English | فارسی

🛡️ Abdal CVE-2026-60137 PoC Exploits

Abdal CVE-2026-60137 is a defensive WordPress exposure verifier for the insufficient sanitization of the author__not_in parameter in WP_Query, tracked as CVE-2026-60137. The vulnerability can allow SQL injection when untrusted input reaches the affected parameter. On affected WordPress 6.9 and 7.0 releases, it can be chained with CVE-2026-63030 as part of the wp2shell remote code execution path.

The tool helps administrators and authorized security teams identify potentially affected WordPress versions and suspicious REST batch endpoint exposure without attempting to prove SQL injection through a destructive database payload.

🎯 Why This Tool Was Created

Version discovery and endpoint behavior can provide rapid defensive triage across many WordPress installations. This verifier combines those signals into clear verdicts so administrators can prioritize patching and follow-up inspection.

⚠️ Affected and Fixed Versions

For WordPress 6.8.x, the published issue concerns the facilitated SQL injection. The complete wp2shell chain involving CVE-2026-63030 applies to the affected 6.9.x and 7.0.x branches.

✨ Features

• Scans a single URL or a file containing multiple URLs.
• Uses concurrent workers for efficient bulk verification.
• Detects the WordPress version when it is publicly discoverable.
• Checks both /wp-json/batch/v1 and /?rest_route=/batch/v1 as defensive exposure signals.
• Supports configurable worker count, HTTP timeout, User-Agent, and TLS verification.
• Limits response-body reads and redirect depth for safer operation.
• Displays colored per-target results with version, endpoint, HTTP state, elapsed time, and details.
• Prints a categorized summary after each scan.
• Supports starting another scan without restarting the application.
• Classifies results as VULNERABLE, AFFECTED, AFFECTED-WAF, PATCHED, NOT-AFFECTED, UNKNOWN, NOT-WORDPRESS, INVALID, or ERROR when applicable.

🚀 Usage

Run executable:

Then follow the interactive prompts:

1. Select a single target or a text file containing targets.
2. Enter the URL or file path.
3. Configure workers, timeout, User-Agent, and TLS verification.
4. Review the per-target verdicts and final summary.
5. Choose whether to start another scan or exit.

Example target file:

https://wordpress.example
https://blog.example

Only scan systems you own or are explicitly authorized to assess.

🧭 Result Interpretation

[!IMPORTANT] The verdict is a heuristic exposure assessment. It is not standalone proof that SQL injection succeeded or that a target was compromised.

🔧 Remediation

• Update WordPress 6.8.x to 6.8.6 or later.
• Update WordPress 6.9.x to 6.9.5 or later.
• Update WordPress 7.0.x to 7.0.2 or later.
• Confirm the installed version after the update instead of assuming automatic updates completed.
• Review custom plugins and themes that pass untrusted data into WP_Query, especially the author__not_in parameter.
• Review REST API and database error logs, file integrity, administrative accounts, and unexpected scheduled tasks.
• Patch CVE-2026-63030 on affected 6.9.x and 7.0.x systems to break the disclosed wp2shell chain.
• Treat WAF protection as defense in depth, not as a substitute for the vendor patch.

⚖️ Disclaimer

This software is provided solely for lawful defensive security testing, asset-owner verification, education, and authorized research. You are responsible for obtaining permission before scanning any system and for complying with all applicable laws, contracts, and policies.

The software and its results are provided as is, without warranties or guarantees of accuracy, availability, fitness for a particular purpose, or absence of false positives and false negatives. The programmer and contributors are not responsible for misuse, service disruption, data loss, security incidents, or any direct or indirect damages arising from use of this project.

🔗 References

• WordPress Security Advisory GHSA-fpp7-x2x2-2mjf
• WordPress 7.0.2 Security Release
• NVD: CVE-2026-60137

🐛 Reporting Issues

If you encounter any issues or have configuration problems, please reach out via email at [email protected]. You can also report issues on GitLab or GitHub.

❤️ Donation

If you find this project helpful and would like to support further development, please consider making a donation:

• Donate Here

🤵 Programmer

Handcrafted with Passion by Ebrahim Shafiei (EbraSha)

• E-Mail: [email protected]
• Telegram: @ProfShafiei
• GitHub: ebrasha

📜 License

This project is licensed under the AGPLv3 License.