WordPress XSS2Shell Flaw Turns Simple Login Bug Into Full Server Takeover

Security Affairs

August 7, 2026 at 4:48 PM

Overview

Researchers at Pwn have identified a serious vulnerability in WordPress, dubbed the XSS2Shell flaw, which allows attackers to take control of an admin account and execute remote code. The issue arises when a user inputs a non-existent username, triggering a response from WordPress that contains a minor formatting error. This flaw can be exploited to gain unauthorized access to the server. WordPress users are strongly advised to update their installations to the patched versions to protect against this vulnerability. Failure to do so could leave sites open to full server takeover, posing significant risks to website security and data integrity.

Key Takeaways

Affected Systems: WordPress versions prior to the patched releases.
Action Required: Users should update to the latest patched versions of WordPress as soon as possible.
Timeline: Newly disclosed

Original Article Summary

WordPress XSS2Shell flaw enables admin takeover and remote code execution. Users should update to patched versions. Researchers at Pwn just published a report on a vulnerability chain they’re calling XSS2Shell, and the entry point is quite simple: type a username that doesn’t exist, and WordPress echoes it back with a tiny formatting flaw baked into […]

Impact

WordPress versions prior to the patched releases.

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Newly disclosed

Remediation

Users should update to the latest patched versions of WordPress as soon as possible.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Vulnerability, Update, XSS.

Read Original Article

Related Coverage

Metabase SQLi zero-day exploited in customer data-theft attacks

BleepingComputer

A serious SQL injection vulnerability in Metabase has been exploited in zero-day attacks, resulting in unauthorized access to customer data. This flaw has specifically affected companies like Framework and Tally, raising concerns about the security of user information stored in Metabase instances. Attackers have taken advantage of this weakness to steal sensitive data, which highlights the urgent need for affected organizations to address the vulnerability promptly. Users and companies relying on Metabase should be vigilant and ensure their systems are secure against potential breaches. The situation emphasizes the importance of maintaining robust security measures, especially when using widely-used data analysis tools.

Aug 7, 2026

Unlimited Technology Systems breach impacts 3.8 million people

BleepingComputer

Unlimited Technology Systems, a healthcare software provider, has reported a significant data breach that has affected over 3.8 million individuals. The breach, which took place in October 2025, has raised serious concerns about the security of personal information in the healthcare sector. While the company has not disclosed specific details about how the breach occurred, the scale of the incident suggests that sensitive data may be at risk. This situation highlights the growing vulnerability of healthcare organizations to cyberattacks, emphasizing the need for robust security measures to protect patient data. Affected individuals may face risks such as identity theft or fraud, making timely notification and support essential.

Aug 7, 2026

Vishing group UNC6671 now focuses on extorting M&A firms

SCM feed for Latest

A vishing group identified as UNC6671 has shifted its focus to targeting mergers and acquisitions (M&A) firms with extortion schemes. This group, known for using voice phishing tactics, aims to exploit sensitive financial data and negotiations occurring in these high-stakes environments. Experts are advising firms to implement managed-device logins and closely monitor audit logs to combat the rising threat of phishing-led data theft. The implications of this shift are significant, as M&A firms often handle large sums of money and confidential information, making them prime targets for attackers seeking to leverage that data for financial gain.

Aug 7, 2026

Zbtlink denies backdoor claims amid firmware download pause

SCM feed for Latest

Zbtlink is facing scrutiny after claims from VulnCheck CTO Jacob Baines, who alleges that Zbtlink routers are designed to communicate with command and control servers, likening this feature to a 'phone-home trojan horse.' This allegation raises concerns about potential security vulnerabilities in Zbtlink products. The company has paused firmware downloads, which could indicate a response to these claims or an effort to address any underlying issues. Users of Zbtlink routers may need to be cautious about their device security and monitor for any unusual activity. The implications of these claims could be significant, as users’ personal data and privacy might be at risk if the allegations are proven true.

Aug 7, 2026

Walmart faces lawsuit over alleged secret voiceprint collection in Illinois

SCM feed for Latest

Walmart is facing a lawsuit in the U.S. District Court for the Northern District of Illinois over allegations that it secretly collects voiceprints from customers who call its stores. The lawsuit claims that Walmart records these calls and extracts vocal characteristics to create mathematical templates that can identify callers in the future. This raises significant privacy concerns, especially regarding how data is collected and used without explicit consent. If the allegations are proven true, it could lead to serious implications for Walmart's operations and customer trust, especially in a time when data privacy is a major concern for consumers. The case could set a precedent for how companies handle customer data in the future.

Aug 7, 2026

More than half of AI-generated patches are broken

CyberScoop

Recent research has shown that more than half of security patches generated by artificial intelligence are likely to fail in fully addressing vulnerabilities. In some cases, these AI-generated solutions may even create new vulnerabilities that attackers can exploit. This raises significant concerns for organizations relying on AI to automate their security measures, as they may inadvertently introduce more risks instead of mitigating them. Companies and security teams should be cautious and verify the effectiveness of AI-generated patches before implementation to prevent potential exploitation. The findings serve as a reminder that while AI can aid in cybersecurity, it should not be solely depended upon without thorough human oversight.

Aug 7, 2026