psf-wordpress-xss2shell-check(8)

Script: /opt/psf-security-patches/wordpress/wordpress-xss2shell-check.sh. Tool page: WordPress core and plugins. Source. With the package installed: man psf-wordpress-xss2shell-check.

WordPress XSS2Shell pre-auth XSS, October 2026: read-only checker  (v1)
CVE-2026-64638

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

WordPress Core 4.7 through 7.0.2 reflects the submitted username in the
wp-login.php error message via sprintf() without adequate sanitization. A
parser-differential payload (a whitespace character between '<' and a tag
name, such as "< area") survives PHP strip_tags() because of the space,
then WordPress's KSES sanitizer re-tokenizes it into a live DOM element. An
attacker who can get a logged-in administrator to trigger the XSS can chain
that into full remote code execution via OAuth app-password abuse and plugin
upload. The attack is pre-authentication: no account is required to send the
crafted login form. Disclosed 2026-08-07 by PWN.AI; WordPress shipped the
fix in 7.0.3 the same day.

This script is read-only: it checks the WordPress version, probes for XSS
reflection (a non-destructive POST to wp-login.php that generates only an
authentication failure), audits defensive posture, and searches logs and
plugin directories for signs of exploitation. It does NOT exercise the RCE
chain or upload anything.

Usage:
  ./wordpress-xss2shell-check.sh [command] [arguments]

  check URL (default)  detect WordPress version and probe wp-login.php for
                       XSS reflection. The probe is a URL-encoded POST to the
                       login form: it generates one failed-authentication entry
                       in the auth log and no other side effects. Root not
                       needed. Exit 0 = not vulnerable or not WordPress, 1 =
                       appears vulnerable, 2 = error or unreachable.
  audit URL            all of check, plus: sensitive file exposure
                       (wp-config backups, .git/config, debug.log, xmlrpc.php,
                       .env), security headers (CSP, HSTS, X-Frame-Options,
                       X-Content-Type-Options), and REST API user enumeration.
                       Exit 0 = no critical findings, 1 = critical, 2 = error.
  hunt [WEBROOT]       read-only log and filesystem analysis: web server access
                       logs for POST bursts to wp-login.php, requests to
                       authorize-application.php (OAuth app-password abuse),
                       plugin upload requests, and direct PHP execution in
                       plugin directories; WordPress debug.log for error
                       patterns; and the plugin directories under WEBROOT (or
                       WP_ROOTS) for recently added or unexpected PHP files.
                       Exit 0 = nothing found, 1 = findings.
  version              print the script version.

Env overrides:
  WP_ROOTS="/var/www /srv/www"   where hunt looks for wp-content/ (space-sep)
  HUNT_SINCE="2026-08-07"        earliest date hunt reads from logs
  HUNT_LOGS="/srv/app/log/*.log" extra log globs
  CURL_OPTS="--insecure"         extra curl options (e.g. skip TLS verify)

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.