{"id":"CVE-2026-64638","kind":"vulnerability","aliases":["CVE-2026-64638"],"related":[],"title":"WordPress: login screen reflected XSS, escalates to code execution in some setups","description":"WAF Release - 2026-08-07 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nAugust 7, 2026\n\n## WAF Release - 2026-08-07\n\nThis release updates WordPress XSS rule metadata in the Cloudflare Managed Ruleset and Cloudflare Free Ruleset to identify XSS2Shell (CVE-2026-64638). It also disables the Command Injection - Obfuscation rule.\n\nKey Findings\n\n- CVE-2026-64638: A pre-authentication reflected cross-site scripting vulnerability affecting the WordPress login screen. Exploitation requires social engineering and explicit interaction by the target user. Under additional conditions, it may be escalated to remote code execution.\n\nImpact\n\nThe WordPress changes update rule metadata only; detection behavior and actions remain unchanged.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...9c6dff1c | N/A | Wordpress - XSS - CVE:CVE-2026-64638 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Free Ruleset | ...9ab5ed95 | N/A | Wordpress - XSS - CVE:CVE-2026-64638 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Managed Ruleset | ...761e7a4c | N/A | Command Injection - Obfuscation | Block | Disabled | Detection logic has been deprecated |","summary":"WordPress's login screen reflects user input without escaping, so a crafted link can run script in a victim's browser. Under additional conditions the sources say it may escalate to remote code execution.","severity":"high","cvss":8.9,"epss":0.00894,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloudflare","lab-disclosure","package","self-hosted","wordpress"],"not_affected_if":["managed-hosting"],"how_to_check":"- Check the WordPress version with `wp core version` or the generator tag on the login page; the sources do not name affected versions.\n- Confirm whether a WAF rule for CVE-2026-64638 is active on your Cloudflare zone (Managed Ruleset rule ...9c6dff1c).","fix":"- Update WordPress core to a release that includes the upstream fix; the sources do not name the version.\n- Keep Cloudflare Managed Ruleset rule for CVE-2026-64638 in Block mode as a stopgap.","status":"open","published_at":"2026-08-07T18:17:20+00:00","first_seen_at":"2026-10-24T18:43:44+00:00","triaged_at":"2026-10-25T05:29:25+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:29:25Z","model":"claude-haiku-5-5","output":{"fix":"- Update WordPress core to a release that includes the upstream fix; the sources do not name the version.\n- Keep Cloudflare Managed Ruleset rule for CVE-2026-64638 in Block mode as a stopgap.","reach":"internet","title":"WordPress: login screen reflected XSS, escalates to code execution in some setups","impact":"high","summary":"WordPress's login screen reflects user input without escaping, so a crafted link can run script in a victim's browser. Under additional conditions the sources say it may escalate to remote code execution.","category":"package","nicknames":["XSS2Shell"],"who_cares":["wordpress","self-hosted","cloudflare"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs script in admin's browser; possibly code execution","analyst_note":"Find the affected WordPress core versions and the fixed release in the NVD entry or WordPress security advisory; the sources do not give them.","how_to_check":"- Check the WordPress version with `wp core version` or the generator tag on the login page; the sources do not name affected versions.\n- Confirm whether a WAF rule for CVE-2026-64638 is active on your Cloudflare zone (Managed Ruleset rule ...9c6dff1c).","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"WordPress sites with a publicly reachable login screen are the exposed surface, since the flaw is on wp-login. The sources do not say which WordPress versions or plugins are affected. Sites behind a WAF with the Cloudflare rule active have a mitigation, though the sources say the rule was only refined, not newly enforced.