CVE-2026-64638 Exploit Metadata

PoC files

33 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-09

Technical assessment

The artifact contains a Python script (exploit.py) that serves a phishing page and a JavaScript payload. The JavaScript payload, when executed in an admin's browser via the reflected XSS vulnerability, automatically creates a new administrator account on the target WordPress site. This is a full exploit chain implementation.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README.md documenting a reflected XSS vulnerability (CVE-2026-64638) in WordPress and an exploit.py script that demonstrates the attack chain. The exploit.py script implements a phishing server that delivers a JavaScript payload to create a backdoor administrator account on a targeted WordPress site. This behavior is consistent with the described exploit chain (XSS → DOM clobbering → admin account creation) and targets the stated vulnerable software. No concealed, unrelated, or operator-directed harmful behavior beyond the normal exploit demonstration was observed.

ClassificationExploit

Model confidence95%

AuthenticationNot required

LanguagesPythonJavaScriptHTML

Target softwareWordPress

Attack typesCross-Site Scripting (XSS)DOM ClobberingAccount Takeover

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact includes a functional Python script (exploit.py) that implements a multi-stage attack chain. It serves a phishing page to trigger a reflected XSS vulnerability, uses DOM clobbering to load a second-stage JavaScript payload, and that payload automatically creates a new administrator account on the target. This is code intended to exercise a vulnerability for account takeover, which is the definition of an exploit.

wp-src/exploit.py:1-168

Requirements

A WordPress site vulnerable to CVE-2026-64638 (versions prior to 7.0.3).README.md:5
An administrator of the target site must be tricked into clicking a link to the attacker's phishing page.README.md:13

Observed behavior

The exploit.py script starts an HTTP server that serves a phishing page (/phish.html) and a malicious JavaScript file (/evil.js).wp-src/exploit.py:98-126
The phishing page contains a hidden form that auto-submits a POST request to the target's /wp-login.php with a crafted username containing a DOM clobbering payload.wp-src/exploit.py:64-96
The DOM clobbering payload injects a <div> element that overwrites the legitimate emoji settings, causing the browser to load the attacker's evil.js script.wp-src/exploit.py:66-76
The evil.js script, running in the admin's browser context, fetches a nonce from the WordPress admin panel and then sends a POST request to create a new administrator account named 'backdoor_xss2shell'.wp-src/exploit.py:19-62
The script sends a callback to the attacker's server upon successful creation of the backdoor admin account.wp-src/exploit.py:55-60

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior: exploit.py serves a phishing page and a JavaScript payload that creates a WordPress administrator account named 'backdoor_xss2shell'This is the normal exploit behavior for the described CVE-2026-64638 vulnerability, targeting the stated WordPress login XSS. It does not indicate a backdoor against the person running the PoC.wp-src/exploit.py:19-62wp-src/exploit.py:64-96wp-src/exploit.py:105-126

Review boundaries

What the analysis did not establish

The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository were included. The analysis is based on the two provided text files (README.md and exploit.py).
The README.md file mentions that the bypass of the sanitize_user() function was simulated in a lab by commenting it out, and the specific bypass technique discovered by the pwn.ai team was not publicly released. The provided exploit code may not work against a fully patched or unmodified vulnerable version without this bypass.
Only the two selected text files (README.md and wp-src/exploit.py) were provided for review; 18 other text files and 13 non-text files in the repository were omitted from the evidence packet.
Binary files were flagged as metadata-only and not analyzed; their content is unknown.
The review is limited to static analysis of the provided source code; no dynamic execution or network behavior was observed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

wp-src/docker-compose.yml

Created 2026-08-08Vuln labCVE-2026-64638Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud · 2026-08-09

Environment assessment

A Docker Compose environment defining a WordPress 7.0.2 instance with a MySQL 8.0 database, intended as a lab to reproduce CVE-2026-64638, a reflected XSS vulnerability in WordPress Core.

wp-src/docker-compose.yml:1-40

Lab assessment

Vulnerability lab

The README explicitly describes CVE-2026-64638, a reflected XSS vulnerability in WordPress Core, and provides a step-by-step reproduction guide. The setup script patches WordPress to simulate the vulnerability, and the exploit script demonstrates the attack chain. The Docker Compose file defines the vulnerable target environment.

