CVE-2026-63030 - WordPress REST API Batch Route Confusion PoC

Description

Proof-of-concept exploit for CVE-2026-63030, a pre-authentication vulnerability in WordPress (versions 6.9.0 through 7.0.1). It chains:

• REST API batch route confusion (validation vs dispatch mismatch)
• SQL injection via author_exclude parameter
• oEmbed cache poisoning + Customizer changeset privilege escalation
• Admin user creation
• Plugin upload for remote command execution

Requirements

• Python 3.10+
• Target: WordPress 6.9.0 – 7.0.1 with at least one published post/page
• No external dependencies (only standard library)

Usage

python3 cve_2026_63030_exp.py --url http://target-wordpress.com/ --command "whoami"

Options

Example

# Auto-exploit with random admin credentials and run 'id'
python3 exploit.py --url http://192.168.1.100/wordpress/

# Custom admin and command
python3 exploit.py --url https://vuln-site.com/ --username backdoor --password 'H4ckMe!' --command 'ls -la /var/www/html'

How it works (high-level)

1. SQLi – Sends a crafted batch request with a malicious author_exclude parameter, exploiting the route confusion to execute a UNION query.
2. Privilege escalation – Poisons the oEmbed cache, then uses the Customizer endpoint to create a new admin user via REST API.
3. RCE – Logs in as the new admin, uploads a minimal plugin that executes system commands via shell_exec().
4. Output – Prints the command result to stdout.

Disclaimer

This is a proof-of-concept only.
It is intended for:

• Security research
• Authorized penetration testing
• Local lab environments

Do not use against systems you do not own or have explicit written permission to test. The authors assume no liability for misuse.

Notes

• The exploit doesn't clean up the admin user or plugin after execution – handle that manually.
• If the target has WAF or hardended wp-config.php, the SQLi may fail.
• For best results, disable DISALLOW_FILE_MODS and DISALLOW_UNFILTERED_HTML in the target's config.