Live › vulnerability › CVE-2026-64638
Go to dashboardWordPress's login screen reflects user input without escaping, so a crafted link can run script in a victim's browser. Under additional conditions the sources say it may escalate to remote code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:43 UTC, 0h before NVD. All times on this page are UTC.
WordPress sites with a publicly reachable login screen are the exposed surface, since the flaw is on wp-login. The sources do not say which WordPress versions or plugins are affected. Sites behind a WAF with the Cloudflare rule active have a mitigation, though the sources say the rule was only refined, not newly enforced.
No product ranges from the sources yet.
wp core version or the generator tag on the login page; the sources do not name affected versions.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WAF Release - 2026-08-07 · Changelog
New updates and improvements at Cloudflare.
August 7, 2026
This release updates WordPress XSS rule metadata in the Cloudflare Managed Ruleset and Cloudflare Free Ruleset to identify XSS2Shell (CVE-2026-64638). It also disables the Command Injection - Obfuscation rule.
Key Findings
Impact
The WordPress changes update rule metadata only; detection behavior and actions remain unchanged.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...9c6dff1c | N/A | Wordpress - XSS - CVE:CVE-2026-64638 | Block | N/A | Rule metadata description refined. Detection unchanged. |
| Cloudflare Free Ruleset | ...9ab5ed95 | N/A | Wordpress - XSS - CVE:CVE-2026-64638 | Block | N/A | Rule metadata description refined. Detection unchanged. |
| Cloudflare Managed Ruleset | ...761e7a4c | N/A | Command Injection - Obfuscation | Block | Disabled | Detection logic has been deprecated |
This page as .md · .json · in your agent: get_signal("CVE-2026-64638")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.