Attack Chain

The core is not "stacked writes to the database", but rather:

1. In serve_batch_request_v1(), the validation phase and the dispatch phase are out of sync on the $matches / $validation indices, leading to route confusion.
2. After misalignment, the string-form author_exclude enters WP_Query's author__not_in, is concatenated into NOT IN (...), forming a SQL injection.
3. Through a UNION SELECT, forge a complete wp_posts row, triggering oEmbed / Customizer logic to switch the current user context to an existing administrator.
4. As the administrator, call the REST user creation endpoint to insert a new administrator.
5. Log in to the backend, upload a plugin, achieve command execution.

Requirements

• Python 3.10+ (standard library only, no third-party dependencies)
• Target is a WordPress instance you are authorized to test
• Target PHP must have at least one executable function enabled (proc_open / passthru / system / shell_exec / exec / popen)
• If disable_functions disables all command execution functions, admin creation can still succeed, but the RCE phase will fail.

File Structure

Usage

Minimal usage (auto-generates admin, executes id by default)

Custom all parameters

Parameter description

Expected output example

After completion, the script will attempt to:

1. Delete the administrator created in this run
2. Delete the temporary plugin directory

If it fails midway, manually clean up using the credentials shown in the output.

Notes

1. Authorized environment only: Do not use against unauthorized systems.
2. Target restriction: By default, the script rejects targets with public IP literal addresses; it only allows private / loopback / link-local addresses, or domain name targets.
3. PHP hardening: If you see has been disabled for security reasons, it means disable_functions has disabled the corresponding function. The PoC will try multiple execution methods in order; if all are disabled, RCE is unavailable, but the admin creation phase may still succeed.
4. Site content: At least one published post or page is required to seed the oEmbed cache.
5. Idempotency and cleanup: Each run creates a new administrator and temporary plugin; on success it is automatically cleaned up. On failure, manually check wp-admin/users.php and wp-content/plugins/.

Remediation advice

• Upgrade to the official patched version (subject to WordPress security announcements)
• When a patch is not available, temporarily restrict unauthorized access to /batch/v1
• In production, keep disable_functions and minimal-privilege web user configuration to reduce the impact of RCE exploitation

Disclaimer

The code in this repository is intended only for security research and authorized vulnerability reproduction. Users must ensure compliance with local laws and the authorization scope of the target system. The author is not responsible for any misuse.