Investigating - A high-severity reflected XSS vulnerability, CVE-2026-64638, has been identified in the WordPress login interface. Exploitation requires a victim to visit a specially crafted URL and, under specific conditions, could potentially lead to PHP code execution.
Impacted versions:
WordPress 4.7 – 7.0.2 (every release on every branch)
WordPress 4.6 and earlier — end of life, no patch available
Fixed versions:
WordPress 7.0.3
WordPress 6.9.6
WordPress 6.8.7
Equivalent minor releases on every remaining supported branch back to 4.7
Recommended Action
Customers are strongly encouraged to update WordPress core and ensure automatic security updates are enabled where appropriate. Since exploitation requires user interaction, customers should also remain vigilant against phishing attempts and avoid clicking suspicious or unsolicited links.
Customers with automatic security updates enabled should receive the applicable update automatically; however, we recommend verifying the currently running WordPress version.
There is currently no reported evidence of widespread exploitation in the wild. We will continue to monitor the situation and provide further updates if required.
If you need assistance or have any concerns, please contact our Support team.
Aug 08, 2026 - 08:26 CDT
Impacted versions:
WordPress 4.7 – 7.0.2 (every release on every branch)
WordPress 4.6 and earlier — end of life, no patch available
Fixed versions:
WordPress 7.0.3
WordPress 6.9.6
WordPress 6.8.7
Equivalent minor releases on every remaining supported branch back to 4.7
Recommended Action
Customers are strongly encouraged to update WordPress core and ensure automatic security updates are enabled where appropriate. Since exploitation requires user interaction, customers should also remain vigilant against phishing attempts and avoid clicking suspicious or unsolicited links.
Customers with automatic security updates enabled should receive the applicable update automatically; however, we recommend verifying the currently running WordPress version.
There is currently no reported evidence of widespread exploitation in the wild. We will continue to monitor the situation and provide further updates if required.
If you need assistance or have any concerns, please contact our Support team.
Aug 08, 2026 - 08:26 CDT
PHP Services
Operational
LAN
Operational
PHX
Operational
IIS Services
Operational
LAN
Operational
PHX
Operational
MariaDB
Operational
LAN
Operational
PHX
Operational
MSSQL
Operational
LAN
Operational
PHX
Operational
FTP
Operational
LAN
Operational
PHX
Operational
Management Portal
Operational
Management Portal
Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance