The National Information Technology Development Agency (NITDA) has issued a security warning to WordPress users and administrators over a pre-authentication vulnerability capable of allowing attackers to execute malicious PHP code on affected websites.
![](https://thenigerialawyer.com/wp-content/uploads/2026/06/ELLAN.png")
![](https://thenigerialawyer.com/wp-content/uploads/2026/05/2026-Summer-IDRI-Masterclass.jpg")
The warning was issued on Wednesday by the NITDA Computer Emergency Readiness and Response Team (NITDA-CERRT) in an advisory concerning the vulnerability identified as CVE-2026-64638.
According to NITDA-CERRT, the vulnerability affects the WordPress login screen and could be exploited without authentication or prior privileges, increasing the risk of unauthorised access and compromise of affected websites.
“A new pre-authentication cross-site scripting (XSS) vulnerability has been discovered on the WordPress login screen, which could potentially lead to PHP code execution,” the advisory stated.
The agency warned that the pre-authentication nature of the flaw makes it particularly dangerous because an attacker does not require valid usernames, passwords or existing privileges before attempting to exploit an affected system.
“The vulnerability can be exploited without authentication or prior privileges. Immediate action is recommended to mitigate this threat,” NITDA-CERRT said.
The agency explained that successful exploitation could allow an attacker to execute PHP code on a vulnerable website, potentially resulting in data theft, privilege escalation and complete system compromise.
Attackers could also exploit the flaw to establish backdoors, inject malware or take control of affected systems.
“Furthermore, the pre-auth nature of the vulnerability means that attackers do not need valid credentials to exploit it, making it a significant threat,” the agency warned.
As an immediate mitigation measure, NITDA-CERRT advised WordPress administrators to update WordPress Core to version 7.0.3.
The agency also recommended the deployment of a Web Application Firewall to detect and prevent cross-site scripting attacks and other malicious traffic directed at websites.
Administrators were further advised to install reputable security plugins capable of monitoring suspicious activities and strengthening protection against unauthorised access.
NITDA-CERRT also urged website operators to restrict access to sensitive areas through appropriate authentication and authorisation controls.
It recommended regular backups of website data and configuration files to reduce the impact of possible data loss or system compromise.
The latest advisory follows previous warnings by NITDA over security vulnerabilities affecting widely used WordPress components.
In 2024, the agency issued an alert concerning CVE-2024-28000, a vulnerability affecting the LiteSpeed Cache plugin for WordPress, which at the time was installed on more than five million websites globally.
That vulnerability affected the plugin’s role simulation feature and was capable of allowing attackers to obtain administrative privileges without authentication.
NITDA had warned that successful exploitation of the flaw could enable attackers to take control of affected websites, install malicious plugins, steal sensitive information or redirect visitors to malicious websites.
The agency clarified that the earlier LiteSpeed Cache vulnerability was separate from CVE-2026-64638.
While the 2024 vulnerability affected a WordPress plugin, the latest security threat identified by NITDA-CERRT concerns the WordPress login screen itself.
The warning comes as NITDA continues efforts to strengthen Nigeria’s cybersecurity, cloud computing and digital infrastructure frameworks.
The agency recently signed three regulatory instruments under the National Sovereign Cloud Initiative — the National Cloud Computing Guideline, National Cloud Technical Guideline and National Digital Infrastructure Assurance Framework — alongside the presentation of the National Cloud Investment Strategy.
According to NITDA, the frameworks are intended to provide a coordinated national approach to cloud adoption, digital sovereignty, infrastructure assurance and investment.
They are also expected to support Nigeria’s ambition to become a regional hub for cloud services, data centres, artificial intelligence infrastructure, sovereign computing and other critical digital infrastructure.
NITDA-CERRT consequently urged WordPress administrators and organisations operating websites on the platform to treat the latest vulnerability as a significant security risk and implement the recommended updates and safeguards without delay.
Interested buyers are encouraged to place their orders and enquiries via:
0704 444 4777, 0704 444 4999, 0818 199 9888
Website: www.alexandernigeria.com
The book also examines Nigeria's legal ecosystem, focusing on the LPELR and NBA AI Guidelines. As a bonus, every purchase comes with a FREE eBook titled: How to Use the AI Features in LegalPedia and LawPavilion.
Ohio Books Ltd praises the publication, stating:
"....this is the only Nigerian book I know of on the topic."
How to Order:
📞 Call, Text, or WhatsApp: 08034917063 | 07055285878
📧 Email: benadigwe1@gmail.com
🌎 Website: www.benadigwe.com
Ebook Version: Access it directly online at https://selar.com/prv626
Authored by Ben Ijeoma Adigwe Esq., ACIarb (UK), LL.M, Dip. in Artificial Intelligence, Director at the Delta State Ministry of Justice, Asaba, Nigeria.
_______________________________________________________________________
“Order Justice Omolaye-Ajileye’s Electronic Evidence Books Now” — Essential Guides On Evidence Act, Case Law And Digital Proof
