News
New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP
4 days ago
New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP
By info@thehackernews.com (The Hacker News)
WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. pwn.ai demonstrated how the flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with an attacker-controlled page. Tracked as CVE-2026-64638 (CVSS score: 8.9), the high-severity
More from The Hacker News
Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
4 hours from now
Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE
2 hours from now
DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt
2 hours from now
OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development
42 minutes ago
A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices
1 hour ago