PoC: WP2Shell — CVE-2026-63030 & CVE-2026-60137

📌 Overview

WP2Shell is a critical exploit chain in WordPress Core source code that allows a remote unauthenticated attacker to gain full control of the server (Full Server Takeover / RCE).

The exploit chain combines two security vulnerabilities:

1. CVE-2026-63030 (REST API Batch Route Confusion): Endpoint resolution conflict in the WordPress REST API batch handler, allowing a request to be authenticated against one route but executed on another, bypassing access control mechanisms (Authentication / Route Validation Bypass).
2. CVE-2026-60137 (SQL Injection in WP_Query): Improper input sanitization for the author__not_in parameter in WP_Query, leading to SQL Injection.

By chaining these two vulnerabilities, an attacker can send crafted HTTP requests to /wp-json/batch/v1, bypass authentication mechanisms, and trigger SQLi to escalate privileges, spawn a shell, and execute arbitrary code remotely (RCE).

📊 Vulnerability Details

🎬 Video Demo Proof-of-Concept (PoC Video)

A video recording the entire reproduction and real-world exploitation process is stored on Google Drive:

🔗 Link to view / download the PoC video: Google Drive - Video Demo WP2Shell PoC

📖 Detailed Writeup

The entire technical analysis flow, step-by-step PoC reproduction, and source code explanation are hosted on Notion:

🔗 Notion article link: WP2Shell CVE PoC Flow (Notion Writeup)

⚙️ Exploitation Flow

flowchart TD
    A["[Attacker] Unauthenticated Remote Request"] --> B["REST API Batch Endpoint (/wp-json/batch/v1)"]
    B --> C["CVE-2026-63030: Batch Route Confusion\n(Bypass Route Validation & Access Control)"]
    C --> D["CVE-2026-60137: SQL Injection\n(Unsanitized 'author__not_in' in WP_Query)"]
    D --> E["Database Manipulation / Privilege Escalation\n(Admin session / User creation)"]
    E --> F["Web Shell Upload / Execution"]
    F --> G["💥 Full Server Takeover (RCE)"]

🛡️ Mitigation

1. Update immediately: Upgrade WordPress Core to a secure version:
   • Branch 6.8.x: update to WordPress 6.8.6
   • Branch 6.9.x: update to WordPress 6.9.5
   • Branch 7.0.x: update to WordPress 7.0.2
2. Configure WAF / Web Server:
   • Temporarily block or strictly control requests to the /wp-json/batch/v1 endpoint from unauthenticated users if an immediate update is not possible.
3. Server forensics review:
   • Check web server logs for unusual requests sent to /wp-json/batch/v1.
   • Scan the wp-content/uploads/ and wp-content/plugins/ directories to detect web shells or suspicious files.

⚠️ Disclaimer

[!WARNING] This PoC documentation and source code are intended solely for security research, education, and system defense. The author assumes no responsibility for any unauthorized use of the information or tools in this repository to attack systems for which you do not have legitimate authorization.