Exploit for SQL Injection in Wordpress CVE-2026-60137 CVE-2026-63030

## https://sploitus.com/exploit?id=B66A24FC-6897-520A-97B5-E07DDAE3336B
# WP2Shell Scanner

A read-only, non-destructive security audit tool that scans WordPress installations for the **wp2shell** vulnerability chain.

## Overview

WP2Shell Scanner is a bash utility that recursively searches a directory tree for WordPress installations and checks whether each site is running a core version vulnerable to the **wp2shell** vulnerabilities (CVE-2026-63030 + CVE-2026-60137).

This tool is designed for system administrators and security teams to quickly identify WordPress instances that require urgent patching.

## What It Scans

The scanner identifies WordPress installations by locating `wp-includes/version.php` files within the target directory and all subdirectories. For each installation found, it:

- Extracts the WordPress version number
- Checks if the version falls within a known vulnerable range
- Classifies the vulnerability type and severity
- Generates both console output and optional CSV reports

## Vulnerable Versions

The tool detects three vulnerability severity levels:

### Full RCE (Unauthenticated Remote Code Execution)
- **WordPress 6.9.0 – 6.9.4**: Contains both CVEs (SQL injection + REST API batch route confusion)
  - **Fix**: Upgrade to 6.9.5 or later
  - **Urgency**: 🔴 CRITICAL – Patch immediately
- **WordPress 7.0.0 – 7.0.1**: Contains both CVEs (SQL injection + REST API batch route confusion)
  - **Fix**: Upgrade to 7.0.2 or later
  - **Urgency**: 🔴 CRITICAL – Patch immediately

### SQL Injection Only
- **WordPress 6.8.0 – 6.8.5**: SQL injection vulnerability (CVE-2026-60137) without the REST API route confusion
  - **Fix**: Upgrade to 6.8.6 or later
  - **Urgency**: 🟡 HIGH – Patch but lower priority than RCE versions
  - **Note**: Not exploitable via the full unauthenticated RCE chain, but still a real vulnerability

### Safe
- All other versions are considered safe and do not appear to be affected

## Setup

Before using the scanner, make the script executable:

```bash
chmod +x wp2shell-scanner.sh
```

## Usage

### Basic Scan
```bash
./wp2shell-scanner.sh /path/to/scan
```

Scans the specified directory and all subdirectories for WordPress installations, displaying results to console.

### Generate CSV Report
```bash
./wp2shell-scanner.sh /path/to/scan --csv report.csv
```

Performs the same scan but also saves results to `report.csv` for further analysis or integration with other tools.

### Common Examples

```bash
# Scan entire web root
./wp2shell-scanner.sh /var/www

# Scan with CSV export
./wp2shell-scanner.sh /home/users --csv wordpress-audit.csv

# Scan web server directory with sudo (if needed for permission)
sudo ./wp2shell-scanner.sh /home
```

## Output

### Console Output

The tool displays results with color-coded status indicators:

- **[!] VULNERABLE - FULL RCE** (Red): Full RCE chain detected – patch immediately
- **[!] VULNERABLE - SQLi only** (Yellow): SQL injection only – patch soon
- **[OK]** (Green): Version is safe
- **[?]** (Yellow): Version could not be determined

**Example:**
```
Scanning for WordPress installs under: /var/www
----------------------------------------------------------------------
[!] VULNERABLE - FULL RCE /var/www/site1 -> WP 6.9.3 (patch to 6.9.5 or 7.0.2 immediately)
[!] VULNERABLE - SQLi only /var/www/site2 -> WP 6.8.4 (patch to 6.8.6; no full RCE chain on this branch)
[OK] /var/www/site3 -> WP 7.1.0
[?] /var/www/site4 -> could not determine version
----------------------------------------------------------------------
Scan complete.
Sites found:          4
  Vulnerable (RCE):   1
  Vulnerable (SQLi):  1
  Safe:               1
  Unknown:            1
```

### CSV Output

When using `--csv`, a file is created with the following format:

```
path,version,status
"/var/www/site1",6.9.3,VULNERABLE (RCE)
"/var/www/site2",6.8.4,VULNERABLE (SQLi)
"/var/www/site3",7.1.0,SAFE
"/var/www/site4",unknown,UNKNOWN
```

This format is suitable for importing into spreadsheets, security dashboards, or automated remediation workflows.