Fix guides / Security notices

Security notice

WordPress XSS2Shell: fixed in August, exploit tools are public. Check your version.

Last updated: Thursday, October 22, 2026, 4:51 PM ETStatus: Fixed in August. Public exploit tools available. Update and check.

This is not a new flaw. On August 6, 2026, WordPress fixed CVE-2026-64638, nicknamed XSS2Shell, a flaw in the WordPress login page that lets an outsider run their own code in a visitor's browser. Its finders, the security company pwn.ai, showed that if a logged in site admin opens a booby trapped link, an attacker can go on to take over the whole site. WordPress rates it 8.9 out of 10, High. What has changed since August is that free exploit tools for it are easy to find, and Tenable lists it as "exploit available." Most sites got the fix automatically. The sites at risk are ones that never updated, ones stuck on old versions, and anything on WordPress 4.6 or older, which gets no fix at all. Check your version today; it takes a minute.

What happened

Who should worry

You are probably fixed if your site updates WordPress automatically and now runs 7.1.3. Check anyway. Ask about this if any of these are true:

Stores on Shopify, Squarespace or Wix do not run WordPress and are not affected by this flaw.

What to do now

  1. Check your version. In WordPress, go to Dashboard, then Updates. Do not assume auto updates worked; the University of Toronto and CUHK both say to verify the running version. (University of Toronto, CUHK)
  2. Update. WordPress's current release is 7.1.3 (October 6, 2026). If you must stay on an older branch, install that branch's newest security release, not just the August one. A later WordPress flaw, CVE-2026-87902, is on CISA's exploited list and was fixed in newer branch releases on September 22. (WordPress, GitHub advisory, CISA)
  3. On 4.6 or older, move to a supported version or take the site down. There is no fix. (University of Toronto, The Hacker News)
  4. Look for signs someone got in. Check Users for admins you don't recognize, each admin's profile for Application Passwords you didn't create, the wp-content/plugins folder for unfamiliar folders (even inactive ones), and Pages for new pages you didn't publish. Ask your host about recently changed files. (CUHK, University of Toronto, pwn.ai)
  5. Admins: don't click unexpected links while logged in to WordPress. The takeover path depends on a logged in admin opening the attacker's page.

Until you can update. The University of Toronto suggests turning off Application Passwords if you don't use them and setting DISALLOW_FILE_MODS to block plugin uploads from the dashboard. These block the takeover path pwn.ai showed but not the underlying flaw. OpenCVE suggests limiting who can reach the login page as a temporary step; our guide to an admin login page open to the internet explains how. None of these replace updating. A Content Security Policy does not stop this attack, according to the University of Toronto's tests. Patchstack has published a blocking rule for its customers, but pwn.ai published a variant that gets past firewall rules that only block ?rest_route=. (University of Toronto, OpenCVE, Patchstack, pwn.ai)

What to send your developer, agency or host

WordPress fixed CVE-2026-64638 (XSS2Shell, CVSS 4.0 score 8.9, High) on August 6, 2026. It is a pre-authentication reflected XSS on wp-login.php that pwn.ai chained to PHP code execution through a logged in administrator, Application Passwords and a plugin ZIP upload. Public exploit tools now exist. It affects WordPress 4.7 through 7.0.2; 4.6 and older get no fix. Please confirm the WordPress version on every site you manage for us, update to 7.1.3 or the newest security release for the branch (which also covers CVE-2026-87902, fixed September 22), and check for unexpected Application Passwords, new admin accounts, unfamiliar folders in wp-content/plugins, new pages and recently changed files. If Application Passwords are not used, please turn them off. Sources: GitHub advisory, WordPress 7.0.3 release, pwn.ai.

Technical steps

Step 1. Check your version

wp core version

Fixed versions from August 6: 7.0.3, 6.9.6, 6.8.7, 6.7.6, 6.6.6, 6.5.9, 6.4.9, 6.3.9, 6.2.10, 6.1.11, 6.0.13, 5.9.14, 5.8.14, 5.7.16, 5.6.18, 5.5.19, 5.4.20, 5.3.22, 5.2.25, 5.1.23, 5.0.26, 4.9.30, 4.8.29, 4.7.34. Any later release on the same branch also includes the fix. (GitHub advisory)

Step 2. Update

wp core update
wp core version

Step 3. Check Application Passwords and admins

wp user list --role=administrator
wp user application-password list <user>

Delete any Application Password you don't recognize, and any admin account you didn't create.

Step 4. Check plugin folders

ls -la wp-content/plugins

Compare each folder against wp plugin list. A folder you don't recognize can hold code that runs even though the plugin was never activated. (pwn.ai, University of Toronto)

Step 5. If you don't use Application Passwords, turn them off

Add to a must use plugin or your theme's functions file:

add_filter( 'wp_is_application_passwords_available', '__return_false' );

To block plugin and theme uploads from the dashboard, add to wp-config.php:

define( 'DISALLOW_FILE_MODS', true );

Note that DISALLOW_FILE_MODS also turns off dashboard updates, so use it only where updates are handled another way. (University of Toronto)

Common questions

Is this a new WordPress flaw?

No. WordPress fixed it on August 6, 2026. What is new is that ready made exploit tools are now public, so sites that never got the fix are easier targets.

Has my business been hacked?

This notice does not mean your business has been hacked. The takeover path needs a logged in admin to open an attacker's page, and only sites still on an old version are exposed. Check your version and the signs listed above.

My site updates automatically. Am I safe?

Probably, but check. The University of Toronto and CUHK both say to confirm the version your site is actually running rather than assume the update worked.

Can EverThread tell me if I am affected?

Our website scan checks your site from the outside, the way a browser sees it, and does not check your WordPress version or test for this flaw. If you use EverThread client reports with the EverThread Connect plugin installed, the report shows the WordPress version the site runs and whether WordPress says an update is waiting; compare that version with the list above. Our free scan does flag an admin login page that is open to the internet, which is covered in our guide.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

We email you a link to confirm first, and every alert has a one-click unsubscribe. Alerts can include a short note about EverThread. Already a customer? Use your account email and your alerts include a link to your dashboard. Privacy

Sources

While you are here

Check your site's other basics free. We look at your home page the way a browser does and tell you in plain English. This scan does not check your WordPress version or test for the XSS2Shell flaw above. No account.

Or sign up free and we check it every day and email you when something changes.