renzi25031469/cve-2026-64638-wordpress-core-xss2shellTemplate Nuclei para detecção não-intrusiva do XSS2Shell, um parser differential pré-autenticado no WordPress Core que permite injeção de elementos DOM na página de login, servindo de base para uma cadeia de XSS → RCE.
Template Nuclei for non-intrusive detection of XSS2Shell, a pre-authenticated differential parser in WordPress Core that allows injection of DOM elements into the login page, serving as the basis for an XSS → RCE chain.
⚠️ This template only detects the sanitization flaw (marker reflection step in the HTML response). It does not run the full exploitation chain (DOM clobbering, JSONP/SOME, Application Password theft, or plugin upload). Strict use on assets under explicit authorization.
WordPress Core, when rendering the "user not registered" error message in wp-login.php, inserts the submitted username into HTML without consistent escaping between two distinct filters:
wp_strip_all_tags() (based on PHP's strip_tags()) only recognizes a tag if < is followed immediately by a letter — a space after < makes the filter treat the content as plain text.wp_kses_post(), applied right after, uses its own tokenizer, which tolerates that space and reconstructs the string as a real HTML element (<area>, <div>, and <button> are on the allowlist).The result is that an unauthenticated attacker can inject arbitrary DOM elements into the login page, which — combined with legacy handlers from the user-profile.js script, DOM clobbering of the ajaxurl variable, and JSONP from the REST API — allow JavaScript execution on the WordPress origin and, in a full chain, RCE against an administrator's account.
Discovered and disclosed by pwn.ai. Fixed in WordPress 7.0.3 (backport down to the 4.7 branch).
The template sends a POST request to /wp-login.php with a payload in the log field containing:
< area id=xss2shell-marker href=/x>< div id=xss2shell-div>
If WordPress is vulnerable, wp_kses_post() reconstructs these strings as real HTML elements in the response. The template uses two regex matchers (and condition) to confirm that both tags appear reconstructed — reducing false positives from WAFs that partially reflect input.
# Validate template syntax
nuclei -t CVE-2026-64638.yaml -validate
# Run against a single target
nuclei -t CVE-2026-64638.yaml -u https://target.com
# Run against a list of targets
nuclei -t CVE-2026-64638.yaml -l targets.txt
# Debug (see full request/response)
nuclei -t CVE-2026-64638.yaml -u https://target.com -debug-req -debug-resp
| Result | Meaning |
|---|---|
| Positive match | Injected tags reflected as real HTML → differential parser present → vulnerable target (unpatched) |
| No match | Payload escaped or removed → patched target (WordPress ≥ 7.0.3) or protected by a WAF/proxy that normalizes spaces inside tags |
Upgrade to WordPress 7.0.3 or later. The patch was backported to all maintained branches starting from 4.7.
This template is provided for security research and authorized penetration testing purposes. Use against systems without explicit authorization is illegal. The author is not responsible for misuse.
Renzi