Tools

g0d150ne/wp2shell

Modular WordPress pre-auth exploit framework chaining SQL injection and authentication bypass to deliver remote code execution, interactive shells,…

joaoaugustom/wordpress_backup_migration-rce_unauthenticated

This exploit is based on CVE-2023-6553 and was built upon the original exploit by Chocapik, it was added that a direct reverse shell can be obtained.

colere-sys/wp2shell-poc

Analysis and end-to-end implementation of the patched wordpress RCE vulnerability - CVE-2026-60137 and CVE-2026-63030

attackercan/wp2shell-poc2

CVE-2026-63030

87achrafg-stack/cve-2026-49083

Python exploit for CVE-2026-49083, a privilege escalation vulnerability in the LatePoint Calendar Booking WordPress plugin, enabling unauthorized…

izxci/cve-2026-49083

Python exploit for CVE-2026-49083 targeting privilege escalation in the LatePoint Calendar Booking WordPress plugin. Provides automated exploitation…

b4d-53ct0r/cve-2025-3616

Metasploit module exploiting arbitrary file upload in Greenshift WordPress plugin (CVE-2025-3616) to achieve RCE via MIME spoofing, with…

bahaabdelwahed/killshot

A Penetration Testing Framework, Information gathering tool & Website Vulnerability Scanner

trex96/vulnerable-bsr-lab-cve-2023-6933

Hands-on lab for CVE-2023-6933, a PHP Object Injection vulnerability in Better Search Replace WordPress plugin, with Docker deployment, nuclei…

abdurahmon3236/cve-2024-6366

Metasploit exploit module for CVE-2024-6366, an unauthenticated file upload remote code execution in WordPress User Profile Builder before 3.11.8,…

abdurahmon3236/-cve-2024-31211

Metasploit module that exploits a WordPress unserialization vulnerability (CVE-2024-31211) in WP_HTML_Token to achieve remote code execution.

moham3driahi/xattacker

X Attacker Tool ☣ Website Vulnerability Scanner & Auto Exploiter

akucybersec/cve-2022-1329-wordpress-elementor-3.6.0-3.6.1-3.6.2-remote-code-execution-exploit

Exploit for CVE-2022-1329, a WordPress Elementor plugin RCE vulnerability, allowing authenticated users to upload and execute arbitrary PHP files via…

nate0634034090/nate158g-m-w-n-l-p-d-a-o-e

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class…

0dayninja/cve-2021-24155.rb

WordPress Backup Guard Authenticated Remote Code Execution Exploit

tegal1337/nekobotv1

NekoBot | Auto Exploiter With 500+ Exploit 2000+ Shell

rastating/wordpress-exploit-framework

A Ruby framework designed to aid in the penetration testing of WordPress systems.

dsfau/wordpress-cve-2018-6389

Metasploit module for WordPress DOS load-scripts.php CVE-2018-638