CVE-2026-64638 — XSS2Shell Proof of Concept

A proof-of-concept (PoC) tool for validating CVE-2026-64638, a pre-authentication reflected Cross-Site Scripting (XSS) vulnerability affecting WordPress installations (versions 6.4 – 7.0.2).

Overview

This tool automates the process of fingerprinting, validating, and generating a PoC for CVE-2026-64638. It safely confirms whether a target WordPress installation is vulnerable to the pre-authentication reflected XSS without deploying malicious payloads. If the target is confirmed vulnerable, it can generate an HTML PoC for authorized security testing and inclusion in bug bounty reports.

Features

• Version Fingerprinting: Accurately detects the target WordPress version using multiple heuristics.
• Safe Validation: Tests payload reflection and REST API JSONP endpoints to confirm exploitability safely.
• Artifact Generation: Automatically generates HTML PoC files, curl reproduction commands, and report snippets.
• Payload Variants: Supports multiple bypass variants (standard, envelope, waf) to test different filtering scenarios.

Architecture / How It Works

1. Fingerprinting: Identifies the WordPress version via generator tags, readme.html, or enqueued script parameters.
2. Endpoint Validation: Confirms that wp-login.php is reachable and functional.
3. Payload Reflection Check: Sends a crafted username payload to wp-login.php and checks if the required DOM elements (e.g., ajaxurl, color-picker) survive sanitization in the response.
4. JSONP Callback Check: Tests the REST API JSONP functionality to verify if JavaScript evaluation is possible, completing the chain.
5. Report Generation: Compiles the findings into reproducible artifacts.

Requirements

• Python 3.x
• Supported operating systems: Linux, macOS, Windows
• Dependencies: requests>=2.31.0, urllib3

Installation

Clone the repository and install the required dependencies:

git clone https://github.com/eh-amish/xss2shell-poc.git
cd xss2shell-poc
pip install -r requirements.txt

Configuration

This tool does not require any environment variables or complex configuration files. All parameters are passed directly via command-line arguments.

Usage

Run the tool with Python 3 against an authorized target.

Basic Vulnerability Check (No PoC Generation)

python3 xss2shell_poc.py -t https://target.com --check-only

Full Validation and PoC Generation

python3 xss2shell_poc.py -t https://target.com

Advanced Variants

If the standard payload is blocked by a WAF or the REST endpoint returns HTTP 401, try alternative variants:

python3 xss2shell_poc.py -t https://target.com --variant waf
python3 xss2shell_poc.py -t https://target.com --variant envelope

Custom PoC Filename

python3 xss2shell_poc.py -t https://target.com -o custom_poc.html

Project Structure

.
├── .gitignore
├── CONTRIBUTING.md
├── LICENSE
├── README.md
├── SECURITY.md
├── requirements.txt
└── xss2shell_poc.py

Examples

Example Execution Output

Target  : https://target.com
Variant : standard
Mode    : Full PoC

[>] Phase 1 — WordPress Version Fingerprint
[+] WordPress 7.0.2 — VULNERABLE (6.4 – 7.0.2)

[>] Phase 2 — Confirm Login Page
[+] wp-login.php reachable (HTTP 200)

[>] Phase 3 — Testing XSS Payload (variant: standard)
[+] XSS PAYLOAD SURVIVED SANITIZATION!
[+] Injected DOM elements found in response: ['id="ajaxurl"', 'id="color-picker"']

[>] Phase 4 — REST API JSONP Callback Check
[+] REST JSONP callback works: https://target.com/?rest_route=/&_method=GET&_jsonp=testcb
[+] jQuery will evaluate response as script → XSS fires automatically

Security

This repository contains security-related testing tools. Please refer to SECURITY.md for our responsible disclosure policy and authorized use requirements.

Limitations

• The version fingerprinting may fail if the target has implemented robust "security through obscurity" measures to hide its WordPress version.
• WAFs may block the payload reflection check even if the underlying software is vulnerable.

Contributing

We welcome professional contributions! Please see CONTRIBUTING.md for details on our workflow, code quality standards, and submission guidelines.

License

This project is licensed under the MIT License.

Credits / Attribution

• The vulnerability logic is based on publicly available security advisories regarding CVE-2026-64638.
• The PoC script structure and payloads were curated by the project contributors for testing purposes.

Disclaimer

Intended for authorized use only. This project is provided strictly for authorized penetration testing, security research, and bug bounty programs where explicit, written permission has been granted by the system owner. Do not use this tool against systems you do not own or have permission to test. The authors and contributors are not responsible for any misuse, damage, or legal consequences resulting from the use of this software.