The National Information Technology Development Agency (NITDA) has warned users of multiple critical vulnerabilities affecting Microsoft Windows Remote Desktop Protocol (RDP).
The agency gave the warning on Wednesday through its Computer Emergency Readiness and Response Team (NITDA-CERRT) in an advisory covering the vulnerability tracked as CVE-2026-64638.
According to NITDA, vulnerabilities affect Remote Desktop components and could enable attackers to access sensitive information, bypass security protections, escalate privileges or execute malicious code on vulnerable systems.
WordPress administrators were advised to update to version 7.0.3 immediately after researchers disclosed a high-severity flaw that can be exploited to potentially take full control of affected servers. “A new pre-authentication cross-site scripting (XSS) vulnerability has been discovered on the WordPress login screen, which could potentially lead to PHP code execution,” the advisory read.
The agency warned that the flaw could expose affected websites to unauthorised access and compromise. “The vulnerability can be exploited without authentication or prior privileges. Immediate action is recommended to mitigate this threat,” NITDA-CERRT said.
The agency warned that a successful compromise could allow an attacker to execute PHP code on an affected system, potentially resulting in data theft, privilege escalation and full system compromise. It also warned that attackers could use the vulnerability to create backdoors, inject malware or take control of an affected system. “Furthermore, the pre-auth nature of the vulnerability means that attackers do not need valid credentials to exploit it, making it a significant threat,” it said.
Administrators were further advised to use reputable security plugins to monitor and protect their websites and to limit access to sensitive areas through appropriate authentication and authorisation mechanisms. NITDA-CERRT also recommended maintaining regular backups to reduce the potential impact of data loss if a website is compromised.
NITDA had in 2024 issued a security alert over CVE-2024-28000, a vulnerability affecting the LiteSpeed Cache plugin for WordPress, which was installed on more than five million websites globally at the time. The vulnerability affected the plugin’s role simulation feature and could allow attackers to gain administrative privileges without authentication.
