db
database
MySQL 8.0 database service for WordPress, configured with a root password, a dedicated WordPress database, and user credentials. Includes a healthcheck using mysqladmin ping.
docker-compose.yml:2-15imbas007/CVE-2026-64638-POC
PoC files
16 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
The artifact is a repository containing a scanner (xss2shell_scanner.py) and a checker (xss2shell_checker.py) for CVE-2026-64638, a reflected XSS vulnerability in WordPress. The README and Makefile describe and reference these scanning/checking tools. The provided exploit_server.py is a callback server for XSS exfiltration, but the core exploit chain script (xss2shell_chain.py) is not included in the supplied evidence, so the primary operation visible is detection and validation.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence consists of a README, Makefile, a Python callback server, and a requirements file for a CVE-2026-64638 proof-of-concept. The code serves an educational exploit page and logs callbacks, consistent with the stated XSS-to-RCE chain demonstration. No concealed executable behavior, persistence, credential theft, or unrelated payloads were observed in the supplied text.
ClassificationScanner
Model confidence95%
AuthenticationNot required
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The supplied evidence includes references to and usage instructions for xss2shell_scanner.py and xss2shell_checker.py, which are explicitly described as tools for detecting the vulnerability (version detection, patch checking) without exploiting it. The exploit chain script (xss2shell_chain.py) is mentioned but its source code is not provided in the evidence, so the primary artifact operation visible is scanning/checking.
README.md:85-86Makefile:51-55Requirements
- Target WordPress instance must be vulnerable (version < 7.0.3).
README.md:25 - Scanner requires network access to the target WordPress login page.
Makefile:52
Observed behavior
- The Makefile defines a 'scan' target that runs xss2shell_scanner.py to detect version and patch status.
Makefile:51-52 - The Makefile defines a 'check' target that runs xss2shell_checker.py, described as a lightweight patch checker.
Makefile:54-55 - The README describes xss2shell_scanner.py as performing version detection and username reflection test.
README.md:85 - The README describes xss2shell_checker.py as a safe, non-exploitative patch checker.
README.md:86
Behaviors behind the backdoor verdict
Observables
- Callback Server
- exploit_server.py serves a static HTML page and logs GET/POST requests to /callbackThis is the expected behavior for a PoC that demonstrates an XSS callback chain; it does not perform any unauthorized actions on the operator's machine.
exploit_server.py:43-89 - Network Activity
- The server binds to a user-specified host and port (default 127.0.0.1:8080) and logs incoming data to a local file.This is standard for a controlled lab environment and does not indicate backdoor behavior.
exploit_server.py:123-135
What the analysis did not establish
- The main exploit chain script (xss2shell_chain.py) is referenced but its source code is not included in the supplied evidence. Only exploit_server.py, Makefile, README.md, and requirements.txt are provided.
- The scanner and checker scripts (xss2shell_scanner.py, xss2shell_checker.py) are referenced but their source code is not included in the supplied evidence.
- The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository are included.
- 12 out of 16 text files in the repository were not included in the evidence packet; their contents are unknown and could contain backdoor behavior.
- No binary files were identified, but the analysis scope notes 70,512 unclassified bytes across 12 files, which may include unexamined content.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Docker lab environments
1GitHubdocker-compose.yml
Created Vuln labCVE-2026-64638Compose · images
Analysis
Environment assessment
A Docker Compose environment running a vulnerable WordPress 7.0.2 instance with MySQL 8.0 and WP-CLI, designed to demonstrate the CVE-2026-64638 XSS2Shell exploit chain.
docker-compose.yml:1-66README.md:1-171Lab assessment
Vulnerability labThe README explicitly states the repository is for authorized security research and educational purposes, describes CVE-2026-64638, and provides a Docker Compose file that deploys a known vulnerable WordPress version (7.0.2) along with exploit scripts to demonstrate the XSS2Shell chain.
