Cybersecurity & Data Protection
1
UPVOTE
thehackernews.com

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. Under additional conditions, the bug can be chained into PHP code execution on the server. Tracked as CVE-2026-64638 (CVSS score: 8.9), the High-severity vulnerability requires no attacker privileges. According to pwn.ai,
New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP
TN

The Hacker News

1d ago
1 0

Discussion

Your thoughts matter!

Your input is valuable—be the first to share it!

No comments yet.

Be the first to share your take and keep the conversation moving.

Join the conversation

Log in or sign up to add your comment and participate in the discussion!

Log In Sign Up

UPVOTERS

Community appreciation

See who found this content valuable and showed their support.

KH

Lars Khan

Lars KhanUpvoted 1d ago2 comments · 42 shares

TOPICS

Explore the same topics

Discover more content from the topics this post is mapped to.

bleepingcomputer.com
Hackers breach TrueConf to trojanize client installers with bac…

The Head Mare hacktivist group has been exploiting vulnerabilities in unpatched TrueConf video conferencing servers to replace client installers with malicious…
LK

Lars Khan

2026-08-08 18:51
0
thehackernews.com
Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence …

Attacker-controlled instructions can make Atlassian's Rovo assistant collect Jira or Confluence data that a signed-in user can access, then send it to an outsi…
Golden Greta

Golden Greta

5h ago
0
schneier.com
Friday Squid Blogging: Arctic Bobtail Squid Video

Nice video of the Arctic bobtail squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.…
SS

Schneier on Security

8h ago
0
bleepingcomputer.com
Metabase SQLi zero-day exploited in customer data-theft attacks

A critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances in data theft attacks, known to impact Framework…
Golden Greta

Golden Greta

17h ago
0
darkreading.com
AI-Generated Patches Fail Half the Time

A study of more than 6, 000 patches found that even working patches can introduce new bugs, break something else, or are open to bypass.
DR

Dark Reading

19h ago
0
thehackernews.com
Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT an…

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targetin…
TN

The Hacker News

19h ago
0

Keep browsing

Explore more from this topic

Dive into the full feed of curated posts covering Cybersecurity & Data Protection.

Browse Topics

RELATED CONTENT

Continue exploring

Discover more content that aligns with your interests and this post.

thehackernews.com
Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence …

Attacker-controlled instructions can make Atlassian's Rovo assistant collect Jira or Confluence data that a signed-in user can access, then send it to an outsi…
Golden Greta

Golden Greta

5h ago
0
thehackernews.com
Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT an…

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targetin…
TN

The Hacker News

19h ago
0
thehackernews.com
TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later S…

A new analysis has uncovered that the threat actor tracked as TeamPCP has been active on the cybercrime scene as far back as 2020, indicating the group has bee…
RM

ryan maybe

1d ago
0
thehackernews.com
New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape…

Zapscape, a new Linux kernel vulnerability, could allow an attacker with kernel privileges inside an L1 guest virtual machine (VM) to escape KVM isolation and…
SA

SariMartinez

1d ago
0
thehackernews.com
CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Cr…

Coinspect has identified CryptoJS. lib. WordArray. random() as the weak random number generator behind the Ill Bloom wallet drains. Introduced in the JavaScri…
TN

The Hacker News

2d ago
0
thehackernews.com
Poison Claude Sells Discounted Claude Access While Its Operator…

Cybersecurity researchers have discovered more than half-a-dozen services advertisements for illegal access to artificial intelligence (AI) models on undergrou…
Giulia

Giulia

2d ago
0

Still curious?

See more related posts

Keep the inspiration flowing with fresh submissions and trending finds from the community.

View Latest