SQL Injection in WordPress WP_Query author__not_in Parameter

Repository contains a standalone Python exploit tool plus a Nuclei exposure template and documentation. The main artifact is wp2shell.py, a large Python 3 CLI tool with subcommands check, read, exploit, shell, masscan, and autopwn. Based on the README and visible constants/parser code, it is intended to chain a REST API batch SQL injection (via author_exclude on WordPress batch requests) with a claimed oEmbed/customizer authentication bypass to achieve pre-auth administrator creation and then authenticated RCE through webshell/plugin deployment. Capabilities described include non-destructive checking, UNION/error/blind extraction, interactive shell, single-command execution, persistence/backdoor installation, cleanup, threaded mass scanning, proxy support, stealth delays, and automated subdomain discovery. The repository also includes wp2shell-exposure.yaml, a Nuclei template for detection rather than exploitation. That template fingerprints WordPress version, checks batch endpoint exposure through both /?rest_route=/batch/v1 and /wp-json/batch/v1, validates REST API and permalink behavior, and sends multiple SQLi test payloads: boolean, timing, UNION, error-based, and a database-count probe. The duplicated file wp2shell-exposure/wp2shell-exposure.py is actually YAML content mislabeled with a .py extension. Supporting files are README documents and license. Overall purpose: offensive assessment of allegedly vulnerable WordPress Core versions for pre-auth SQLi/auth-bypass-to-RCE chaining. The main exploit is operational rather than just a detector because it advertises account creation, shell access, persistence, and cleanup, while the Nuclei component is a detection/exposure scanner. The visible code and docs expose numerous fingerprintable WordPress REST paths and example backdoor locations.

Repository contains a multi-implementation exploit suite for unauthenticated WordPress RCE chaining CVE-2026-63030 (REST batch route confusion) with CVE-2026-60137 (blind SQLi in author_exclude/author__not_in). It is not just a detector: it includes full exploitation logic, data extraction, admin creation, shell deployment, and cleanup. Structure: (1) README and go-scanner/README.md document the attack chain and usage; (2) go-scanner/wp2shell-master.go is the main standalone Go binary implementing scan, check, read, shell, rce, and root-prereq modes; (3) waf-bypass/ contains Python tooling for blind SQLi extraction and a full pre-auth RCE shell path with Cloudflare/ModSecurity bypass; (4) metasploit-modules/ contains an exploit module and a scanner module; (5) lab/ and lab/waf/ provide Dockerized vulnerable WordPress environments, including a ModSecurity configuration simulating Cloudflare-style raw-body inspection; (6) find-vulnerable.sh is a lightweight reconnaissance helper. Core exploit behavior across implementations is consistent: send nested JSON batch requests to /wp-json/batch/v1 or ?rest_route=/batch/v1, use a malformed/primer path to trigger route confusion, exploit time-based blind SQLi through author_exclude, extract DB metadata and admin information, use UNION-based row forgery to turn read-oriented SQLi into DB writes, create or elevate an administrator, then upload/activate a PHP shell or plugin for arbitrary command execution. WAF bypass features include unicode escaping of SQL keywords in JSON, use of Origin/Referer headers matching the target, realistic Chrome User-Agent strings, and Cloudflare challenge detection. The Go tool appears to be the most complete operator-facing implementation, while the Python scripts expose individual stages and the Metasploit modules integrate the chain into MSF with customizable payload support.

Repository contains two files: a README and a single Python entry point, exploit.py. The code is a standalone Python 3 exploit toolkit, not tied to a major framework. Based on the README and visible code, its purpose is mass or single-target exploitation of a claimed WordPress Core pre-auth RCE chain combining CVE-2026-63030 (REST batch route confusion/auth bypass) and CVE-2026-60137 (SQL injection). The exploit supports interactive targeting of either one URL or a list of hosts, multithreading, resumable scans via log/scanned.txt, and result logging to result.txt and result_upload.txt. The visible code structure includes UI helpers, file-writing helpers, an HTTP wrapper using urllib with TLS verification disabled, and batch endpoint helpers. Constants such as DESYNC={"method":"POST","path":"///"}, POSTS_ITEM='/wp/v2/posts/999999', SIG='WP2S_OK', and PLUGIN_MARK='wp2s_' indicate logic for malformed REST batch requests, REST object interaction, and shell/plugin identification. The README describes the exploitation flow as: anonymous POST to /?rest_route=/batch/v1 or /wp-json/batch/v1, abuse of batch desynchronization/auth bypass, SQLi-based data extraction, admin creation, then authenticated code execution. Main exploit capability is operational compromise of WordPress sites: it attempts to create an administrator account and then races seven upload/write methods in parallel to land a PHP shell. Those methods are direct plugin upload, direct theme upload, REST plugin installation, plugin editor write, theme editor write, FTP-bypass submission, and media upload with multiple PHP-like extensions. Output states distinguish between full shell, admin-only compromise, SQLi-only, or failure. Overall, this is an operational exploit tool with mass-scan support and post-exploitation web-shell deployment, not merely a detector or README-only PoC.

