## https://sploitus.com/exploit?id=39999FC8-B38B-56EC-BF13-B4558FA74FE8
# wp2shell-check
Non-intrusive exposure checker for the WordPress **"wp2shell"** pre-authentication RCE chain
(CVE-2026-63030 + CVE-2026-60137).
> โ ๏ธ **Authorized use only.** Run this only against WordPress instances you own or have explicit
> permission to test. It is a triage aid, not an exploit. Scanning systems without permission may be illegal.
---
## What it does
Given a URL, `wp2shell-check`:
1. Reads the WordPress version from the `generator` meta tag on the homepage (passive).
2. Compares it against the versions affected by the wp2shell chain.
3. Sends a single benign probe to the REST batch endpoint (`?rest_route=/batch/v1`) to check whether
the REST batch route is reachable.
4. Prints a one-line verdict.
It is designed for fast fleet triage: _which of my sites are on an affected version with REST reachable?_
## What it does **not** do
- It does **not** send SQL injection payloads or trigger the route-confusion bug.
- It does **not** confirm exploitability. The route probe only tells you the batch route is registered
and validating input โ which is true of virtually any default install with the REST API enabled
(the batch endpoint has been in core since WordPress 5.6). **The version check is the load-bearing signal.**
- It is a reachability + version heuristic, not a proof-of-concept.
---
## The vulnerability (wp2shell)
Two chained WordPress Core flaws, disclosed with an emergency release on **2026-07-17**:
| CVE | Type | Affected versions |
| -------------- | -------------------------------------------- | ---------------------------------------------- |
| CVE-2026-63030 | REST API batch-route confusion (RCE enabler) | 6.9.0โ6.9.4, 7.0.0โ7.0.1 |
| CVE-2026-60137 | `WP_Query` `author__not_in` SQL injection | 6.8.0 and later (6.8.0โ6.8.5 = SQLi-only band) |
Chained, they let an **unauthenticated** attacker reach SQL injection and escalate to **remote code
execution** on a default install โ no plugins, no login. The RCE half only applies when a persistent
object cache is **not** in use.
**Fixed in:** 6.8.6 (SQLi only), 6.9.5, 7.0.2 (and 7.1 Beta 2+). WordPress enabled forced
auto-updates for affected sites โ verify the update actually landed.
Reported by Adam Kues (Assetnote / Searchlight Cyber) via WordPress's HackerOne program.
---
## Install
Requires Python 3.9+ and `requests`.
```bash
# with uv
uv pip install requests
# or plain pip
pip install requests
```
## Usage
```bash
python wp2shell.py https://target.example
```
Example output:
```
https://target.example: VULNERABLE (RCE) [6.9.3]
```
## Interpreting the output
| Verdict | Meaning |
| ------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
| `VULNERABLE (RCE)` / `VULNERABLE (SQLi)` | Affected version **and** REST batch route reachable โ exposed on a default install. See _Limitations_. |
| `version-affected (...), route unconfirmed` | Version is in an affected band, but the REST batch route did not respond as expected. |
| `not affected` | WordPress detected, version outside the affected bands. |
| `wordpress not detected` | No version found (REST locked down, `generator` tag removed, or not WordPress). |
| `unreachable` | Host did not respond. |
---
## Limitations
- **"VULNERABLE" is an exposure signal, not a confirmation.** It means _affected version + REST reachable_.
It does not prove the route-confusion / injection is exploitable on that specific host.
- **Persistent object cache.** The RCE requires that no persistent object cache is in use. A site can be
in the affected band yet not RCE-exploitable - and this tool cannot detect that remotely.
- **Version detection is best-effort.** The `generator` tag is often removed or spoofed; a missing version
yields `wordpress not detected`, not a guarantee that the site is safe or non-WordPress.
- **Single URL per run.** No batch input, rate limiting, or output formats beyond the console line.
## Remediation
1. Update to **6.8.6**, **6.9.5**, or **7.0.2** (or newer) for your branch, and confirm the update applied.
2. If you can't patch immediately, block `/wp-json/batch/v1` and `?rest_route=/batch/v1` at your WAF,
or restrict anonymous access to the REST API.
---
## Disclaimer
Provided as-is, for authorized security testing and educational purposes only. You are solely responsible
for how you use it.
## References
- WordPress security release, 6.9.5 / 7.0.2 (2026-07-17)
- Cloudflare โ WAF protections for the WordPress vulnerabilities
- The Hacker News โ wp2shell coverage
- ZeroSec (zsec.uk) โ wp2shell code-trace deep dive