Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Back to all walkthroughs
Room Icon

XSS2Shell: CVE-2026-64638

Max room.

Chain a pre-auth XSS, DOM clobbering, and SOME to take control of a WordPress website and gain RCE.

medium

60 min

17

User profile photo.
User profile photo.

To access material, start machines and answer questions login.

WordPress (opens in new tab) powers a huge share of the web, and its login screen is one of the few pages every installation exposes to the entire internet, logged in or not. WordPress also ships a feature called Application Passwords: a way for an already-authenticated user to generate a scoped credential that lets an external app act on their behalf over the , no cookies required.

In August 2026, the security research team at pwn. (opens in new tab) disclosed a critical, pre-auth vulnerability chain in WordPress core, nicknamed XSS2Shell. A single, quietly reintroduced escaping gap on the login screen, combined with a legacy password-generator script never designed to run there, turns into full remote code execution the moment a logged-in administrator opens one crafted link. WordPress's own security release for 7.0.3 (opens in new tab) credits the same finding, and NVD tracks it as -2026-64638 (opens in new tab):

  • Severity: High
  • 4.0 Score: 8.9 (AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
  • CVE-ID: CVE-2026-64638
  • CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)
  • Affected Versions: All versions of WordPress before 7.0.3
  • Patched Version: 7.0.3 (fix backported to every branch back to 4.7)

Info: Read the CVSS vector closely and it tells you the shape of the whole chain before you write a single payload. AC:H (high attack complexity) and UI:A (active user interaction) both point at a bug that cannot fire on its own; it needs a real person to do something. That "something" turns out to be a logged-in administrator simply opening a link, which Task 2 covers in full.

Consider a scenario where your organization runs a public WordPress blog with no unusual plugins installed, just a stock theme and core kept reasonably current. An attacker cannot log in, cannot guess a password, and cannot upload a file directly. All they have is a link. If a site administrator, already logged into /wp-admin in one browser tab, opens that link in another, the attacker walks away with a working shell on the server. No credentials were ever guessed, phished, or cracked.

Attack overview: an attacker sends a crafted link through the Report a Broken Link form, an already-logged-in admin opens it, DOM clobbering and SOME silently mint an Application Password, and that password becomes RCE.

This room walks through the full chain: how a single space character defeats PHP's tag stripping without defeating WordPress's own HTML sanitizer, how that gap reaches a piece of legacy JavaScript nobody expected to run on the login page, and how that JavaScript hands an attacker a working webshell.

Learning Objectives

  • Understand how a parser differential between strip_tags() and wp_kses_post() lets malformed HTML survive
  • Understand DOM clobbering using HTML elements to override JavaScript variables
  • Understand Same Origin Method Execution (SOME): using a JSONP-style callback
  • Exploit WordPress's Application Passwords authorization flow to mint a credential without ever seeing the admin's real password
  • Turn a stolen Application Password into remote code execution through the

Prerequisites

Connecting to the Machine

Start the machine using the Start Lab Machine button below. Allow 2-3 minutes for it to fully load. Once ready, the will open in split view, providing access to both the lab environment and the required tools.

START LAB MACHINE

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Lab Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Lab machine
Status:Off
Answer the questions below

I have started the target machine.