wp2shell — WordPress REST API Time-Based Blind SQLi → RCE Proof‑of‑Concept

Description

poc_wp_tot.py is a proof‑of‑concept (PoC) to exploit a time‑based blind SQL injection vulnerability on the WordPress REST API batch endpoint, and perform an escalation chain up to Remote Code Execution (RCE).

Vulnerabilities tested:

• CVE-2026-63030
• CVE-2026-60137

Important warnings

• ONLY use this tool against systems you own or have explicit written permission to test. Misuse is potentially illegal and harmful.
• Author: GhostGTR666 (github.com/gagaltotal)
• PoC version: 1.0.0

Requirements

• Python 3.8+ (recommended)
• Network connection to the target WordPress
• Access to run the script in your testing environment

Installation

1. Clone or copy the poc_wp_tot.py file to your working directory.
2. (Optional) Create a virtual environment:

python3 -m venv venv
source venv/bin/activate

Usage

The script provides three operating modes: probe (detection), extract (retrieve data), and rce (execute commands). Here are usage examples.

Probe (check vulnerability):

python3 poc_wp_tot.py https://target.example.com/

Extract (get scalar values via time‑based blind SQLi):

python3 poc_wp_tot.py -v https://target.example.com/ "SELECT user_login FROM wp_users LIMIT 1"

RCE (execute remote commands — full exploit chain):

python3 poc_wp_tot.py https://target.example.com/ -c "id && uname -a"

Common options

• -h, --help : Display help message
• -v, --verbose: Enable verbose output (debug)
• -c <COMMAND> : RCE mode — execute shell command on target

Brief technical summary

• The script exploits the WordPress REST API batch endpoint to inject SQL payloads that cause the SLEEP() function to be executed on the target server as a boolean condition (time‑based blind SQLi).
• Using probing and extraction techniques based on binary search over response times, the script can extract strings and integers from the database.
• The exploit chain seeds an oEmbed entry via SQL payload, finds the generated post cache, composes a malicious changeset, creates a new administrator account, and uploads a PHP plugin that is executed for RCE.

Risks & mitigation

• This script can potentially make permanent changes to the WordPress installation (e.g., account creation, plugin upload). Ensure testing is done in a controlled environment (lab) and backups are available.
• Immediately update WordPress and plugins to the latest versions, restrict REST API access if not needed, and use a web application firewall solution.

Developer notes

• The main implementation and logic are in poc_wp_tot.py.
• To understand the full flow, see the calibrate(), get_scalar(), and exploit_rce() functions in the script.

License & attribution

• This PoC is provided as-is for educational/security testing purposes.
• Original author: GhostGTR666 — github.com/gagaltotal