In the ever-evolving landscape of cybersecurity, a significant security risk has emerged concerning WordPress installations. Recent investigations reveal that malicious elements can be injected into WordPress pages, posing a severe threat to both site administrators and users. This threat is orchestrated through a combination of outdated scripts and clever manipulation of the platform’s functionalities. The injected elements themselves do not carry out actions independently; rather, they are designed to align with specific selectors identified by a residual script known as user-profile.js. This particular script is traditionally used during the password-reset workflow and is triggered automatically when the page loads.
Upon executing, this mechanism initiates an auto-click cascade, triggering an AJAX request that can lead to adverse outcomes. Through a method known as DOM clobbering, the attacker is able to hijack the destination URL via jQuery’s ajaxurl variable. This subtle but effective manipulation does not require any direct interaction from the victim, allowing for a streamlined and discreet process for the cybercriminal.
The ramifications of this malicious activity are particularly concerning when considering how it interacts with WordPress’s REST API. Leveraging method-override along with JSONP parameters, the response generated is embedded in executable JavaScript. This entails that the attacker gains script execution rights within WordPress’s origin without needing to authenticate themselves or compromise user accounts at this juncture.
The situation escalates when an Administrator logged into a single-site setup accidentally visits a page controlled by the attacker and clicks once. Building upon techniques previously outlined by researcher Paulos Yibelo in 2022, this method makes use of the administrator’s active session to generate a WordPress Application Password. This process intricately weaves through legitimate and authenticated WordPress API calls, allowing for the publication of a page embedded with the attacker’s JavaScript via the administrator’s unfiltered_html privilege. Additionally, the attacker can upload a ZIP file containing a PHP web shell, further solidifying control over the targeted WordPress environment.
A recent analysis by PWN.ai has illuminated that, should this attack sequence succeed, it could lead to dire consequences such as exposure of database credentials found in wp-config.php. Moreover, attackers further leverage this access to execute operating system commands with the privileges granted to the web server, thereby expanding their control over the compromised system.
WordPress has approached the situation with caution in their official advisory, pointing out that successful exploitation depends heavily on conditions outside the attacker’s immediate control, such as effective social engineering and explicit victim engagement. It is essential to note that while the potential for exploitation is serious, the advisory stresses that there is no confirmed evidence of in-the-wild exploitation as of the latest disclosures.
In response to this critical issue, WordPress has released an emergency patch, version 7.0.3, on August 6, 2026. This update enriched safety protocols by adding calls for esc_html(), esc_url(), and esc_attr() within the files wp-includes/user.php and wp-login.php, effectively addressing the parsing discrepancies that led to this vulnerability. The fix was not only backported to the 4.7 branch but also included in a collection of 11 other security patches, finding its way into the WordPress 7.1 RC2 branch.
Site administrators are advised to take immediate action by updating their installations to version 7.0.3 without delay. Although many sites with automatic background updates may have already received this crucial fix, self-hosted sites often require manual intervention to ensure protection. Administrators should remain vigilant for any unexpected Application Passwords or newly uploaded plugins, as these may serve as potential indicators of compromise, showcasing ongoing malicious activity.
In conclusion, the cybersecurity landscape continuously shifts under the weight of these emerging threats. It is paramount for all WordPress site owners to stay informed and proactive about security updates and to maintain best practices in safeguarding their digital environments.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world