mrx-arafat/cve-2026-63030-pocProof-of-concept exploit for CVE-2026-63030 (WordPress pre-auth RCE) with SQL injection detection, credential extraction, and webshell deployment. Includes 8-stage exploitation workflow and remediation guidance.
📖 Read the full technical analysis first: CVE-2026-63030: WordPress Pre-Auth RCE Explained
This repository contains the proof-of-concept exploit referenced in that article. Start with the blog to understand the vulnerability, limitations, and reproduction process.
| Aspect | Details |
|---|
| Vulnerability | CVE-2026-63030 (route confusion) + CVE-2026-60137 (SQL injection) |
| Type | Pre-authentication Remote Code Execution |
| CVSS Score | 9.8 (Critical) |
| Affected Versions | WordPress 6.9.0–6.9.4, 7.0.0–7.0.1 |
| Fixed In | WordPress 6.9.5, 7.0.2+ |
| Impact | 500M+ WordPress sites potentially affected |
| Preconditions | None — works on stock WordPress installations |
This repository contains:
wordpress-rest-exploit.py — Single-file Python exploit tool (1,005 lines, no dependencies)README.md — This file with setup and usagePOC.md — Detailed step-by-step reproduction guide with real examplesLICENSE — MIT LicenseBefore using this exploit, understand the critical limitation that makes this vulnerability different from how it's been reported:
The vulnerability chain is real and critical. However:
Why? WordPress allows custom database table prefixes. Default is wp_, but most security-hardened sites use bw1w_, wordpress_, or random strings. Without knowing the prefix, hash extraction fails silently.
The blog article explains:
./wordpress-rest-exploit.py
The tool will guide you through:
CVE-2026-63030: WordPress REST Batch Route-Confusion SQLi
------------------------------------------------------------
Target URL: https://example.com/
[*] Checking if target is vulnerable to CVE-2026-63030...
[+] WordPress 7.0 detected (AFFECTED VERSION)
[+] VULNERABLE - batch route-confusion behavior confirmed
What would you like to do?
1) Read database fingerprint
2) Extract WordPress user logins and password hashes
3) Execute custom SQL query
4) Deploy plugin webshell (requires admin credentials)
5) Confirm SQL injection with timing payload
6) Exit
Select option [1]:
This is essential to understand before using the exploit.
WordPress allows custom database table prefixes for security hardening. The exploit tool cannot automatically detect the prefix.
✅ Default prefix (wp_): Exploitation works
❌ Custom prefix (bw1w_, etc.): Exploitation fails silently
When the tool asks for table prefix:
Option 1: You Know the Prefix
Database table prefix [wp_]: bw1w_
[+] Querying bw1w_users...
[+] Found credentials!
Option 2: Guess Common Prefixes
wp_ (default)wordpress_bw1w_ (popular hardening)wpdb_Option 3: Direct Access
If you have SSH access or can read wp-config.php:
$table_prefix = 'bw1w_'; // Found it!
Option 4: Brute-Force via SQLi The tool can attempt common prefixes through blind SQL injection (slow but possible).
SLEEP(3) payloadwp_users table (or custom prefix)For detailed reproduction with real command output and examples, see:
👉 POC.md — Complete 8-stage walkthrough
This guide includes:
Update immediately (highest priority):
# Update to patched versions
WordPress 7.0.2 or 6.9.5
If immediate update impossible:
Block batch endpoint at WAF/reverse proxy:
Block: /wp-json/batch/v1
Block: /?rest_route=/batch/v1
Or disable REST API entirely (less ideal):
// Add to wp-config.php or mu-plugins
add_filter('rest_endpoints_enabled', '__return_false');
Or require authentication:
add_filter('rest_pre_dispatch', function($response) {
if (strpos($_SERVER['REQUEST_URI'], '/batch/v1') !== false) {
if (!is_user_logged_in()) {
return new WP_Error('rest_batch_unauthenticated', 'Forbidden', ['status' => 401]);
}
}
return $response;
}, 10, 1);
| Finding | Impact |
|---|---|
| Vulnerability detection works perfectly | Easy to identify affected sites |
| SQL injection is reliable | Database access is guaranteed (if prefix known) |
| Table prefix is the bottleneck | 70% of production sites are protected |
| Blind SQLi is slow | 30+ minutes for complete extraction |
| Post-auth RCE works seamlessly | Full system compromise once authenticated |
| Pre-auth RCE undisclosed | Searchlight Cyber didn't release the technique |
For authorized security testing only. Use exclusively against systems you own or have explicit written permission to test. No warranty is provided and no liability is accepted for misuse.
Research & Development: Easin Arafat
GitHub: @mrx-arafat
Website: arafatops.com
This proof-of-concept demonstrates the WordPress wp2shell vulnerability chain with practical exploitation techniques, vulnerability detection, and real-world testing results. Start with the blog article to understand the full context.
Last Updated: July 2026
License: MIT