## https://sploitus.com/exploit?id=552CE83B-A494-51AD-91B8-7A2834DA6B38
# CVE-2026-64638 – XSS2Shell: WordPress login page pre-authentication XSS → server-side RCE
>HackSpeak distributes the image. **This repository contains the XSS2Shell educational use case for CVE-2026-64638**, with code identical to that from the upstream source; the upstream source is **MIT License, Copyright (c) 2026 WordSec**.>
>⚠️ **Only for security research and authorized testing purposes**. It can only be run on WordPress sites that you own or have written permission to evaluate. The PoC will generate and clean up temporary artifacts; do not use it against third-party administrators or production systems. ## **Brief description of the vulnerability**
**XSS2Shell(CVE-2026-64638)** is a **pre-authentication reflected XSS** on the WordPress login page (`wp-login.php`), which can be exploited to execute **server-side PHP code** upon successful login. – **Root cause**: The **parsing divergence** between PHP’s `strip_tags()` function and WordPress’s KSES (`wp_kses_post()`) allows malicious payloads to be executed during authentication. – **XSS**: Malicious requests without authentication can trigger execution on the login page. – **RCE chain**: DOM Clobbering exploits `ajaxurl`, triggering jQuery POST requests via `user-profile.js` on the login page. This leads to execution of the Same Origin Method Execution (SOME, Paulos Yibelo 2022). The payload steals API credentials, generates a page containing the exploit, uploads a malicious plugin ZIP file, and executes PHP code directly without activation. – **Affected versions**: Almost all versions of WordPress (4.9.0–7.0.2); the fix was released in **7.0.3** (2026-08-06, urgent), and has since been ported to all maintenance branches starting at 4.7. ## **How to use**
```bash
python3 xss2shell_poc.py -t http://wordpress.test --lhost 192.168.1.100 --lport 8080 -c "whoami"
```
| Parameter | Description |
|---|---|
| `-t, --target` | WordPress base URL (including http/https, automatically normalized) |
| `-c, --command` | Command to execute after the shell is ready |
| `--lhost` / `--lport` | Listening address/port (lport 0 = random) |
| `--keep` | Retain temporary output pages (default: cleanup) |
| | Required: Python 3.7+; zero third-party packages required. You must log in as an administrator to the target site and open the attacker’s URL (one-time interaction). |
> **Disclaimer**
> **Only for security research, vulnerability validation, and defensive testing purposes**. Run in a destructible environment only; do not use on unauthorized systems. The PoC is educational code based on public analysis. Read the upstream documentation and target authorization boundaries before using it. > **References**
> **Upstream source repository**: https://github.com/wordsec/XSS2Shell
> Official disclosure on pwn.ai: XSS2Shell – https://pwn.ai/blog/xss2shell
> WordPress official security announcement: GHSA-52p2-r8wf-jcrf – https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-52p2-r8wf-jcrf
> WordPress 7.0.3 release announcement: https://wordpress.org/news/2026/08/wordpress-7-0-3-release/
> Report from The Hacker News: https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html
> WordSec technical analysis + PoC description: https://wordsec.net/blog/xss2shell-wordpress-pre-auth-xss-to-rce-cve-2026-64638