Package: wordpress Version: 7.0.2+dfsg1-1 Severity: grave Tags: security Justification: user security hole
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. References: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-52p2-r8wf-jcrf https://wordpress.org/news/2026/08/wordpress-7-0-3-release/ -- System Information: Debian Release: 13.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable-debug'), (500, 'stable'), (50, 'unstable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 6.12.100+deb13-amd64 (SMP w/12 CPU threads; PREEMPT) Locale: LANG=en_AU.UTF-8, LC_CTYPE=en_AU.UTF-8 (charmap=UTF-8), LANGUAGE=en_AU:en Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages wordpress depends on: ii apache2 [httpd] 2.4.68-1~deb13u1 ii ca-certificates 20250419 pn default-mysql-client | virtual-mysql-c <none> lient pn libapache2-mod-php | php <none> pn libjs-cropper <none> ii libjs-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9 ii libjs-underscore 1.13.4~dfsg+~1.11.4-3 pn php-gd <none> pn php-getid3 <none> pn php-mysql | php-mysqlnd <none> Versions of packages wordpress recommends: pn wordpress-l10n <none> pn wordpress-theme-twentytwentyfive <none> Versions of packages wordpress suggests: pn default-mysql-server | virtual-mysql-server <none> pn php-curl <none> pn php-imagick <none> pn php-mbstring <none> pn php-ssh2 <none> ii php-xml 2:8.4+96 pn php-zip <none> ii php8.4-xml [php-xml] 8.4.24-1~deb13u1
