WAF Watch: WordPress RCEs and campus login floods

1. WordPress “XSS2Shell” — login XSS that can chain to worse

WordPress patched a pre-auth reflected XSS on the login screen (CVE-2026-64638) in 7.0.3, with backports on maintained branches. No account required for the XSS; getting to real code execution still needs an admin to interact with attacker-controlled content. CUHK’s IT security team pushed a campus advisory: update core, then review accounts and plugins. The XSS2Shell write-up walks through the chain.

Do this: Inventory every WordPress install (including departmental orphans). Patch to 7.0.3 or the matching backport. Until that’s done, tighten edge rules around login and reflected XSS in count mode first.

2. WordPress 7.0.4 — Author-level media RCE via Imagick

On August 12, WordPress 7.0.4 closed an Author+ RCE where a crafted upload can be treated as PostScript-family content when Imagick and Ghostscript are both present — a “PNG that isn’t a PNG.” Patchstack’s post is the clear technical read.

Do this: Patch to 7.0.4. If Authors can upload media, treat unpatched media processing as urgent. Virtual-patch upload content-type abuse at the edge while estates catch up.

3. Elementor Pro — unauthenticated file upload to RCE

August 19 advisory: Elementor Pro Forms File Upload (≤4.2.1) had a CVSS 9.0 unauthenticated arbitrary file upload fixed in 4.2.2. A multipart trick lets a .php land under wp-content/uploads/elementor/forms/. Only a published form with a file field is required.

Do this: If any microsite runs Elementor Pro forms, get to 4.2.2 immediately. Sweep that uploads path for unexpected PHP. Edge rules on form upload abuse buy time.

4. Norway Digdir — DDoS on shared government login

From about 03:38 on August 24, Digdir reported a large DDoS on shared digital services (with partner Vivicta) — the third wave in a short period. ID-porten and related gateways slowed or went down. Digdir framed it as availability, with no indication of a data breach. The Record covered the same wave.

Do this: Shared IdPs are the blast radius. Rate-limit auth paths, rehearse status/comms, and don’t assume “we have a WAF” means login survives a flood.

5. Norway Sikt / Feide — multi-day hits on higher-ed services

Sikt documented DDoS across Feide login, Studentweb, and related UH-sector services starting August 29, with further Feide impact into early September. Again: availability attacks, no reported intrusion — but when SSO floods, dozens of apps fail together.

Do this: Treat shared campus login like critical infrastructure. Edge rate limits and challenge modes on auth, plus a plan when the IdP is the target.

Tip of the week

New virtual-patch rules start in count — and match the body, not only the path.

Before you flip block on a fresh WordPress or plugin signature, watch production for a day. Confirm the rule sees the real exploit (multipart fields, POST parameters), not just a pretty URL. Attackers rewrite delivery so path-only filters never fire.

That’s how we run ProtectMyWebsite: rules start in count; after 24 hours the dashboard shows what’s safe to block — one click.

If you run campus or agency sites: scan your site, see managed WAF for university and college websites, managed WAF for government and public-sector websites, and start a 14-day trial.