Last Updated: 2026-08-08T13:24:58Z
CVSSv3: 8.9
What’s Happening
Pwn.ai has disclosed XSS2Shell, a Same Origin Method Execution (SOME) attack against WordPress before 7.0.3, which has been released with patches.
The attack begins with a logged-in WordPress admin visiting an attacker-controlled site. That site opens a child window that, post XSS, becomes the same origin as the WordPress target. The child requests an application password of the WordPress instance, which is returned to the attacker-controlled JavaScript.
That app password can be used to create a new published page which in turn contains JavaScript to upload a malicious webshell, all under the authorization of the logged-in administrator. There you go: preauth XSS to site takeover.
Actions
First, of course patch WordPress to version 7.0.3. If you have automatic updates enabled, you should be good.
Additionally, this is yet another strong argument for limiting access to wp-login.php and other sensitive WordPress endpoints to only specific IP sources. That way, this class of attack never gets a chance to exploit vulnerabilities in those pages.