## https://sploitus.com/exploit?id=EC2B25A4-889A-5D7C-9793-6DABDD56AEF6
# wp2shell — WordPress Core Pre-Auth RCE
**CVE-2026-63030** (Batch Route Confusion) + **CVE-2026-60137** (SQL Injection)
Zero-dependency exploitation toolkit for the wp2shell vulnerability chain in WordPress Core. A single anonymous HTTP request achieves remote code execution on a default WordPress installation with no plugins required.
---
## 📋 Table of Contents
- [Affected Versions](#-affected-versions)
- [Exploitation Flow](#-exploitation-flow)
- [Quick Start](#-quick-start)
- [Demo](#-demo)
- [Features](#-features)
- [Upload Methods](#-upload-methods)
- [Output Files](#-output-files)
- [Dork / Hunting](#-dork--hunting)
- [References](#-references)
- [Disclaimer](#-disclaimer)
---
## 🎯 Affected Versions
| Range | Impact | Fixed In |
|---|---|---|
| **7.0.0 – 7.0.1** | Full RCE | 7.0.2 |
| **6.9.0 – 6.9.4** | Full RCE | 6.9.5 |
| **6.8.0 – 6.8.5** | SQLi only | 6.8.6 |
> **No plugins or special configuration required.** A naked WordPress install is exploitable.
---
## 🔗 Exploitation Flow
```
┌─────────────────────────────────────┐
│ ANONYMOUS HTTP REQUEST │
│ POST /?rest_route=/batch/v1 │
└────────────────┬────────────────────┘
│
┌────────────────▼────────────────────┐
│ CVE-2026-63030: Batch Desync │
│ Malformed path → WP_Error → │
│ Array misalignment → Auth Bypass │
└────────────────┬────────────────────┘
│
┌────────────────▼────────────────────┐
│ CVE-2026-60137: SQL Injection │
│ author__not_in → unsanitized → │
│ UNION SELECT extraction │
└────────────────┬────────────────────┘
│
┌───────────┼───────────┐
│ │ │
┌────▼────┐ ┌───▼────┐ ┌───▼──────────┐
│ oEmbed │ │ Blind │ │ Changeset │
│ Seeding │ │ SQLi │ │ Re-entrancy │
│ Write │ │ Read │ │ Escalation │
│ Cache │ │ IDs │ │ → Admin User │
└────┬────┘ └───┬────┘ └───┬──────────┘
│ │ │
└───────────┼───────────┘
│
┌────────────────▼────────────────────┐
│ ADMIN CREATED (pre-auth!) │
│ → Login → Upload Shell (7 methods) │
└─────────────────────────────────────┘
```
---
## 🚀 Quick Start
```bash
pip install requests
python exploit.py
```
```
╔══════════════════════════════════════════════════════════════╗
║ WP2SHELL — WordPress Core Pre-Auth RCE Exploit ║
║ CVE-2026-63030 (Batch Route Confusion) + CVE-2026-60137 ║
║ Affected: WP 6.9.0 – 7.0.1 | Fixed: 6.9.5 / 7.0.2 ║
╚══════════════════════════════════════════════════════════════╝
[?] Target [url/list.txt] > list.txt
[?] Threads [15] > 15
```
### Single Target
```bash
python exploit.py
```
```
[?] Target [url/list.txt] > https://vulnerable-site.com
┌────────────────────────────────────────────────────────┐
│ SCAN CONFIGURATION │
├────────────────────────────────────────────────────────┤
│ Targets : 1 Threads : 1 Dir : wp_core_rce│
└────────────────────────────────────────────────────────┘
┌────────────────────────────────────────────────────────┐
│ EXPLOIT SUCCESS │
├────────────────────────────────────────────────────────┤
│ Method : direct-plugin │
│ Shell : https://target.com/wp-content/plugins/... │
│ Login : https://target.com/wp-login.php │
│ User : wp2s_abc123def │
│ Pass : WP2S!xxxxxxxxxxxxxxxx │
└────────────────────────────────────────────────────────┘
```
### Mass Scan
```bash
python exploit.py
```
```
┌────────────────────────────────────────────────────────┐
│ SCAN CONFIGURATION │
├────────────────────────────────────────────────────────┤
│ Targets : 500 Threads : 15 Dir : wp_core_rce │
└────────────────────────────────────────────────────────┘
┌────────────┬────────────────────────────────────────┬──────────────┐
