WordPress XSS2Shell Vulnerability

Those injected elements are not scripts themselves, but they are crafted to match selectors that WordPress’s own user-profile.js file automatically searches for on page load, a script left over from password-reset functionality.

This causes the browser to auto-trigger a click event that cascades into an AJAX request, and through a technique called DOM clobbering, the attacker’s injected element hijacks the destination URL of that request.

Pointed at WordPress’s REST API with method-override and JSONP parameters, the request comes back wrapped in executable JavaScript, giving the attacker arbitrary script execution inside the WordPress origin, purely pre-authenticated, pwn.ai said.

On its own, this reflected XSS is already serious, but WordPress’s advisory and independent analysis confirm that under specific conditions it can escalate to remote code execution.

If a logged-in administrator is lured to a malicious third-party page and interacts with it, the attacker’s script can piggyback on the admin’s session to mint a WordPress Application Password, publish a page containing attacker JavaScript using the admin’s unfiltered_html privileges, and finally upload a plugin ZIP file containing a PHP web shell, all through legitimate, authenticated WordPress API calls the admin never explicitly approved.

WordPress’s official advisory notes that this escalation path requires social engineering and explicit victim interaction, factors outside the attacker’s direct control, which is why the CVE carries a CVSS score of 8.9 rather than a maximum rating.

WordPress shipped an emergency fix in version 7.0.3, released on August 6, 2026, alongside eleven other security patches. Given the severity, the WordPress security team backported the fix all the way to version 4.7, covering every branch still receiving security updates.

There is currently no evidence of active in-the-wild exploitation or a public proof-of-concept exploit, according to vulnerability trackers monitoring the CVE. Site owners and administrators should update to WordPress 7.0.3 or the corresponding backported patch immediately, since most managed hosts apply this automatically but self-hosted sites often require manual intervention.

The underlying technique builds on a 2022 Same Origin Method Execution (SOME) research technique published by Paulos Yibelo, which was originally used to bypass Content Security Policy protections on WordPress sites and was nominated for Top Web Hacking Technique of the year.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.