# Critical WordPress XSS2Shell Flaw Enables Full Server Takeover A simple login page vulnerability can lead to remote code execution. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-08-07 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/4c919861-bdd5-4929-8383-1a29ddb01cd2 ## Vulnerability Discovery Pwn researchers uncovered a critical security chain in WordPress dubbed XSS2Shell. The flaw triggers when a specially crafted payload is entered in the username field. A parsing flaw in PHP's strip_tags() function fails to filter HTML elements containing spaces. This allows attackers to inject malicious code into the login page. All WordPress versions from 4.7 to 7.0.3 are vulnerable to this exploit. ## DOM Clobbering Technique The critical component involves a technique called DOM clobbering. The injected area element clobbers the window.ajaxurl property, putting it under attacker control. WordPress's login page loads user-profile.js script, which uses this fake ajaxurl value to initiate automatic requests. Browser features enable this request to trigger an attacker-controlled callback function. ## Admin Privilege Escalation Attackers can hijack admin sessions using cross-window click techniques. By leveraging a 2022-discovered method, attackers trigger the application-password approval screen in a hidden window. This grants them valid Application Passwords for admin accounts. WordPress REST API accepts authenticated requests from any origin using these credentials. ## Remote Code Execution With admin privileges, attackers can inject malicious JavaScript using unfiltered_html capability. These scripts can upload and execute arbitrary PHP plugins. Researchers' PoC demonstrated code execution as the web server user, confirmed via JSON response. All traces are cleaned post-exploitation, making detection difficult. ## Zero-Click Attack Chain This vulnerability chain works without user interaction beyond visiting a malicious link. The entire process executes automatically, leading to RCE on default WordPress installations. The exploit primarily targets single-site WordPress instances, which represent a significant portion of installations. ## Patch Timeline Researchers reported the flaw to WordPress on July 27. The WordPress team responded rapidly, releasing version 7.0.3 on August 6. The fix was backported to all actively maintained branches starting from WordPress 4.7. Security experts classify this as a critical update requiring immediate implementation due to server takeover risks. ## Industry Impact WordPress powers over 43% of all websites, making this a potentially massive vulnerability. Small businesses and individual users with poor update practices face particularly high risk. Cybersecurity professionals urge all WordPress administrators to update immediately. This incident demonstrates how simple flaws can cascade into catastrophic security breaches. ## Recommended Mitigations WordPress users must update to the latest version immediately. Administrators should review application password usage and restrict unnecessary privileges. File permissions on web servers should limit plugin installation capabilities. Security teams need to educate developers about modern attack vectors like DOM clobbering. This event underscores the critical importance of continuous security updates. ## Sources covering this story - https://securityaffairs.com/196820/hacking/wordpress-xss2shell-flaw-turns-simple-login-bug-into-full-server-takeover.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._