WordPress vulnerability: Login page opens the door to take over the server

A critical security vulnerability in the widely used content management system WordPress has been identified, allowing attackers to potentially take over servers through a compromised login page. The flaw, designated as CVE-2026-64638, was recently patched by developers after warnings from cybersecurity researchers. According to reports, malicious actors have already begun exploiting this issue, prompting urgent calls for users to update their installations. The vulnerability stems from weaknesses in WordPress's internal HTML filtering functions. A researcher from pwn.ai detailed how the exploit works in a blog post, explaining that the attack requires user interaction. An attacker creates a seemingly benign HTML page containing a form directed at a victim’s WordPress login page. This form is often delivered via phishing emails, tricking users into clicking on a link and visiting the prepared website. Once the victim opens the attacker's page, a script automatically submits the hidden form within the victim's browser. The form sends data to the target WordPress site's wp-login.php file, embedding crafted HTML snippets with malicious code. These snippets are processed by WordPress and displayed on the login error page. Because all activity occurs on the origin of the real WordPress site, the embedded code runs with the rights and cookies of the logged-in user. If the victim is logged in as an administrator, the attacker can further exploit the situation by stealing an API access token. With this token, they can upload and execute arbitrary PHP code on the server, fully compromising the WordPress instance. The Canadian Centre for Cyber Security noted signs that attackers are actively using this vulnerability. In response, the WordPress development team released version 7.0.3, which includes patches to address the flaw. Users are strongly advised to upgrade their installations immediately to prevent potential exploitation. The attack mechanism relies heavily on social engineering tactics, such as phishing emails, to lure victims into interacting with the malicious site. Once the initial compromise occurs, the attacker gains control over the server, potentially leading to data breaches, unauthorized modifications, or the spread of malware. Security experts emphasize the importance of keeping software up to date to mitigate risks associated with known vulnerabilities. They recommend that administrators monitor their systems for unusual activity and implement additional layers of security, such as two-factor authentication and regular backups. The incident underscores the ongoing challenges faced by developers in securing complex web applications against evolving threats. While the patch addresses the immediate risk, it highlights the need for continuous vigilance and proactive measures in maintaining digital security. Researchers continue to analyze the impact of the vulnerability and assess whether other components of the WordPress ecosystem might be affected. As more information becomes available, security advisories will likely provide updated guidance for users and organizations relying on the platform.