Sploitus

Exploit for CVE-2026-64638

githubexploit Β· 2026-08-07

Exploit Code

README74 lines
## https://sploitus.com/exploit?id=AE6F6022-D94F-5E89-9A0B-5D6C8C0B3E13
# XSS2Shell β€” WordPress Pre-Auth XSS β†’ RCE Chain PoC

**CVE-2026-64638** Β· Reflected XSS on `wp-login.php` Β· CVSS 8.9 (v4.0) Β· Patched in WordPress 7.0.3

> ⚠️ **AUTHORIZED TESTING ONLY.** This tool is for security research and
> authorized penetration testing against systems you own or have explicit
> written permission to test. Unauthorized use is illegal in most
> jurisdictions. The researcher (PWN.AI) disclosed this on 2026-08-07;
> WordPress shipped the fix in 7.0.3 the same day.

## Overview

XSS2Shell is a pre-authentication **XSS to code-execution chain** affecting
WordPress Core (all versions back to 4.7, ~500M+ sites). A single crafted
failed-login attempt runs attacker JavaScript in the WordPress origin; against
a logged-in administrator it escalates to **full RCE**.

Public disclosure: 

## The Chain (5 stages)

1. **Parser differential** β€” `wp-login.php` reflects the submitted username
   via `sprintf('Error: The username %s ...')`.
   `` (whitespace between ``, ``,
   `X`.
3. **Autonomous request** β€” `wp-pass.php`'s delegated click handler fires via
   the injected button. The guard `user_id === new_user_id` is bypassed
   (`undefined === undefined` β€” both inputs absent on the login page). The
   identifier `ajaxurl` resolves to the injected `` via HTML named
   property access on the Window object.
4. **Same-origin POST** β€” jQuery POSTs to the attacker-controlled `href`
   (`/?rest_route=/&_method=GET&_jsonp=alert&_envelope=1` β€” JSONP envelope).
5. **RCE (admin victim)** β€” OAuth app-password flow β†’ REST API page creation β†’
   plugin upload β†’ webshell (PHP in `wp-content/plugins//` is
   web-accessible without activation).

## Usage

```bash
# 1. Non-destructive check β€” does the target reflect the payload?
python3 xss2shell.py check https://example.com

# 2. Generate the trigger HTML form (XSS stage)
python3 xss2shell.py exploit --target example.com > trigger.html

# 3. RCE stage (lab only β€” needs admin application password)
python3 xss2shell.py shell https://example.com --app-password "XXXX XXXX XXXX XXXX XXXX XXXX"

# 4. Emit the plugin zip without uploading
python3 xss2shell.py zip --out xss2shell-plugin.zip
```

Requires: **Python 3.8+ stdlib only** β€” no third-party dependencies.

## Attack flow (manual lab walkthrough)

1. Serve `trigger.html`, submit it (or auto-submit via JS) against the target
   login page β†’ XSS fires in the victim's browser.
2. With an admin victim: `authorize-application.php` is abused to mint an
   application password.
3. Use the app password with `shell` to upload the plugin zip.
4. Access `/wp-content/plugins/xss2shell/xss2shell.php` β€” `{"rce":true,...}`.

## Detections / References

- PWN.AI disclosure: 
- THN coverage: 
- NHS cyber alert: 
- SocRadar: 

## License

MIT β€” see [LICENSE](LICENSE). Copyright (c) 2026 Hamza Γ‡ağrΔ±cΔ± (Boreas37).