wp2r00t - WordPress REST Batch Route-Confusion SQLi PoC

A self-contained proof-of-concept for the unauthenticated blind SQL injection reachable through the WordPress REST batch endpoint (/wp-json/batch/v1). It is an independent implementation built from the published vulnerability mechanics.

Official Advisory: WordPress Security Release | CVE-2026-63030

Author: J4ck3LSyN
Authorities: CFSD, NFK & C4b1NKr3W

Note: I did not ship this with the associated weaponized r00t.py persistence implant due to obvious legalities. To abtain it, you can DM me on x

[!WARNING]
This code is provided AS IS for educational and research purposes only. Do not use this PoC on production systems, shared environments, or any unauthorized targets.

• Running or hosting this code may trigger antivirus detections, security monitoring alerts, or legal consequences if misused.
• The authors and repository maintainers assume no liability for any damage, misuse, or illegal activity resulting from this code.
• Use exclusively in isolated lab environments with proper authorization. Intended for defensive research, vulnerability analysis, and blue-team testing only.

Repository Contents

• poc.py - Main Proof-of-Concept CLI (check, read, shell modes)
• val.py - Lightweight passive vulnerability validator (val.py <target>)
• MITIGATIONS.md - Comprehensive mitigation and hardening guide
• LETHALITY.html - Visual Capability Lethality Matrix (heatmap + kill chain)
• LICENSE - MIT License
• r00t.py:redacted - Main implant orchestrator (ties everything together)
• modules/ - Post-exploitation implant modules

Modules:

• exploit.py - Core exploitation logic (SQLi + RCE primitive)
• privesc.py:redacted - Local privilege escalation checks (DirtyCOW, sudo, capabilities, etc.)
• lpe_byond.py:redacted - Advanced LPE using BYOVD + eBPF techniques (operator-gated)
• recon.py:redacted - Host profiling and enumeration
• persistence.py:redacted - Persistence mechanisms (systemd, cron, SSH keys)
• c2.py:redacted - Encrypted C2 beacon (HTTPS + DoH)
• exfil.py:redacted - Credential harvesting and data exfiltration
• stealth.py:redacted - Anti-analysis, sandbox detection, and obfuscation

Affected Versions

See the official WordPress security releases for details.

1. Vulnerability Mechanics

The batch endpoint dispatches several sub-requests in one call, validating and permission-checking each independently. When a sub-request path fails wp_parse_url(), it is appended to the validation array but not to the matched-handler array. The two arrays fall out of step, and a later sub-request is dispatched under a different sub-request's handler. That is the route confusion.

This PoC nests the primitive twice:

1. Outer desync. A POST /wp/v2/posts request that carries a requests body is dispatched under the batch handler itself. Having been validated as a posts request, its inner requests list is never re-checked against the batch schema, so the inner sub-requests may use GET (method allow-list bypass).
2. Inner desync. Inside that inner batch, a GET /wp/v2/users request carrying author_exclude=... is dispatched under posts get_items(). The users collection schema has no author_exclude parameter, so the value passes validation untouched. posts get_items() maps author_exclude to the WP_Query author__not_in query var, which vulnerable builds interpolate into SQL as a raw string.

The net sink is a pre-authentication boolean / time-based blind SQL injection:

... post_author NOT IN (<value>) ...

A value of 0) <sql>-- - closes the IN() list and appends arbitrary SQL.

2. Safety Model

The PoC is fail-closed. Three runtime gates prevent accidental or out-of-scope execution. All are enforced in modules/exploit.py; the CLI in poc.py only threads them through.

• AuthorizationError is raised in BatchClient._ensure_authorized(), AdminSession._ensure_authorized(), and AdminSession._ensure_r00t().
• BatchClient._count() enforces --max-requests before the socket opens.
• --r00t is the capability separator: a build shipped without it cannot deploy or execute a webshell.

Credential handling for shell: admin username/password resolve from --user / --password, or environment variables / a secure file.

3. Installation

git clone https://github.com/J4ck3LSyN-Gen2/CVE-2026-63030-wp2r00t.git
cd CVE-2026-63030-wp2r00t
python3 -m py_compile modules/exploit.py poc.py   # basic sanity check

Requirements: Python 3.11+, standard library only (no pip dependencies).

4. CLI

python3 poc.py <command> <url> [flags]

Common flags (all subcommands):

--authorized            Assert you own / are authorized to test <url>. Required to send.
--noop                  Build/validate payloads without sending (no network contact).
--max-requests N        Hard cap on requests to the target.
--rest-route            Use /?rest_route=/batch/v1 instead of /wp-json/batch/v1.
--timeout FLOAT         Request timeout (default 30).
--proxy URL             HTTP(S) proxy.
--insecure              Disable TLS certificate verification.

Available Commands

• check - Confirm vulnerability (non-destructive)
• read - Blind SQL extraction
• shell - Post-auth webshell helper (requires --r00t)
• validate - Passive identifier

Quick Reference

Full command documentation is available in the original detailed sections (or run python3 poc.py --help).

5. Architecture & OPSEC

• Randomized inter-request delay (jitter) and varied per-sample SLEEP values defeat fixed-cadence / fixed-delta WAF/NDR behavioral analytics.
• Default concurrency is 1 (strictly sequential).
• Commands travel in the POST body, not the URL.
• Per-session randomized webshell slug, token, and output marker.

The post-exploitation modules (recon, privesc, exfil, persistence, stealth, c2, lpe_byond) and r00t.py form a separate implant chain that is not part of the network-facing PoC and is intentionally excluded from shared builds. They are out of scope for this document.

6. License

This project is licensed under the MIT License. See LICENSE for details.

Disclaimer: Use only on systems you own or are explicitly authorized to test. The authors assume no liability for any misuse.