NITDA warns WordPress users over vulnerability that could give attackers website control

Nigeria’s National Information Technology Development Agency (NITDA) has warned WordPress users and administrators about a pre-authentication vulnerability that could allow attackers to execute malicious PHP code on affected websites.

The warning was issued on Wednesday by the NITDA Computer Emergency Readiness and Response Team (NITDA-CERRT) in an advisory covering the vulnerability tracked as CVE-2026-64638.

NITDA-CERRT advised WordPress administrators to update WordPress Core to version 7.0.3 and implement additional security measures to protect their websites.

What NITDA is saying

NITDA-CERRT said CVE-2026-64638 is a pre-authentication vulnerability affecting the WordPress login screen and could potentially lead to PHP code execution.

• “A new pre-authentication cross-site scripting (XSS) vulnerability has been discovered on the WordPress login screen, which could potentially lead to PHP code execution,” the advisory said.

The agency warned that the flaw could expose affected websites to unauthorised access and compromise.

• “The vulnerability can be exploited without authentication or prior privileges. Immediate action is recommended to mitigate this threat,” NITDA-CERRT said.

According to the advisory, a successful compromise could allow an attacker to execute PHP code on an affected system, potentially resulting in data theft, privilege escalation and full system compromise.

The agency also warned that attackers could use the vulnerability to create backdoors, inject malware or take control of an affected system.

• “Furthermore, the pre-auth nature of the vulnerability means that attackers do not need valid credentials to exploit it, making it a significant threat,” NITDA-CERRT said.

What users should do

NITDA-CERRT advised WordPress administrators to update WordPress Core to version 7.0.3 as the primary measure against the vulnerability.

• NITDA-CERRT also recommended deploying a Web Application Firewall (WAF) to detect and prevent XSS attacks.
• Administrators were further advised to use a reputable security plugin to monitor and protect their websites and to limit access to sensitive areas through appropriate authentication and authorisation mechanisms.

The agency also recommended maintaining regular backups to reduce the potential impact of data loss if a website is compromised.

Get up to speed

NITDA has previously warned about vulnerabilities in widely used WordPress components.

• In 2024, the agency issued a security alert over CVE-2024-28000, a vulnerability affecting the LiteSpeed Cache plugin for WordPress, which was installed on more than 5 million websites globally at the time.
• The vulnerability affected the plugin’s role simulation feature and could allow attackers to gain administrative privileges without authentication.
• NITDA said attackers could exploit the flaw to take control of affected websites, potentially allowing them to install malicious plugins, steal sensitive information or redirect visitors to malicious websites.

The 2024 warning involved a separate vulnerability from the current CVE-2026-64638: while the earlier flaw affected a WordPress plugin, the latest vulnerability identified by NITDA-CERRT affects the WordPress login screen itself.

What you should know

NITDA has also been working to strengthen the regulatory and infrastructure framework supporting Nigeria’s cloud computing ecosystem.

The agency recently signed three regulatory instruments under the National Sovereign Cloud Initiative (NSCI): the National Cloud Computing Guideline, the National Cloud Technical Guideline and the National Digital Infrastructure Assurance Framework (NDIAF), alongside the presentation of the National Cloud Investment Strategy.

According to NITDA, the frameworks are intended to provide a structured national approach to cloud adoption, digital sovereignty, infrastructure assurance and investment, while supporting the development of Nigeria as a regional hub for cloud services, data centres, artificial intelligence infrastructure, sovereign computing and other critical digital infrastructure.