Ethical Hacking News
WordPress has recently been hit with a critical XSS2Shell flaw that can be exploited for full server takeover. The vulnerability, which was discovered by researchers at Pwn, is based on a simple login bug and allows attackers to inject malicious HTML code into error messages. With this exploit, attackers can gain control over WordPress servers, making it crucial to update to the latest version as soon as possible.
The recent discovery of the WordPress XSS2Shell flaw highlights a critical vulnerability that can be exploited to gain full control over a WordPress server.The exploit is based on a simple login bug triggered by a user submitting a non-existent username.The vulnerability lies in how WordPress handles error messages and PHP's built-in `strip_tags()` function, which allows attackers to inject malicious HTML code into error messages.The injected HTML code is then interpreted as a legitimate HTML element and rendered as real, live HTML by WordPress's sanitizer `wp_kses_post()`.Attackers can use the exploit to walk a full property chain across browser windows, tricking the REST API into responding as JSONP.The researchers demonstrated that the entire exploit chain works pre-authentication, requires zero user interaction, and reliably ends in remote code execution on a stock WordPress install.WordPress has released version 7.0.3 to fix the vulnerability, which is recommended for all users.
The recent discovery of the WordPress XSS2Shell flaw has sent shockwaves throughout the cybersecurity community, highlighting a critical vulnerability that can be exploited to gain full control over a WordPress server. The exploit, which was discovered by researchers at Pwn, is based on a simple login bug that can be triggered by a user submitting a non-existent username.
The vulnerability lies in how WordPress handles error messages when a user submits an invalid username. When the user enters a username that doesn't exist, WordPress builds an error message using that submitted text, after running it through a function meant to strip out any HTML tags. However, this stripping function is flawed and allows attackers to inject malicious HTML code into the error message.
The problem lies in PHP's built-in `strip_tags()` function, which only recognizes a tag if the opening bracket is immediately followed by a letter, with no space in between. Attackers can exploit this flaw by injecting a payload of HTML code, such as ``, into the error message. This allows the malicious HTML code to sail through `strip_tags()` untouched.
However, when the injected HTML code reaches WordPress's separate sanitizer, `wp_kses_post()`, it gets interpreted as a legitimate HTML element and rendered as real, live HTML. This is where the attackers can get creative with their exploit. They find that the login page also loads a script meant for the profile page, `user-profile.js`, on the login page too, purely because the login page also handles password resets.
The script watches for a password-reset button and auto-clicks it, and thanks to the injected DOM elements, it finds one that isn't supposed to exist. The click event triggers a chain of events that eventually resolves an undefined JavaScript variable, `ajaxurl`, using a browser quirk: any HTML element with a matching `id` attribute automatically becomes accessible as a property on the `window` object.
The injected `` element becomes the value assigned by the browser to `window.ajaxurl`, allowing the attacker to control how the script handles the request. The request lands on WordPress's REST API, which is tricked into responding as JSONP, wrapping the reply in a callback function name controlled by the attacker. This allows the attackers to walk a full property chain across browser windows.
The researchers reused a technique first published in 2022 to turn this into a cross-window click, one that fires inside an actual logged-in administrator's session rather than the attacker's own. The next step is to orchestrate a sequence of events to open a hidden window, navigate the admin's browser to WordPress's own application-password approval screen, and trigger the cross-window click on the approve button using the admin's real session cookies and nonces.
This hands the attacker a valid Application Password for the admin account, which WordPress's REST API happily accepts over HTTP Basic auth from any origin. The attackers can then make authenticated cross-origin API calls, publish a page containing attacker JavaScript, and upload and execute a plugin containing arbitrary PHP.
The researchers demonstrated that the entire exploit chain works pre-authentication, requires zero user interaction beyond visiting a link, and reliably ends in remote code execution on a stock WordPress install.
WordPress responded quickly to this discovery by moving fast once notified, shipping version 7.0.3 on August 6, which backports the fix all the way to WordPress 4.7. The researchers reported the chain on July 27. If you're running WordPress and haven't updated yet, it's strongly recommended to do so as soon as possible.
Related Information:
https://www.ethicalhackingnews.com/articles/WordPress-XSS2Shell-Flaw-A-Critical-Vulnerability-Exploited-for-Full-Server-Takeover-ehn.shtml
https://securityaffairs.com/196820/hacking/wordpress-xss2shell-flaw-turns-simple-login-bug-into-full-server-takeover.html
Published: Fri Aug 7 12:16:09 2026 by llama3.2 3B Q4_K_M