│ │ │ │
│ #/TOTAL │ HOST │ STATUS │
├────────────┼────────────────────────────────────────┼──────────────┤
│ 1/500 │ vulnerable-site.com │ SHELL │
│ │ ↳ direct-plugin → https://vulnerabl... │
│ 2/500 │ target2.com │ ADM │
│ 3/500 │ safe-site.org │ SQLi │
│ 4/500 │ nope.com │ NO │
│ 5/500 │ jackpot.net │ SHELL │
│ │ ↳ theme-editor → https://jackpot.ne... │
└────────────┴────────────────────────────────────────┴──────────────┘
┌────────────────────────────────────────────────────────┐
│ SHELL 2 ADMIN 3 SQLi 15 TOTAL 50/500│
└────────────────────────────────────────────────────────┘
├────────────────────────────────────────────────────────┤
│ result.txt │ admin credentials │
│ result_upload.txt │ shell upload URLs │
│ log/scanned.txt │ scanned hosts │
└────────────────────────────────────────────────────────┘
```
---
## ✨ Features
- **Zero dependencies** — Python 3.11+ stdlib only (`requests` for expander only)
- **Multi-threaded** — 15 threads default, up to 30
- **Auto-resume** — `log/scanned.txt` skips already-scanned targets
- **Silent batch mode** — Clean table output, no log spam
- **Auto-detection** — WordPress + batch API + SQLi availability checks
- **7 parallel upload methods** — First-win race condition
---
## 📤 Upload Methods
All 7 methods execute in parallel via `ThreadPoolExecutor`. The first successful method wins and the rest are cancelled.
| # | Method | Description |
|---|---|---|
| 1 | `direct-plugin` | Upload zip via `/wp-admin/plugin-install.php` |
| 2 | `direct-theme` | Upload zip via `/wp-admin/theme-install.php` |
| 3 | `rest-api` | POST zip to `/wp-json/wp/v2/plugins` with auth cookie |
| 4 | `plugin-editor` | Write PHP directly via `/wp-admin/plugin-editor.php` |
| 5 | `theme-editor` | Write PHP into active theme directory |
| 6 | `ftp-bypass` | Submit FTP credentials when WordPress requests them |
| 7 | `media-upload` | Upload PHP via media library with 15 extension variants |
**Media upload extensions:** `.phtml` `.php5` `.php7` `.php8` `.pht` `.phar` `.shtml` `.php4` `.phps` `.phtm` `.Php5` `.PhP5` `.pHtml` `.phP` `.PHP`
**FTP credentials tried:** `localhost` / `127.0.0.1` with `root` / `www-data` / WordPress admin credentials
---
## 📁 Output Files
| File | Content |
|---|---|
| `result.txt` | Admin credentials: `url.com/wp-login.php:user:pass` |
| `result_upload.txt` | Shell URLs: `shell_url \| login_url:user:pass \| method` |
| `log/scanned.txt` | All scanned hosts (auto-skip on re-run) |
---
## 🔍 Dork / Hunting
### Shodan
```
http.title:"WordPress"
http.component:"WordPress"
```
### Fofa
```
app="WordPress"
body="wp-json"
body="/batch/v1"
```
### ZoomEye
```
app:"WordPress"
"/wp-json/batch/v1"
```
### Censys
```
services.http.response.body:"/wp-json/batch/v1"
```
---
## 📚 References
- [Searchlight Cyber Advisory](https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/)
- [Hadrian Technical Blog](https://hadrian.io/blog/wp2shell-a-pre-authentication-rce-in-wordpress-cores-rest-batch-api)
- [WordPress 7.0.2 Release](https://wordpress.org/news/2026/07/wordpress-7-0-2-release/)
- [Assetnote Research](https://github.com/assetnote)
- [Wordfence Threat Intel](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-69-701-remote-code-execution-via-rest-api-batch-request-route-confusion)
---
## ⚠️ Disclaimer
This tool is provided for **authorized security research and penetration testing only**. Use only on systems you own or have explicit written permission to test. The authors accept no liability for misuse.
---
## 📄 License
MIT License. See [LICENSE](LICENSE) for details.