Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
wordpress-batch-rce-lab — CVE-2026-63030: WordPress REST batch-endpoint array desync. Mechanism, detection, mitigation, and a safe reproduction lab. | Kitploit
Tools/GitHubGitHub/zenithgenius/wordpress-batch-rce-lab
Vulnerability AnalysisCode AnalysisExploitationWeb Application ExploitationWeb SecurityCTFPenetration TestingLearning & EducationLabs & Practice

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
GitHubzenithgenius/wordpress-batch-rce-lab

wordpress-batch-rce-lab

CVE-2026-63030: WordPress REST batch-endpoint array desync. Mechanism, detection, mitigation, and a safe reproduction lab.

View Repository
11 month agoNot yet reviewed

wp2shell: WordPress Batch RCE

A technical breakdown of CVE-2026-63030, a logic bug in WordPress core's REST API batch endpoint that lets an anonymous request dispatch under a different request's route and permission check, chaining into CVE-2026-60137 (SQL injection) for unauthenticated remote code execution on a stock install. Patched in WordPress 7.0.2 / 6.9.5, July 2026.

Disclosure. This writeup and lab were built after WordPress's public fix and Searchlight Cyber's public advisory. The array-desync mechanism is reproduced in full and safely: it needs only read-shaped requests to observe. The SQL-injection-to-RCE chain is described at a mechanism level only; no working exploit payload is published here.

The writeup

  1. The mechanism. How WP_REST_Server::serve_batch_request_v1() desyncs two parallel arrays, the exact one-line diff between vulnerable 7.0.1 and patched 7.0.2, and a live proof against genuinely vulnerable WordPress.
  2. Detection. Request fingerprint, access-log hunting queries, the PHP error-log tell.
  3. Indicators and mitigation. WAF rules (nginx/Apache/ModSecurity) and a drop-in mu-plugin.

The lab

batch-rce-lab/. Docker Compose running real, vulnerable WordPress 7.0.1. A safe HTTP proof toggles the running server between vulnerable and patched source and shows the response flip. A standalone PHP model reproduces the desync with no WordPress at all. Full run-through in batch-rce-lab/README.md.

Read online

Published via GitHub Pages: https://zenithgenius.github.io/wordpress-batch-rce-lab/

Credits

Vulnerability discovered by Adam Kues, Assetnote (Searchlight Cyber), reported via WordPress's HackerOne program. Writeup and lab by Isaac Joumessi. For educational and defensive use only.

Download Tool