industri4l-h3ll-xpl0it3rs/cve-2026-63030-wp2shellCVE-2026-63030 Exploit | by gr1tx
xpl0ited by gr1tx
WP2Shell is a Python-based Proof-of-Concept (PoC) for CVE-2026-63030.
It performs time-based vulnerability verification against the WordPress Batch API and generates detailed HTML and JSON reports.
The project is intended for authorized security assessments, penetration testing, vulnerability validation, and research purposes.
Clone the repository:
git clone https://github.com/Industri4l-H3ll-Xpl0it3rs/CVE-2026-63030-WP2Shell/blob/main/CVE-2026-63030.py
Install dependencies:
pip install requests urllib3
python3 CVE-2026-63030.py --help
Example:
usage: CVE-2026-63030.py [options] target_file
Options:
--threads
--sleep
--retries
--timeout
--delay
--max-targets
--output
--insecure
--verbose
--authorized
Help:
└─$ python3 CVE-2026-63030.py --help
usage: CVE-2026-63030.py [-h] [--threads THREADS] [--sleep SLEEP]
[--retries RETRIES] [--timeout TIMEOUT]
[--delay DELAY] [--max-targets MAX_TARGETS]
[--output OUTPUT] [--insecure] [--verbose]
[--authorized]
target_file
WP Batch SQLi Auditor — safe time-based SQL injection testing for authorized
assessments. by gr1tx
positional arguments:
target_file File containing a list of URLs
options:
-h, --help show this help message and exit
--threads THREADS
--sleep SLEEP
--retries RETRIES
--timeout TIMEOUT
--delay DELAY
--max-targets MAX_TARGETS
--output OUTPUT
--insecure Disable TLS verification
--verbose, -v
--authorized Confirm that authorization for testing has been obtained
Basic scan:
python3 CVE-2026-63030.py targets.txt --authorized
Verbose mode:
python3 CVE-2026-63030.py targets.txt --authorized --verbose
Custom report:
python3 CVE-2026-63030.py targets.txt --authorized --output report
Generated files:
report.json
report.html
This software and proof-of-concept code is provided for educational and research purposes only.
You are responsible for obeying all applicable laws. Use ethically and responsibly.