HackSpeak/CVE-2026-64638

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based exploit for CVE-2026-64638 that chains a pre-auth reflected XSS in WordPress login into full server-side RCE via DOM Clobbering, Application Password theft, page publishing, and malicious plugin upload.

Backdoor review

No backdoor observed in reviewed code

The PoC implements a documented XSS-to-RCE chain against WordPress (CVE-2026-64638). It serves attacker-controlled pages, captures an Application Password via social engineering, publishes a page containing upload JavaScript, and deploys a PHP shell plugin. All behavior aligns with the stated exploit purpose; no concealed backdoor, unrelated payload, or operator-directed harm was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPythonJavaScriptHTMLPHP
Target softwareWordPress
Attack typesCross-Site Scripting (XSS)Remote Code Execution (RCE)DOM ClobberingCredential Theft
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, functional Python script (xss2shell_poc.py) that actively exploits CVE-2026-64638 to achieve remote code execution. It generates XSS payloads, hosts an attacker server, captures credentials, publishes a page, uploads a malicious plugin, and executes arbitrary commands on the target. This is clearly exploit code, not a scanner or writeup.

xss2shell_poc.py:1-558README.md:9-13

Requirements

  • A WordPress instance vulnerable to CVE-2026-64638 (versions < 7.0.3).README.md:14
  • An administrator of the target WordPress site must be socially engineered to visit an attacker-controlled URL and log in.README.md:29xss2shell_poc.py:473-476
  • The attacker must run a Python server to host the exploit pages and receive callbacks.xss2shell_poc.py:370-373xss2shell_poc.py:465-467

Observed behavior

  • Starts an HTTP server to host the exploit pages and receive beacon callbacks from the victim's browser.xss2shell_poc.py:370-373xss2shell_poc.py:465-467
  • Generates an XSS payload that exploits a parsing difference between PHP strip_tags() and WordPress KSES to inject HTML/JavaScript into the login error page.README.md:11xss2shell_poc.py:128-133
  • Uses DOM Clobbering to hijack the 'ajaxurl' variable, triggering a jQuery POST that leads to Same Origin Method Execution (SOME) and automatic click of the Application Password approval button.README.md:13xss2shell_poc.py:128-130
  • Captures the generated Application Password via a callback URL and saves it to a local JSON file.xss2shell_poc.py:316-326xss2shell_poc.py:64-76
  • Uses the stolen credentials to publish a new WordPress page containing JavaScript that uploads a malicious plugin ZIP.xss2shell_poc.py:216-234xss2shell_poc.py:258-262
  • The uploaded plugin contains a PHP web shell (shell.php) that executes arbitrary commands passed via the 'cmd' parameter.xss2shell_poc.py:274-282
  • Executes a user-supplied command on the target server via the web shell and prints the output.xss2shell_poc.py:526-531
  • Optionally cleans up the published page after exploitation.xss2shell_poc.py:542-554
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Capture
Application Password captured via callback page and saved to xss2shell_creds.jsonThe PoC captures the victim's Application Password as part of the documented RCE chain, not as a hidden backdoor.xss2shell_poc.py:316-326
Php Shell Deployment
Plugin ZIP containing shell.php with shell_exec() is uploaded to the targetThe shell.php file executes arbitrary commands via shell_exec(), which is the intended RCE payload of the PoC.xss2shell_poc.py:272-282
Attacker Server
Local HTTP server serves exploit pages and receives beaconsThe server is part of the PoC infrastructure to deliver the XSS payload and coordinate the attack steps.xss2shell_poc.py:290-356
Review boundaries

What the analysis did not establish

  • The evidence includes only two of four repository files; the other two files (likely .gitignore and LICENSE) are omitted but are not expected to alter the classification.
  • The analysis is based solely on static code review; the code was not executed, and its operational reliability is not verified.
  • Two files (total 4) were omitted from text content due to size/selection policy; their metadata shows no binary content, but their text was not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1