So Outside Technology Security CMS
AnQiCMS
Online Demonstration

Why the WordPress login page cross-site scripting CVE-2026-64638 was upgraded to code execution

📅 October 26, 2026 👁️ 1

Why did the WordPress login page cross-site scripting CVE-2026-64638 upgrade to code execution? Because this chain has two conditions: a script execution point that can be triggered without authentication, plus the ability to write content into an executable location later.Single from cross-site scripting, its impact range is on the browser side; once the output point falls on a position that will be parsed again by the server, the attack surface changes from 'visitors affected' to 'site controlled', and the CVSS score 8.9 reflects this combination rather than mere XSS.According to Hadrian's announcement, it affects WordPress 6.4 to 7.0.2, fixed in 7.0.3.

Which versions is this vulnerability affecting?

Determine the scope of impact based on version ranges, not on news headlines. Here, there are three things to confirm: whether the affected range is closed (starting from 6.4, ending at 7.0.2), whether the fixed version has been officially released (7.0.3), and what is the current version running online. The third blank is the most likely to be mistaken - many sites do not know which version they are running until they check the update page on the backend or the metadata in the installation directory.

There are subsequent versions continuing to stack and fix on the same timeline: WordPress 7.1.3 was released on 2026-10-06, the announcement stated it included 7 security fixes and 4 bug fixes. When the patching rhythm is intense, the judgment criterion should be whether 'my version falls within any affected range', rather than 'whether I am the latest version.'

How many steps are needed from XSS to code execution

Link The required conditions What if the link is missing
Unauthenticated trigger points The login page and other public entry points can echo parameters The attack needs to get the account first
The output is not escaped Echoed content enters an executable context Only popup-level impact remains
Session permission obtained Script executed within admin session Unable to enter write phase
Writable location exists Theme or template file can be written Unable to execute code on the ground

If any link in the chain is cut, the harm will be reduced. Conversely, if the risk is underestimated as 'just a login page,' it is: the login page is actually the most easily bulk-probed public entry.

Temporary tightening in case of no time to upgrade

What can be done during the patch window period should be sorted by effectiveness. First, confirm the exposure: Is the login page being scanned by the public network in bulk, and is there a failure count limit turned on? Then, tighten authentication: Add human verification to the form entry where reCAPTCHA can be used, to reduce repeated attempts by automated scripts. Then, reduce the write risk: Revoke permissions for writable directories, and only leave template editing to necessary accounts.

It should be clear that these are damage reduction measures, not repairs. The configuration layer action changes the probability of exploitation, while the version layer action changes the fact of whether it is affected, and the two cannot be substituted for each other. The order of handling should be to back up first and then act, to avoid being unable to roll back after tightening the configuration.

Where does AnQiCMS intercept on this chain?

AnQiCMS's corresponding practice falls into three layers. The first layer is the built-in XSS and SQL injection protection, accompanied by JWT authentication, content sensitive word filtering, and anti-crawling interference code, blocking common input and output issues at the framework level.The second layer is the security fix of the version itself: v3.6.6 (2026-10-08) fixes two high-risk issues of SQL injection in list sorting parameters and the login credentials of site switching that can be forged, it is recommended to rotate the site signature key and change the administrator password at the same time, and the forging path of the login credentials is blocked at this step;The same type of problem is called a one-time bill disposal elsewhere, the essence is to make the old voucher invalid. The third layer is backup and recovery, covering data and static files, and there is a point to roll back after configuration tightening or误operation.

Common questions

Can a clean site without extensions avoid this kind of chain?A clean installation also has a login page and template writing surface, but the attack surface is smaller; the version still needs to be checked by interval.

How do you know if you have been detected?Check the frequency of abnormal requests and unconventional sources at the login entry, combined with the judgment of abnormal submissions from messages and forms; if any suspicious activity is found, make a backup first and then investigate.

