WordPress has patched a high-severity pre-authentication reflected cross-site scripting (XSS) flaw (CVE-2026-64638, CVSS 8.9) affecting all versions of the CMS. Researchers demonstrated how this flaw can be chained to achieve PHP code execution on the server if a logged-in administrator interacts with an attacker-controlled page. Immediate patching is recommended for all WordPress installations.