# Evidence Scope and Vulnerability Scope Are Different Claims ## Claim "This affects all versions" and "this was proven exploitable on all versions" are separate claims, and a disclosure that states which one it actually demonstrated is doing real evidentiary work most vulnerability reporting skips. <!-- atomicity: 1 idea ✓ --> ## Scope & conditions - Holds for any multi-stage vulnerability chain where the root cause is universal but a demonstrated escalation depends on narrower, stated conditions. - The distinction matters most when the universal part (root-cause scope) and the conditional part (escalation scope) get reported together under one severity label or CVSS score, inviting readers to apply the broader scope to the narrower claim. - Doesn't diminish the severity of the universal part — patch regardless — it only prevents over- or under-reacting to the conditional part based on evidence that was never gathered for it. ## Evidence CVE-2026-64638 ("XSS2Shell") is a pre-auth XSS on WordPress's login page, reproduced live and cookie-less against two real WordPress 7.0.2 deployments — genuinely proven at "all versions" scope. The escalation into full PHP code execution via Application Passwords was demonstrated only on a clean local install, never attempted on the production sites. The reporting states this distinction directly rather than letting a reader infer it from the CVSS score or the "all versions affected" framing alone. > [!quote] "The production evidence supplied to The Hacker News stops at the XSS... The all-version scope therefore applies to the underlying XSS, not automatically to this specific PHP-execution path." ## Links - [[3. Resources/Permanent Notes/A Parser Disagreement Between Two Sanitizers Is the Exploitable Seam]] — evidence-for: the root-cause note for the same disclosure; that note covers *why* the bug exists, this one covers *how confidently different parts of the chain were actually proven* - [[3. Resources/Permanent Notes/A Safety Control That Cannot See Severity Becomes a Hazard]] — applies-in: a severity label collapsing distinct claims into one number is the same failure mode this note names for evidence scope - [[3. Resources/Permanent Notes/Vendor Usage Anecdotes Need Verification Before Adoption Decisions]] — contrasts: that note is about an anecdote standing in for evidence entirely; this note is about a disclosure that explicitly declines to let proven evidence stand in for unproven claims - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] ## Tests / falsifiers - Compare this disclosure against a sample of other CVE writeups for the same class of multi-stage chain — does the pattern of stating "proven here, not proven there" hold as a general trade-press practice, or is this an outlier? - If the escalation is later reproduced on production systems and disclosed, the earlier scoping should be revised rather than silently left as originally stated — track whether that update happens. ## Maintenance - Last tended: 2026-08-16 - Next review: 2026-11-16 ## Source - [[3. Resources/Readwise/Articles/New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP]] — The Hacker News, reporting pwn.ai's disclosure of CVE-2026-64638, patched WordPress 7.0.3.