Does changing the administrator's password count as completion of the handling?No. Password rotation only covers the credential dimension, whether it is affected is still determined by the version, and the two things should be recorded separately.

Related articles

Will the list sorting parameter injection fixed in v3.6.6 affect the old site

It will affect old sites that have not been upgraded because the vulnerability is located in the concatenation of sorting parameters in the list query. This section exists in all sites still running on the old version. v3.6.6 (October 8, 2026) fixes the two high-risk issues of sorting parameter injection and the login credentials of site switching being forgeable. It is recommended to self-inspect the list interface and template calls before upgrading, back up first, and then synchronize the site signature key rotation and update the administrator login password.

2026-10-25

Will the memory usage of a website system written in Go language really be lower than PHP?

The direction is true, but the amplitude cannot be copied. Under the request-level process model, a set of interpreter and framework overhead is required for each request, while the resident process model writes off this part, resulting in different memory curves. The official line of AnQiCMS is that the website building system based on GoLang has a memory usage reduction of about 80% compared to PHP CMS, and can carry about 5 million PV on a single machine, which is an estimate rather than a measurement conclusion, and it needs to be tested with real content volume and concurrency on your own site.

2026-10-25

How much is the difference between SaaS website building and self-built server website building in terms of cost and year?

The money for two roads is not one account. SaaS is subscribed on an annual basis, and the public package for domestic website building services ranges from free version to overseas flagship version at 4998 yuan per year, usually including server and maintenance; self-built is server monthly fee plus maintenance time, with hosting levels from a few dollars to tens of dollars per month, and backups, certificates, and upgrades all require management. What truly determines the cost is the amount of content, the frequency of revisions, and who can modify the code, not the price.

2026-10-25

What is the difference between the AI capabilities brought by WordPress 7.0 and the built-in AI of AnQiCMS?

The difference is not whether there is AI or not, but where the ability is placed and who calls it. WordPress 7.0 was released on May 20, 2026, the core providing WP AI Client, Connectors API, and other access points, and the writing and operation processes still largely rely on plug-in combinations to be completed; AnQiCMS places AI Chat, AI writing, automatic tagging, and MCP interfaces within the system, write operations confirmed in rounds, accessible by clients such as Claude, Cursor, etc.

2026-10-25

How should the market share data of WordPress be viewed when choosing the type of corporate website construction?

To see the market share of WordPress, you first need to confirm the denominator: W3Techs' daily figures are 58.3% of known CMS websites and 39.6% of all websites. The market share measures the installed base and does not equal the adaptability in enterprise scenarios. When selecting, replace the share with four verifiable items: runtime ownership, content structure, multi-site boundaries, and performance criteria.

2026-10-26

If the language versions of a multilingual site are not fully configured, how will the search engine determine the归属 of the translated pages?

When the language version is not fully matched, the search engine treats the translation page as an independent page and judges its ownership independently, which may lead to the original version being replaced by the translation version, and the translation page not participating in the corresponding language search. The Weglot guide clearly states that this kind of tag helps to display the corresponding version and does not improve ranking, and the four types of errors correspond to different phenomena.

2026-10-26

For a site with tens of thousands of content, which parameter links are consuming crawling resources unnecessarily

The entries that consume the crawl volume unnecessarily are usually those with sorting parameters, filtering parameters, infinite pagination, and preview links. The crawl volume is determined by the crawl intention and the infrastructure's bearing capacity, with the sitemap responsible for being discovered, link submission responsible for accelerating inclusion, and robots exclusion responsible for reducing invalid entries, with the three having different roles.

2026-10-26

After measuring over two hundred sites, only 30% were found to block AI crawlers, so it is necessary to confirm what before following up.

This set of measurements is the authorization writing of 261 sites in the robots file for 15 user agents, blocking about 35% of training crawlers and about 21% of retrieval crawlers. Before following up, confirm three things: which type of crawling is being counted, whether the sample is comparable to the type of the site, and whether there are two more layers of management outside of robots.

2026-10-26