Those injected elements don’t execute anything on their own, but they’re crafted to match selectors that user-profile.js, a script left over from the password-reset flow, automatically scans for on page load.
That triggers an auto-click cascade into an AJAX request, and through DOM clobbering, the attacker’s injected element hijacks the destination URL via jQuery’s ajaxurl variable.
Pointed at WordPress’s REST API with method-override and JSONP parameters, the response returns wrapped in executable JavaScript, granting the attacker script execution inside the WordPress origin entirely pre-authenticated, no account and no victim interaction required for this stage.
Escalating to RCE requires a logged-in single-site Administrator to visit an attacker-controlled page and click once. Building on a 2022 Same Origin Method Execution technique by researcher Paulos Yibelo, the chain uses the admin’s session to mint a WordPress Application Password.
Publish a page containing attacker JavaScript via the admin’s unfiltered_html capability, and finally upload a plugin ZIP containing a PHP web shell, all through legitimate, authenticated WordPress API calls.
PWN.ai stated that a successful chain could expose database credentials in wp-config.php and permit operating-system commands under the web server’s privileges.
WordPress’s own advisory frames the escalation cautiously, noting it depends on “conditions outside the attacker’s control” and requires successful social engineering plus explicit victim interaction.
WordPress shipped an emergency fix in version 7.0.3 on August 6, 2026, adding esc_html(), esc_url(), and esc_attr() calls in wp-includes/user.php and wp-login.php to close the parser disagreement.
The fix was backported to the 4.7 branch, bundled with 11 other security patches, and carried into the WordPress 7.1 RC2 branch. As of disclosure, there is no confirmed evidence of in-the-wild exploitation.
Site owners should update to 7.0.3 immediately; installations with automatic background updates should already have received it, though self-hosted sites often need manual intervention.
Administrators should also treat any unexpected Application Passwords or newly uploaded plugins as potential indicators of compromise.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
