CVE-2026-63030 is a critical, unauthenticated vulnerability affecting the WordPress REST API. It exploits a route-confusion bug within the nested batch processing endpoint (/wp-json/batch/v1 or /?rest_route=/batch/v1).

The Root Cause

When WordPress processes a batch of REST API requests, it validates each sub-request against its specific schema before execution. However, due to a flaw in how the internal routing pointer handles deliberately malformed paths (e.g., ///), the validation schema becomes desynchronized from the actual execution handler.

The Attack Chain

1. Route Confusion & SQLi: An attacker injects a nested batch payload. The desync causes a request targeting the /wp/v2/users endpoint (which doesn't accept author_exclude) to be executed by the /wp/v2/posts handler. The unsanitized author_exclude parameter is passed directly into WP_Query's author__not_in clause, resulting in Unauthenticated SQL Injection.
2. Pre-Auth Admin Creation: The SQLi is used to read the database and identify oembed_cache post IDs. The exploit then uses a Customizer changeset payload to poison the navigation menu cache, tricking WordPress into executing a user-creation request under the context of an existing administrator.
3. Remote Code Execution (RCE): With a newly forged administrator account, the tool authenticates, uploads a randomized, token-gated PHP webshell plugin, executes OS commands, and securely cleans up all traces.

Affected Versions

• WordPress 6.9.0 through 6.9.4
• WordPress 7.0.0 through 7.0.1 (Note: Older versions may be vulnerable depending on specific plugin configurations and REST API backports).

🚀 Features

• Zero Dependencies: 100% Python 3 standard library. No pip install required.
• Single File Modular: All components (Client, SQLi, Exploit, Shell, CLI) are neatly organized in one portable script (exploit.py).
• Multi-Technique SQL Extraction: Automatically falls back through the fastest available methods:
  1. UNION-based: In-band extraction by forging a fake WP_Post row (1 request per value).
  2. Error-based: Leverages EXTRACTVALUE() XPATH errors if WP_DEBUG_DISPLAY is enabled.
  3. Blind Boolean/Timing: Binary search character extraction with configurable sleep delays.
• Automated Pre-Auth Bridge: No need for existing credentials; the tool creates its own administrator account on the fly.
• Ephemeral Webshell: Generates a unique plugin slug and cryptographically secure token. The shell refuses to execute without the token and self-destructs after use.
• Auto-Cleanup: Automatically deletes the forged administrator account and removes the webshell plugin directory upon exit.
• Interactive REPL: Provides a pseudo-terminal that maintains remote working directory state (cd support).

📦 Installation & Requirements

No third-party packages are required. Ensure you have Python 3.8 or higher installed.

💻 Detailed Usage & Options

The exploit is divided into three main sub-commands: check, read, and shell.

Global Options

These options apply to all sub-commands:

1. check - Vulnerability Detection

Safely probes the target to confirm the presence of the route-confusion markers and tests SQLi timing without extracting data.

2. read - Database Extraction

Extracts data directly from the database via the SQL injection.

3. shell - Remote Code Execution

Deploys the webshell and executes commands. If no credentials are provided, it automatically triggers the pre-auth admin creation bridge.

🖥️ Execution Evidence & Examples

Below are real-world examples of the tool in action.

Example 1: Checking for Vulnerability

Example 2: Extracting Database Fingerprint

Example 3: Dumping User Credentials

Example 4: Gaining an Interactive Shell (Pre-Auth)

Notice how the tool automatically creates an admin account, deploys the shell, and cleans up after exiting.

🧠 Technical Deep Dive

The Desync Primer

The core of the exploit relies on injecting _DESYNC_PRIMER = {"method": "POST", "path": "///"}. This invalid URL forces WordPress's internal routing to generate a WP_Error for the first sub-request. This shifts the internal pointer, causing the second sub-request to be validated against one schema but executed by the handler of the third sub-request. This smuggles the author_exclude parameter into the WP_Query.

UNION Fake-Post Primitive

Instead of slow blind SQLi, the tool uses a UNION SELECT to inject a fully formed, fake wp_posts row. By setting orderby=none and per_page=500, it prevents WP_Query from splitting the query. The injected post_title contains the hex-encoded result of the target SQL expression, wrapped in || delimiters, which is reflected directly in the REST API JSON response.

Webshell OpSec

The deployed PHP plugin is designed for high stealth:

• Randomized directory and filename (e.g., wp_a1b2c3d4.php).
• Requires a 32-character hex token (t) and command (c) via GET parameters.
• Uses hash_equals() to prevent timing attacks on the token.
• Automatically changes directory (chdir) to prevent path disclosure.
• Output is wrapped in EXPLOIT::...::END markers for clean parsing by the Python client.

🛡️ Mitigation & Remediation

1. Update WordPress: Immediately upgrade to WordPress 7.0.2 or later, which includes the patch for CVE-2026-63030.
2. Disable Batch Endpoint: If the batch endpoint is not explicitly required, disable it via a must-use plugin (mu-plugins):
   root@kitploit:~

   add_filter( 'rest_request_before_callbacks', function( $response, $handler, $request ) {
       if ( $request->get_route() === '/batch/v1' ) {
           return new WP_Error( 'rest_disabled', 'Batch endpoint disabled', array( 'status' => 403 ) );
       }
       return $response;
   }, 10, 3 );
   

3. Web Application Firewall (WAF): Implement rules to block:
   • Nested /batch/v1 requests containing author_exclude in the URI.
   • Requests containing UNION, SLEEP(), or EXTRACTVALUE in URL parameters.
   • Malformed paths like /// in REST API requests.
4. Disable WP_DEBUG_DISPLAY: Ensure WP_DEBUG_DISPLAY is set to false in wp-config.php to prevent error-based SQLi leakage.

📜 Credits & Acknowledgments

• Vulnerability Research & Exploit Development: Ch4120N
• Concept Inspiration: WordPress REST API route confusion, oEmbed cache poisoning, and Customizer changeset primitives.

"With great power comes great responsibility. Use this knowledge to defend, not to destroy."
— Ch4120N