CVE-2026-63030-CVE-2026-60137

Pre-auth RCE proof-of-concept chaining a WordPress REST batch API auth bypass with WP_Query SQL injection to dump hashes, add admin users, or plant a webshell.

The end result: a shell on the box, a rogue administrator account, or a dumped credential hash — all from a single unauthenticated POST request.

Affected versions: WordPress 6.9.0, 6.9.1, 6.9.2, 6.9.3, 6.9.4, 7.0.0, 7.0.1 Fixed in: WordPress 6.9.5 / 7.0.2 (patch released alongside coordinated disclosure)

Vulnerability Analysis

CVE-2026-63030 — REST Batch API Array Desync (Auth Bypass)

Background

WordPress 5.6 introduced the batch processing endpoint at /wp-json/batch/v1. It allows authenticated REST clients to bundle multiple sub-requests into a single HTTP round-trip. Each sub-request is independently validated and dispatched by WP_REST_Server::serve_batch_request_v1().

The Vulnerable Code Path

Inside serve_batch_request_v1() (simplified):

Why It Breaks

The two arrays ($responses and $matches) are expected to stay in sync — one entry per sub-request, same index. When sub-request [0] fails wp_parse_url(), it adds an entry to $responses but not to $matches. After the first loop:

Loop 2 then dispatches $matches[0] and writes the result to $responses[0]. It is dispatching request[1] but overwriting index 0 in responses — and critically, it uses the permission context that was computed as part of the failed request[0]'s error handling, not the permission context for the target endpoint.

The practical effect: any endpoint that requires authentication (including endpoints that perform SQL queries) can be called without credentials.

The Trigger

The string ://\x00 is a valid Python string but an invalid URL in PHP's wp_parse_url() wrapper (the null byte causes the parse to fail, returning false rather than a WP_Error, which makes the is_wp_error() guard useless — only $parsed === false catches it, and the array alignment is already broken by that point).

CVE-2026-60137 — WP_Query author__not_in SQL Injection

Background

The WordPress REST API for posts (/wp/v2/posts) exposes an author_exclude query parameter that maps directly to WP_Query's author__not_in argument. WP_Query is the core database abstraction used for nearly every content query in WordPress.

The Vulnerable Code Path

In WP_Query::parse_query() (simplified):

Later in WP_Query::get_posts():

Why It Breaks

The sanitization only fires when $author__not_in is an array. PHP's type system determines this based on how the value arrived:

• JSON body with array → PHP receives [1, 2, 3] → is_array() = true → sanitized
• URL query string → PHP receives "1,2,3" (a string) → is_array() = false → not sanitized

The REST endpoint accepts author_exclude from the URL query string. It arrives as a string. WP_Query skips the sanitization block, and the raw value is interpolated into the SQL WHERE clause.

Exploitation

The injection point lands inside a NOT IN (...) context:

Because the batch endpoint dispatches the sub-request as part of a larger query result, the UNION rows are returned in the REST JSON response body, making this a Boolean/UNION blind-free extraction — no timing, no out-of-band needed.

Exploit Chain

Requirements

Install dependencies:

Usage

Modes

Examples

Detection only — safe to run during scoping:

Dump admin hash:

Dump with debug output (shows raw HTTP responses — useful when WAF is involved):

Create rogue admin account:

Plant shell and drop to interactive prompt:

One-shot command execution (non-interactive):

Through Burp proxy:

Bypass Cloudflare with existing cf_clearance cookie:

Non-default table prefix:

Cloudflare Bypass Notes

The tool uses cloudscraper by default, which mimics a Chrome TLS fingerprint and automatically solves Cloudflare's JavaScript challenge (iuam mode). This covers most shared-hosting targets behind Cloudflare.

If the target uses Cloudflare's bot management (__cf_bm) or you already have a solved challenge cookie, pass it with --cookie "cf_clearance=..." to use a plain requests session instead.

The batch endpoint has two registered paths. WAF rules frequently block the standard path (/wp-json/batch/v1) but miss the legacy query-param path (/?rest_route=/batch/v1). The tool probes both automatically.

Troubleshooting

[-] Could not extract credentials

• Run with --debug to see the raw JSON response.
• Check table prefix with --prefix. Many installs use wp_ (default); some use custom prefixes.
• The target's content.rendered may be filtered. Try --mode adduser instead.

[-] OUTFILE failed

• SELECT INTO OUTFILE requires MySQL's FILE privilege on the DB user. This is common on shared hosting but usually disabled on cloud/managed databases (RDS, Cloud SQL, etc.).
• The webroot guess list covers common paths. If none match, check server headers or use --mode dump to read the path from config files.

[-] Target does not appear vulnerable

• The target may be patched (6.9.5+ or 7.0.2+).
• All batch paths may be WAF-blocked. Confirm manually: GET /wp-json/ and look for /batch/v1 in the routes key.

Patch Details

WordPress 6.9.5 / 7.0.2 addressed both CVEs:

• CVE-2026-63030: serve_batch_request_v1() now maintains a single unified array for both match data and responses, eliminating the index desync. Failed requests are tracked by index in the unified structure.

• CVE-2026-60137: WP_Query::parse_query() now casts author__not_in to an array unconditionally before sanitization, regardless of the input type:

  root@kitploit:~

  $author__not_in = array_map('absint', (array) $author__not_in);
  

CVSS Scores

Timeline

Legal

This tool is provided for authorized security testing and research only.

• Do not run against systems you do not own or have explicit written permission to test.
• Do not use in production environments without authorization.
• The authors are not responsible for any damage caused by misuse.

License

MIT License — see LICENSE

References

• WordPress Security Blog — 6.9.5 / 7.0.2 Release
• WP REST Batch API Source — class-wp-rest-server.php
• WP_Query Source — class-wp-query.php
• phpass — Portable PHP password hashing framework
• cloudscraper