According to pwn.ai, which discovered the flaw and shared technical details with The Hacker News, the login-page XSS requires no authentication. The researchers use WordPress's REST JSONP support to turn that request into JavaScript executing in the site's origin. The path from XSS to PHP execution builds on Yibelo's earlier SOME technique, which uses a permitted JSONP property chain to invoke a method in another browser window. They did not attempt Application Password creation, file upload, persistence, or PHP execution on those systems. A successful PHP execution would expose WordPress database credentials in wp-config.php, allow persistent administrator creation and content changes, expose files and secrets readable by the PHP worker, and permit operating-system commands with that worker's privileges.