WordPress has a pre-auth reflected XSS vulnerability on its login screen. An attacker can use a malicious third-party website to place script content into a WordPress response, but the victim must be socially engineered into visiting and interacting with it. Under certain conditions, the issue can be escalated to RCE.
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).
WordPress contains a reflected cross-site scripting (XSS) vulnerability, where attacker-controlled data is returned and executed as JavaScript in a victim's browser. The flaw is on the login screen and can be reached before authentication. An attacker-hosted malicious third-party website can be used to trigger it. According to the record, escalation to remote code execution (RCE), meaning code execution on the remote system, requires conditions outside the attacker's control.
Successful exploitation lets an attacker execute JavaScript in the context of the WordPress login screen. Under additional conditions, the issue may lead to RCE, affecting the system's confidentiality, integrity, and availability. Exploitation requires victim interaction, and the path to RCE is not fully controlled by the attacker.
Update WordPress to a release containing the security fix, or to the corresponding backported release for the branch in use. Until updating is possible, reduce users' exposure to untrusted links and increase monitoring around the login screen. These are temporary mitigations, not a replacement for the fix.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
VulnScan helps organizations find vulnerabilities early and remediate them on a flexible schedule.
Check WordPress installations and their login screens to determine whether the relevant security fix has been applied. Review web logs for requests to the login screen with unusual input or script-like content, and for referrers from untrusted external sites. Monitor login sessions and administrative activity for anomalies after users follow suspicious links.
