Nigerian WordPress users told to update now — bug lets hackers run code

Nigeria's Computer Emergency Readiness and Response Team is telling WordPress administrators to update to version 7.0.3 immediately after researchers disclosed a high-severity flaw that can be chained into full server takeovers. The advisory, tracked as CVE-2026-64638, affects all WordPress Core versions from 4.7.0 through 7.0.2 and carries a CVSS score of 8.9, the highest-severity issue fixed in the 7.0.3 security release.

NITDA-CERRT's advisory, reported by Nairametrics on 12 August 2026, warns that the vulnerability "could give attackers website control" and describes it as a pre-authentication issue on the WordPress login screen that can lead to PHP code execution. The agency added: "The vulnerability can be exploited without authentication or prior privileges. Immediate action is recommended to mitigate this threat."

The underlying flaw, nicknamed XSS2Shell, was discovered and reported by security researchers at pwn.ai, who described it as "a pre-auth XSS to RCE vulnerability chain affecting all versions of WordPress Core: the software that powers over 43% of all internet-facing websites." The issue arises from a parser differential between PHP's strip_tags() function and WordPress's KSES sanitiser. Certain crafted usernames — such as those beginning with < area ...> with a space after the opening bracket — are not stripped by strip_tags() but are interpreted as HTML elements by KSES, allowing arbitrary HTML injection into the login error message.

At the initial stage, the attack requires no authentication: a single failed login attempt with a crafted username is enough to trigger reflected cross-site scripting in the WordPress origin. From there, a chain of techniques — DOM clobbering, JSONP globalEval(), Same Origin Method Execution, and theft of WordPress Application Passwords — can let an attacker upload a malicious plugin and execute PHP code with the web server's privileges. Escalation to full code execution does require a logged-in administrator to visit an attacker-controlled page, a social engineering step that pwn.ai and other researchers have documented in detail.

WordPress.org confirmed the severity in its 7.0.3 release notes, describing the issue as "pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at pwn.ai." The patch was shipped on 6 August 2026, adding appropriate escaping functions — esc_html(), esc_url(), and esc_attr() — in wp-includes/user.php and wp-login.php to render user-supplied values safely. WordPress also backported the fix across 24 maintenance branches, down to version 4.7.34, covering 6.9.6, 6.8.7, 6.7.6, 6.6.6, and 6.5.9.

Global security outlets moved quickly after disclosure. The Hacker News, Wordsec.net, Ionsec, CyberHappenings, and specialist blogs published technical breakdowns and mitigation guidance between 6 and 9 August. Canada's cyber centre issued advisory AV26-792, and France's CERT-FR published CERTFR-2026-AVI-0979, both advising administrators to update versions prior to 7.0.3. The National Vulnerability Database entry for CVE-2026-64638 confirms the pre-authentication nature of the XSS and its potential escalation to remote code execution via a malicious third-party website.

For Nigerian site owners, the practical steps are clear: update WordPress Core to 7.0.3 or the appropriate backported maintenance release, enable automatic background updates where possible, review installed plugins and themes, revoke unused Application Passwords, and monitor for unexpected admin accounts or plugin installations. Many WordPress deployments in Nigeria run on shared hosting with auto-updates disabled, leaving sites exposed until hosting providers or administrators manually trigger the patch.