tc4dy/CVE-2026-64638-PoC-Exploit

GitHubRepository PoCExploit

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a full exploitation toolkit for CVE-2026-64638, a pre-auth reflected XSS in WordPress. The primary script, exploit.py, implements a multi-stage attack chain: XSS injection, Application Password capture, malicious plugin upload for RCE, reverse shell, persistence, privilege escalation, and C2 beaconing. It is designed to actively compromise a target, not merely detect the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The repository contains a disclosed exploit for CVE-2026-64638, a WordPress XSS-to-RCE chain. The code implements the described attack: XSS injection, Application Password capture, plugin upload, and post-exploitation actions (reverse shell, C2, privilege escalation, etc.). All behavior is consistent with the documented exploit functionality. No concealed or materially misrepresented behavior targeting the operator or an unrelated system was found.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareWordPress
Attack typesCross-site Scripting (XSS)Remote Code Execution (RCE)Privilege EscalationCommand and Control (C2)Credential Theft
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact, exploit.py, is explicitly designed to exploit CVE-2026-64638. It implements a full attack chain that goes beyond detection to actively compromise a target by capturing credentials, uploading a webshell, and providing post-exploitation capabilities like reverse shells and persistence. The README.md describes it as a 'Full exploitation toolkit' for 'Red teams / authorized pentesters'.

README.md:44exploit.py:1224-1268

Requirements

  • A vulnerable WordPress instance (versions 4.7.0 through 7.0.2) with the Application Password feature enabled.README.md:17
  • The attacker must be able to host a malicious JavaScript payload on a server reachable by the victim's browser.exploit.py:741-859
  • The attack requires social engineering or tricking a logged-in WordPress administrator into visiting a malicious page or clicking a crafted link.README.md:22

Observed behavior

  • Checks if the target WordPress site is vulnerable by sending a crafted XSS payload to the login form and checking for its reflection.exploit.py:725-734
  • Starts a local HTTP server to host a JavaScript payload that, when executed in the victim's browser, automatically generates an Application Password via the WordPress REST API and exfiltrates it to the attacker.exploit.py:741-859
  • Generates an HTML exploit page that auto-submits the XSS payload to the target's wp-login.php.exploit.py:872-888
  • Uses the captured Application Password to authenticate to the WordPress admin panel and upload a malicious plugin containing a webshell.exploit.py:1059-1094
  • Provides an interactive shell for executing system commands on the compromised server via the uploaded webshell.exploit.py:1119-1130
  • Includes modules for reverse shell, persistence (cron, systemd, SSH), privilege escalation, memory forensics, database dumping, and C2 beaconing.exploit.py:1132-1145exploit.py:1147-1178exploit.py:1209-1217exploit.py:1219-1222exploit.py:938-999exploit.py:82-208
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Chain
XSS injection -> Application Password capture -> Plugin upload (RCE) -> Post-exploitationThe exploit.py file implements the full attack chain described in the README, including credential capture via a local HTTP server and subsequent authenticated actions.exploit.py:861-870exploit.py:1059-1094exploit.py:1224-1268
Local Http Server
ThreadingHTTPServer on port 9100The exploit starts a local HTTP server to serve the XSS payload and receive captured credentials. This is a standard technique for reflected XSS exploitation and is disclosed in the README.exploit.py:741-859
C2 Communication
HTTP, DNS, or Telegram C2 beaconingThe C2Manager class implements beaconing to a user-supplied C2 server. The README documents this feature, and it is only activated when the operator provides --c2-type and --c2-server arguments.exploit.py:82-208README.md:59
Post Exploitation Modules
Privilege escalation, memory forensics, database dump, SSH key extraction, persistenceThese modules are part of the disclosed exploit toolkit and are only executed when the operator enables them via command-line flags or interactive commands.exploit.py:210-293exploit.py:295-372exploit.py:938-999exploit.py:1011-1057exploit.py:1147-1178
Review boundaries

What the analysis did not establish

  • The evidence packet does not include the content of safecheck.py, which is described as a non-intrusive scanner. Only exploit.py, README.md, and requirements.txt were provided as selected text.
  • The analysis is based solely on static review of the provided source code; the code was not executed, and its actual functionality or reliability cannot be verified.
  • The evidence packet reports one non-text media file (likely the image 64638.png) and three unclassified files that were not included in the selected text, so their content is unknown.
  • The safecheck.py file was not included in the selected text evidence and was not reviewed.
  • Binary and non-text media files (e.g., 64638.png) were not analyzed.
  • The review is limited to static analysis of the provided text; runtime behavior was not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1