raphy76/wp2shell-poc-fulljsfull javascript reproduction of CVE-2026-63030 (author_exclude, author__not_in and misalignment between validations and matches)
This project allows to reproduce the logical flow related to CVE-2026-63030 and CVE-2026-60137 leading to an sql injection serving as a base to finally trigger a RCE in WordPress.
The demonstration illustrates how these vulnerabilities can be chained to reach an SQL injection, which can then serve as a stepping stone toward triggering Remote Code Execution (RCE) in a WordPress environment.
Simply open the index.html file in your preferred web browser:
open index.html