README.md:1-10docker-compose.yml:1-66Lab shapeCompose · images
Services3
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Services and files described by the evidence
wordpress
web applicationvulnerable target
WordPress 7.0.2-php8.2-apache service, the vulnerable target. Exposed on host port 127.0.0.1:8088. Configured with debug mode enabled, FS_METHOD direct for PoC testing, and a healthcheck that curls wp-login.php. Mounts a local logs directory.
docker-compose.yml:17-42cli
administrationsetup
WordPress CLI service used for installing WordPress and running wp commands. It depends on the db service and mounts the wp_data volume. Its default command is 'wp --info'.
docker-compose.yml:44-57test.sh
orchestrationtesting
Bash script that automates starting the Docker environment, installing WordPress, running vulnerability scans, and executing the full XSS2Shell exploit chain. It also provides cleanup commands.
test.sh:1-249xss2shell_chain.py
exploitscannerpayload generatorcallback server
Main Python exploit script implementing the full XSS2Shell chain: version detection, XSS payload generation, application password creation, malicious plugin upload, and remote command execution. Also includes a built-in callback server.
xss2shell_chain.py:1-1018xss2shell_scanner.py
scanner
Python script that detects WordPress version from public endpoints and checks if the version is vulnerable to CVE-2026-64638. Also probes login page for username reflection.
xss2shell_scanner.py:1-245xss2shell_checker.py
scanner
Lightweight, non-exploitative patch checker that reports detected WordPress version and whether the login page reflects usernames. It imports functions from xss2shell_scanner.py.
xss2shell_checker.py:1-56exploit_server.py
callback server
Standalone HTTP server that serves an educational exploit page and logs callback beacons from XSS payloads. It writes callback data to callback.log.
exploit_server.py:1-145How the supplied evidence relates each vulnerability
CVE-2026-64638
Supported by supplied evidence
The entire repository is dedicated to demonstrating CVE-2026-64638. The README describes it as a pre-authentication reflected XSS in WordPress Core, the Docker Compose file deploys a vulnerable version (7.0.2), and the exploit scripts implement the XSS2Shell chain targeting this CVE.
README.md:1-10docker-compose.yml:18xss2shell_chain.py:1-10Requirements and sequence described by the evidence
Prerequisites
- Docker and Docker Compose must be installed to run the lab environment.
README.md:33-36 - Python 3 and the dependencies listed in requirements.txt (requests, beautifulsoup4, lxml) are required to run the exploit scripts.
requirements.txt:1-3README.md:100-102 - The full RCE chain requires WordPress admin credentials (default: admin/admin123) to create an application password and upload a malicious plugin.
test.sh:22-24README.md:55 - The XSS payload requires an authenticated administrator to interact with the attacker-controlled content for stages 3-7 of the chain.
README.md:130-132
Evidence-described exercise path
- Start the Docker environment with './test.sh up', which launches the vulnerable WordPress 7.0.2, MySQL, and WP-CLI services, then installs WordPress with admin/admin123 credentials.
test.sh:60-100 - Run a vulnerability scan using './test.sh scan' or 'python3 xss2shell_chain.py scan -u http://127.0.0.1:8088' to confirm the target is vulnerable.
test.sh:102-115xss2shell_chain.py:150-160 - Execute the full XSS2Shell chain with './test.sh chain' or 'python3 xss2shell_chain.py chain -u http://127.0.0.1:8088 --user admin --pass admin123 --cmd id'. This logs in, creates an application password, uploads a malicious plugin, and executes a command via the plugin.
test.sh:130-150xss2shell_chain.py:800-900 - Optionally, run individual stages: generate XSS payload URL, start callback server, create application password, upload plugin, or execute RCE separately.
README.md:100-120
Behaviors behind the stored safety assessment
No harmful behavior observed
All visible behavior is directed at the lab's own vulnerable WordPress target. The exploit scripts interact only with the local Docker service on 127.0.0.1:8088, create a plugin within the WordPress container, and execute commands inside that container. There is no evidence of host escape, external connections, credential theft, persistence, or destructive actions beyond the intended lab exercise. The callback server binds to localhost by default and only logs data locally.
docker-compose.yml:20test.sh:20xss2shell_chain.py:800-900exploit_server.py:130What the analysis did not establish
- The packet does not include the contents of xss_payload.html, docs/CHAIN.md, docs/MITIGATION.md, docs/PAYLOAD_NOTES.md, Makefile, SECURITY.md, or .gitignore, which may contain additional context.
- The CVE-2026-64638-specific XSS bypass payload is not publicly released in this repository; the default payload is a standard test vector.
- The exploit scripts disable SSL verification (verify=False) for lab convenience, which is not a safety concern in this isolated context but is noted.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.