CVE-Katalog
CVE-2026-64638
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be esc
- Schweregrad
- High · CVSS 8.9
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.89% · Oct 22, 2026
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | wordpress | sid | 7.1.3+dfsg1-1 | fixed |
| Debian | wordpress | forky | 7.1.3+dfsg1-1 | fixed |
| Debian | wordpress | trixie | 6.8.7+dfsg1-0+deb13u1 | fixed |
| Debian | wordpress | trixie-security | 6.8.10+dfsg1-0+deb13u1 | fixed |
| Debian | wordpress | bookworm | 6.1.9+dfsg1-0+deb12u1 | vulnerable |
| Debian | wordpress | bookworm-security | 6.1.9+dfsg1-0+deb12u1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | wordpress | source | sid | 7.0.3+dfsg1-1 | not yet assigned | Not reported | [1143843] |
| Debian | wordpress | source | forky | 7.0.3+dfsg1-1 | not yet assigned | Not reported | [1143843] |
| Debian | wordpress | source | trixie | 6.8.7+dfsg1-0+deb13u1 | not yet assigned | Not reported | [1143843] |
| Debian | wordpress | source | bookworm | (unfixed) | not yet assigned | Not reported | [1143843] |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [wordpress]Betroffen
Details (4)
6.1.9+dfsg1-0+deb12u1· all · bookwormBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookwormBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
- [wordpress-l10n]Betroffen
Quellpaket: [wordpress]
Details (4)
6.1.9+dfsg1-0+deb12u1· all · bookwormBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookwormBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
- [wordpress-theme-twentytwentyone]Betroffen
Quellpaket: [wordpress]
Details (4)
6.1.9+dfsg1-0+deb12u1· all · bookwormBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookwormBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
- [wordpress-theme-twentytwentythree]Betroffen
Quellpaket: [wordpress]
Details (4)
6.1.9+dfsg1-0+deb12u1· all · bookwormBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookwormBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
- [wordpress-theme-twentytwentytwo]Betroffen
Quellpaket: [wordpress]
Details (4)
6.1.9+dfsg1-0+deb12u1· all · bookwormBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookwormBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
6.1.9+dfsg1-0+deb12u1· all · bookworm-securityBetroffen
nvd · wordpress · debian · bookworm; nvd · wordpress · debian · 12
[Debian 13 (Trixie)]
- [wordpress]Betroffen
Details (6)
6.8.3+dfsg1-0+deb13u1· all · trixieBetroffen · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.3+dfsg1-0+deb13u1· all · trixieBetroffen · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.10+dfsg1-0+deb13u1· all · trixie-securityBehoben · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.6+dfsg1-0+deb13u1· all · trixie-security · Historical versionBetroffen · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-security · Historical versionBehoben · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-securityBehoben · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
- [wordpress-l10n]Betroffen
Quellpaket: [wordpress]
Details (6)
6.8.3+dfsg1-0+deb13u1· all · trixieBetroffen · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.3+dfsg1-0+deb13u1· all · trixieBetroffen · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.10+dfsg1-0+deb13u1· all · trixie-securityBehoben · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.6+dfsg1-0+deb13u1· all · trixie-security · Historical versionBetroffen · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-securityBehoben · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-security · Historical versionBehoben · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
- [wordpress-theme-twentytwentyfive]Betroffen
Quellpaket: [wordpress]
Details (6)
6.8.3+dfsg1-0+deb13u1· all · trixieBetroffen · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.3+dfsg1-0+deb13u1· all · trixieBetroffen · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.10+dfsg1-0+deb13u1· all · trixie-securityBehoben · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.6+dfsg1-0+deb13u1· all · trixie-security · Historical versionBetroffen · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-security · Historical versionBehoben · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-securityBehoben · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
- [wordpress-theme-twentytwentyfour]Betroffen
Quellpaket: [wordpress]
Details (6)
6.8.3+dfsg1-0+deb13u1· all · trixieBetroffen · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.3+dfsg1-0+deb13u1· all · trixieBetroffen · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.10+dfsg1-0+deb13u1· all · trixie-securityBehoben · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.6+dfsg1-0+deb13u1· all · trixie-security · Historical versionBetroffen · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-securityBehoben · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-security · Historical versionBehoben · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
- [wordpress-theme-twentytwentythree]Betroffen
Quellpaket: [wordpress]
Details (6)
6.8.3+dfsg1-0+deb13u1· all · trixieBetroffen · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.3+dfsg1-0+deb13u1· all · trixieBetroffen · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.10+dfsg1-0+deb13u1· all · trixie-securityBehoben · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.6+dfsg1-0+deb13u1· all · trixie-security · Historical versionBetroffen · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-securityBehoben · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1· all · trixie-security · Historical versionBehoben · Behoben:
6.8.7+dfsg1-0+deb13u1nvd · wordpress · debian · 13
Beobachtet:
Referenzen
- [https://nvd.nist.gov/vuln/detail/CVE-2026-64638]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-64638]
- [https://security-tracker.debian.org/tracker/CVE-2026-64638]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2701.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]