README.md:1-10wp-src/setup.ps1:1-5wp-src/exploit.py:1-5

Lab shapeCompose · images

Services2

Compose manifests1

Dockerfiles0

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

wordpress

vulnerable targetweb application

WordPress 7.0.2-php8.3-apache service, exposed on host port 8282. It is the target of the XSS vulnerability. The setup script patches its source code to remove sanitization functions, simulating the vulnerable state.

wp-src/docker-compose.yml:4-16wp-src/setup.ps1:48-62

db

databasesupporting infrastructure

MySQL 8.0 database service for the WordPress instance. It stores WordPress data and is not directly involved in the vulnerability.

wp-src/docker-compose.yml:18-33

exploit.py

exploit serverphishing page generatormalicious JavaScript host

A Python script that starts an HTTP server to serve a phishing page and a malicious JavaScript payload. The phishing page auto-submits an XSS payload to the WordPress login, and the JavaScript creates a backdoor admin account when executed in an admin's browser.

wp-src/exploit.py:1-168

setup.ps1

lab setup automation

A PowerShell script that starts the Docker containers, installs WordPress 7.0.2, and patches the WordPress source code to remove `sanitize_user()` and `wp_kses_post()` calls, simulating the vulnerability for the lab.

wp-src/setup.ps1:1-87

wp-emoji-loader.js

vulnerable JavaScript componentDOM clobbering target

The WordPress emoji loader script that reads configuration from an element with id 'wp-emoji-settings' using `getElementById`. This is the component exploited via DOM clobbering in the attack chain.

wp-src/wp-emoji-loader.js:17-19

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-64638

Supported by supplied evidence

The README, setup script, and exploit script all explicitly reference CVE-2026-64638 and describe a reflected XSS vulnerability in WordPress Core ≤ 7.0.2. The lab environment is configured to reproduce this vulnerability by patching the WordPress source code to remove escaping functions.

README.md:1-10wp-src/setup.ps1:1-5wp-src/exploit.py:1-5

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker and Docker Compose must be installed to run the lab environment.wp-src/setup.ps1:12-13
The lab setup script must be executed to start containers, install WordPress, and apply vulnerability-simulating patches.wp-src/setup.ps1:12-62
An admin user must be logged into the WordPress site in the same browser where the phishing link is clicked, or the admin must click the phishing link while authenticated, for the XSS-to-RCE chain to succeed.README.md:10wp-src/exploit.py:20-25

Evidence-described exercise path

Run the setup script to start Docker containers, install WordPress 7.0.2, and patch the source code to simulate the vulnerability.wp-src/setup.ps1:12-62
Verify basic XSS by accessing the login page and entering a payload like `<img src=x onerror=alert(document.domain)>` as the username.README.md:201-207
Run the exploit server using `exploit.py` to serve a phishing page and malicious JavaScript.wp-src/exploit.py:130-135
Simulate an admin clicking the phishing link, which auto-submits an XSS payload to the login page, triggering DOM clobbering and loading the attacker's JavaScript.wp-src/exploit.py:68-90
The attacker's JavaScript creates a backdoor admin account (`backdoor_xss2shell`) in the admin's browser session.wp-src/exploit.py:20-55
Log in with the backdoor account and upload a PHP webshell via the plugin installer to achieve remote code execution.README.md:260-270

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own WordPress target. The exploit server listens on a user-specified port and serves files to the local target. The setup script patches the WordPress container to simulate the vulnerability. No evidence shows host escape, external connections beyond the lab, persistence outside the container, credential theft, or destructive behavior. The lab is self-contained and the exploit chain is a documented proof-of-concept for the stated CVE.

wp-src/docker-compose.yml:1-40wp-src/exploit.py:130-135wp-src/setup.ps1:48-62

Review boundaries

What the analysis did not establish

The packet does not include the actual WordPress source files that are patched by the setup script; only the patching commands are visible.
The exploit script contains Vietnamese comments and variable names, but the behavior is fully described in the README.
The lab requires manual execution of the setup script and exploit server; no automated malicious behavior is present.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

CVE-2026-64638