XSS2Shell: Chaining a Single Space Character Into WordPress RCE (CVE-2026-64638)

🚨 XSS2Shell: Chaining a Single Space Character Into WordPress RCE (CVE-2026-64638)

TL;DR: A pre-authenticated XSS on WordPress's login page chains into full remote code execution. Zero account, zero plugin required. Root cause: PHP's strip_tags() and WordPress's own KSES sanitizer disagree on how to parse a malformed tag. Patched in v7.0.3, backported to 4.7. Public PoC already on GitHub. ~500M+ sites were exposed.

The root cause

It starts on wp-login.php. Submit a nonexistent username, and WordPress sanitizes it through wp_strip_all_tags(), which wraps PHP's native strip_tags(). Insert a space between an opening angle bracket and a tag name (< area instead of <area), and PHP's parser treats the string as harmless text. Later in the render pipeline, WordPress's own KSES sanitizer re-parses that identical string and interprets it as a live HTML element.

Two sanitizers disagreeing on the same input — that's the entire vulnerability class.

The attack chain

1. Attacker submits a crafted username at wp-login.php
2. strip_tags() lets "< area" through as inert text
3. KSES later re-parses it as a real HTML element
4. Injected element matches selectors user-profile.js scans for on page load (leftover password-reset code)
5. Browser auto-triggers a click event on the element
6. DOM clobbering hijacks the destination URL of the resulting AJAX request
7. Request targets the REST API using method-override and JSONP parameters
8. Response returns wrapped in executable JS — pre-auth script execution inside the WordPress origin

If a logged-in admin is socially engineered into one click on a malicious page, the attacker's script rides that session to mint an Application Password, publish a page via unfiltered_html, and upload a plugin ZIP containing a PHP web shell. Full RCE, entirely through legitimate authenticated API calls the admin never approved.

Why it matters for engineers

• Lives in WordPress Core, not a plugin — affects every install since 4.7
• Zero auth required for the initial XSS stage
• Builds on Paulos Yibelo's 2022 SOME (Same Origin Method Execution) technique, so offensive researchers already understand the mechanics
• CVSS 8.9 — capped below 10 only because RCE depends on victim interaction

Patch status

WordPress shipped v7.0.3 on August 6, 2026, backported to the 4.7 branch. No confirmed in-the-wild exploitation yet, but a public PoC is already live on GitHub — historically that shrinks the window before real attacks begin.

Detection signals worth hunting for: anomalous "< " patterns in wp-login.php username fields, unexpected Application Password creation, new plugin installs outside change management, and REST API calls combining method-override with JSONP parameters.

Full write-up with detection rules and a prevention checklist:
https://www.xpert4cyber.com/2026/08/wordpress-xss2shell-cve-2026-64638.html