Share
## https://sploitus.com/exploit?id=39999FC8-B38B-56EC-BF13-B4558FA74FE8
# wp2shell-check

Non-intrusive exposure checker for the WordPress **"wp2shell"** pre-authentication RCE chain
(CVE-2026-63030 + CVE-2026-60137).

> โš ๏ธ **Authorized use only.** Run this only against WordPress instances you own or have explicit
> permission to test. It is a triage aid, not an exploit. Scanning systems without permission may be illegal.

---

## What it does

Given a URL, `wp2shell-check`:

1. Reads the WordPress version from the `generator` meta tag on the homepage (passive).
2. Compares it against the versions affected by the wp2shell chain.
3. Sends a single benign probe to the REST batch endpoint (`?rest_route=/batch/v1`) to check whether
   the REST batch route is reachable.
4. Prints a one-line verdict.

It is designed for fast fleet triage: _which of my sites are on an affected version with REST reachable?_

## What it does **not** do

- It does **not** send SQL injection payloads or trigger the route-confusion bug.
- It does **not** confirm exploitability. The route probe only tells you the batch route is registered
  and validating input โ€” which is true of virtually any default install with the REST API enabled
  (the batch endpoint has been in core since WordPress 5.6). **The version check is the load-bearing signal.**
- It is a reachability + version heuristic, not a proof-of-concept.

---

## The vulnerability (wp2shell)

Two chained WordPress Core flaws, disclosed with an emergency release on **2026-07-17**:

| CVE            | Type                                         | Affected versions                              |
| -------------- | -------------------------------------------- | ---------------------------------------------- |
| CVE-2026-63030 | REST API batch-route confusion (RCE enabler) | 6.9.0โ€“6.9.4, 7.0.0โ€“7.0.1                       |
| CVE-2026-60137 | `WP_Query` `author__not_in` SQL injection    | 6.8.0 and later (6.8.0โ€“6.8.5 = SQLi-only band) |

Chained, they let an **unauthenticated** attacker reach SQL injection and escalate to **remote code
execution** on a default install โ€” no plugins, no login. The RCE half only applies when a persistent
object cache is **not** in use.

**Fixed in:** 6.8.6 (SQLi only), 6.9.5, 7.0.2 (and 7.1 Beta 2+). WordPress enabled forced
auto-updates for affected sites โ€” verify the update actually landed.

Reported by Adam Kues (Assetnote / Searchlight Cyber) via WordPress's HackerOne program.

---

## Install

Requires Python 3.9+ and `requests`.

```bash
# with uv
uv pip install requests

# or plain pip
pip install requests
```

## Usage

```bash
python wp2shell.py https://target.example
```

Example output:

```
https://target.example: VULNERABLE (RCE) [6.9.3]
```

## Interpreting the output

| Verdict                                     | Meaning                                                                                                |
| ------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
| `VULNERABLE (RCE)` / `VULNERABLE (SQLi)`    | Affected version **and** REST batch route reachable โ†’ exposed on a default install. See _Limitations_. |
| `version-affected (...), route unconfirmed` | Version is in an affected band, but the REST batch route did not respond as expected.                  |
| `not affected`                              | WordPress detected, version outside the affected bands.                                                |
| `wordpress not detected`                    | No version found (REST locked down, `generator` tag removed, or not WordPress).                        |
| `unreachable`                               | Host did not respond.                                                                                  |

---

## Limitations

- **"VULNERABLE" is an exposure signal, not a confirmation.** It means _affected version + REST reachable_.
  It does not prove the route-confusion / injection is exploitable on that specific host.
- **Persistent object cache.** The RCE requires that no persistent object cache is in use. A site can be
  in the affected band yet not RCE-exploitable - and this tool cannot detect that remotely.
- **Version detection is best-effort.** The `generator` tag is often removed or spoofed; a missing version
  yields `wordpress not detected`, not a guarantee that the site is safe or non-WordPress.
- **Single URL per run.** No batch input, rate limiting, or output formats beyond the console line.

## Remediation

1. Update to **6.8.6**, **6.9.5**, or **7.0.2** (or newer) for your branch, and confirm the update applied.
2. If you can't patch immediately, block `/wp-json/batch/v1` and `?rest_route=/batch/v1` at your WAF,
   or restrict anonymous access to the REST API.

---

## Disclaimer

Provided as-is, for authorized security testing and educational purposes only. You are solely responsible
for how you use it.

## References

- WordPress security release, 6.9.5 / 7.0.2 (2026-07-17)
- Cloudflare โ€” WAF protections for the WordPress vulnerabilities
- The Hacker News โ€” wp2shell coverage
- ZeroSec (zsec.uk) โ€” wp2shell code-trace deep dive