RESEARCHERS identified a new vulnerability in WordPress, termed XSS2Shell, that allows attackers to execute remote code and potentially take over servers. This flaw is initiated through a manipulation of the login page error message, exploiting how WordPress sanitizes inputs using PHP functions. By injecting certain HTML tags into a username, attackers can trigger JavaScript execution on the admin side without user interaction.
This method leads to granting attackers valid Application Passwords for admin accounts, enabling unauthorized actions via the REST API. WordPress developers responded quickly, releasing a patch to address this issue across all maintained versions.