Exploit for CVE-2026-63030

## https://sploitus.com/exploit?id=38EFFE6B-72A1-527E-B5A3-881D88E071F7
# CVE-2026-63030 - WordPress REST API Batch Route Confusion PoC

## Description
Proof-of-concept exploit for CVE-2026-63030, a pre-authentication vulnerability in WordPress (versions 6.9.0 through 7.0.1). It chains:
- REST API batch route confusion (validation vs dispatch mismatch)
- SQL injection via `author_exclude` parameter
- oEmbed cache poisoning + Customizer changeset privilege escalation
- Admin user creation
- Plugin upload for remote command execution

## Requirements
- Python 3.10+
- Target: WordPress 6.9.0 – 7.0.1 with at least one published post/page
- No external dependencies (only standard library)

## Usage
```bash
python3 cve_2026_63030_exp.py --url http://target-wordpress.com/ --command "whoami"
```

### Options
| Argument | Description |
|----------|-------------|
| `--url` | Target WordPress root URL (required) |
| `--username` | Admin username to create (auto-generated if omitted) |
| `--password` | Admin password (auto-generated if omitted) |
| `--email` | Admin email (auto-generated if omitted) |
| `--command, -c` | Command to execute via plugin (default: `id`) |
| `--post-id` | Specify a published post ID (auto-detected if omitted) |
| `--timeout` | HTTP timeout in seconds (default: 60) |

### Example
```bash
# Auto-exploit with random admin credentials and run 'id'
python3 exploit.py --url http://192.168.1.100/wordpress/

# Custom admin and command
python3 exploit.py --url https://vuln-site.com/ --username backdoor --password 'H4ckMe!' --command 'ls -la /var/www/html'
```

## How it works (high-level)
1. **SQLi** – Sends a crafted batch request with a malicious `author_exclude` parameter, exploiting the route confusion to execute a UNION query.
2. **Privilege escalation** – Poisons the oEmbed cache, then uses the Customizer endpoint to create a new admin user via REST API.
3. **RCE** – Logs in as the new admin, uploads a minimal plugin that executes system commands via `shell_exec()`.
4. **Output** – Prints the command result to stdout.

## Disclaimer
**This is a proof-of-concept only.**  
It is intended for:
- Security research
- Authorized penetration testing
- Local lab environments

Do not use against systems you do not own or have explicit written permission to test. The authors assume no liability for misuse.

## Notes
- The exploit doesn't clean up the admin user or plugin after execution – handle that manually.
- If the target has WAF or hardended `wp-config.php`, the SQLi may fail.
- For best results, disable `DISALLOW_FILE_MODS` and `DISALLOW_UNFILTERED_HTML` in the target's config.

---