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.3+dfsg1-0+deb13u1· all · trixieInteressata · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.10+dfsg1-0+deb13u1· all · trixie-securityCorretta · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.6+dfsg1-0+deb13u1· all · trixie-security · Historical versionInteressata · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-security · Historical versionCorretta · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-securityCorretta · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
- [wordpress-theme-twentytwentythree]Sconosciuto
Pacchetto sorgente: [wordpress]
Dettagli (6)
6.8.3+dfsg1-0+deb13u1· all · trixieInteressata · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.3+dfsg1-0+deb13u1· all · trixieInteressata · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.10+dfsg1-0+deb13u1· all · trixie-securityCorretta · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.6+dfsg1-0+deb13u1· all · trixie-security · Historical versionInteressata · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-securityCorretta · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-security · Historical versionCorretta · Corretta:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
Osservato:
Riferimenti
- [https://nvd.nist.gov/vuln/detail/CVE-2026-64638]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-64638]
- [https://security-tracker.debian.org/tracker/CVE-2026-64638]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2701.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]