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000694,"input_tokens":3863,"output_tokens":615,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-07':67C,83C '-08':66C,82C '-2026':14A,17A,104C,117C,191C,210C '-64638':15A,18A,105C,118C,192C,211C '2026':65C,78C,81C '7':77C '761e7':223C '9ab5ed95':204C '9c6dff1c':185C 'a4c':224C 'action':167C,178C,180C 'addit':51B,146C 'affect':129C 'also':107C 'august':76C 'authent':122C 'behavior':165C 'block':193C,212C,229C 'browser':49B 'chang':159C 'changelog':68C,69C 'cloudflar':20B,75C,93C,97C,182C,201C,220C 'code':8A,61B,154C 'command':110C,226C 'comment':181C 'condit':52B,147C 'craft':40B 'cross':125C 'cross-sit':124C 'cve':13A,16A,103C,116C,189C,190C,208C,209C 'deprec':235C 'descript':176C,197C,216C 'detect':164C,199C,218C,231C 'disabl':108C,230C 'disclosur':23B 'engin':137C 'escal':6A,58B,151C 'escap':37B 'execut':9A,62B,155C 'explicit':139C 'exploit':134C 'find':115C 'free':98C,202C 'host':27B 'id':172C,175C 'identifi':101C 'impact':156C 'improv':73C 'inject':111C,227C 'input':35B 'interact':140C 'key':114C 'lab':22B 'lab-disclosur':21B 'legaci':173C 'link':41B 'logic':232C 'login':2A,31B,132C 'manag':94C,183C,221C 'may':57B,149C 'metadata':90C,162C,196C,215C 'n/a':186C,194C,205C,213C,225C 'new':70C,179C 'obfusc':112C,228C 'packag':24B 'pre':121C 'pre-authent':120C 'previous':177C 'refin':198C,217C 'reflect':4A,33B,123C 'releas':64C,80C,85C 'remain':168C 'remot':60B,153C 'requir':135C 'rule':89C,113C,161C,171C,174C,195C,214C 'ruleset':95C,99C,170C,184C,203C,222C 'run':43B 'say':55B 'screen':3A,32B,133C 'script':44B,127C 'self':26B 'self-host':25B 'setup':12A 'site':126C 'social':136C 'sourc':54B 'target':143C 'unchang':169C,200C,219C 'updat':71C,86C,160C 'user':34B,144C 'victim':47B 'vulner':128C 'waf':63C,79C 'without':36B 'wordpress':1A,28B,29B,87C,131C,158C,187C,206C 'xss':5A,88C,188C,207C 'xss2shell':19A,102C","nicknames":["XSS2Shell"],"mitigations":[],"who_affected":"WordPress sites with a publicly reachable login screen are the exposed surface, since the flaw is on wp-login. The sources do not say which WordPress versions or plugins are affected. Sites behind a WAF with the Cloudflare rule active have a mitigation, though the sources say the rule was only refined, not newly enforced.","tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-07T18:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-08-07-waf-release/#CVE-2026-64638","url":"https://developers.cloudflare.com/changelog/post/2026-08-07-waf-release/","severity":null,"published_at":"2026-08-07T18:42:10+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:43:44+00:00","fetched_at":"2026-10-24T18:43:44+00:00","note":"Cloudflare: WAF Release - 2026-08-07 · Changelog"},{"source":"nvd","external_id":"CVE-2026-64638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64638","severity":null,"published_at":"2026-08-07T18:17:20+00:00","modified_at":"2026-09-03T17:02:54+00:00","first_seen_at":"2026-10-24T18:53:56+00:00","fetched_at":"2026-10-24T18:53:56+00:00","note":null},{"source":"epss","external_id":"CVE-2026-64638","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-64638","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2873,"url":"https://developers.cloudflare.com/changelog/post/2026-08-07-waf-release/","title":"Cloudflare: WAF Release - 2026-08-07 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-08-07 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nAugust 7, 2026\n\n## WAF Release - 2026-08-07\n\nThis release updates WordPress XSS rule metadata in the Cloudflare Managed Ruleset and Cloudflare Free Ruleset to identify XSS2Shell (CVE-2026-64638). It also disables the Command Injection - Obfuscation rule.\n\nKey Findings\n\n- CVE-2026-64638: A pre-authentication reflected cross-site scripting vulnerability affecting the WordPress login screen. Exploitation requires social engineering and explicit interaction by the target user. Under additional conditions, it may be escalated to remote code execution.\n\nImpact\n\nThe WordPress changes update rule metadata only; detection behavior and actions remain unchanged.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...9c6dff1c | N/A | Wordpress - XSS - CVE:CVE-2026-64638 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Free Ruleset | ...9ab5ed95 | N/A | Wordpress - XSS - CVE:CVE-2026-64638 | Block | N/A | Rule metadata description refined. Detection unchanged. |\n| Cloudflare Managed Ruleset | ...761e7a4c | N/A | Command Injection - Obfuscation | Block | Disabled | Detection logic has been deprecated |","published_at":"2026-08-07T18:42:10+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}