Repository is a full WordPress plugin source tree for Backup Migration 1.3.7, accompanied by a README explaining CVE-2023-6553. This is not a standalone exploit script repository; instead, it contains the vulnerable application code itself plus analysis notes. The core issue is in wp-src/includes/backup-heart.php, a directly reachable POST handler that accepts numerous HTTP headers, lowercases them, and uses them to define runtime constants such as ABSPATH, WP_CONTENT_DIR, BMI_CONFIG_DIR, BMI_BACKUPS, and critically BMI_ROOT_DIR. It then derives BMI_INCLUDES as BMI_ROOT_DIR . 'includes' and executes require_once BMI_INCLUDES . '/bypasser.php'. Because BMI_ROOT_DIR comes from the attacker-controlled Content-Dir header and there is no authentication or nonce check, this creates an unauthenticated file inclusion primitive that can lead to arbitrary PHP execution. Main exploit capability: unauthenticated remote exploitation over HTTP by sending a POST request to backup-heart.php with crafted Content-* headers. The exploit path is effectively header injection into filesystem paths, culminating in require_once of includes/bypasser.php from an attacker-chosen base directory. This is consistent with LFI-to-RCE or direct arbitrary include of attacker-controlled local PHP content. The vulnerable handler also trusts other attacker-supplied paths and values, including config, backups, URL, and resource limits. Repository structure: wp-src/backup-backup.php is the plugin bootstrap; wp-src/includes/ contains operational plugin code including activation logic, the vulnerable backup-heart.php, and bundled subcomponents. The wp-src/analyst/ subtree is a telemetry/opt-in SDK that phones home to feedback.sellcodes.com/api/v1 and is unrelated to the CVE but notable from an endpoint perspective. The wp-src/includes/banner/ subtree is a promotional carousel/installer for other plugins. Most remaining files are admin assets and images. Assessment: valid exploit-relevant repository, not fake, not merely detection. However, because it mainly ships the vulnerable target code and explanatory README rather than a ready-made exploit launcher or weaponized payload, maturity is best classified as POC.

This repository is a small standalone Python proof-of-concept for CVE-2026-60137, a WordPress Core blind SQL injection in the REST-exposed author_exclude parameter that maps to WP_Query::author__not_in. The repository contains only three files: an MIT LICENSE, a detailed README explaining the vulnerability and usage, and one Python script (`cve_2026_60137_poc.py`) that implements the exploit logic. The exploit is not destructive and is more than a simple detector: it fingerprints the target WordPress version, tests multiple REST delivery vectors using time-based blind SQLi payloads, and can optionally extract selected `wp_users` fields via conditional `IF(...,SLEEP(...),0)` probes. The script supports direct REST routes, `rest_route` query-based routing, and batch endpoint delivery. It includes operational features such as cookie-based authenticated testing, proxy support, TLS verification disablement, timing sample collection, threshold-based verdicting, and JSON evidence output. Main exploit capabilities: - Version fingerprinting against WordPress artifacts to determine whether the target appears affected. - Time-based blind SQL injection verification using payloads like `1) OR SLEEP(n)#`. - Conditional blind extraction of database values from `wp_users` using timing oracles. - Testing across several delivery vectors to identify which endpoint is exploitable in the current target/session context. The code structure visible from the provided content includes constants for affected versions and vectors, a `Target` HTTP wrapper class for request handling and timing capture, payload builders, vector-specific send logic, measurement routines, result reporting, and optional extraction/evidence serialization. Based on the available code and README, this is a real exploit PoC with read-only database interaction and practical offensive capability, though it is not part of a larger exploitation framework.

This repository is a standalone Python exploit framework centered on WordPress targeting. It contains one substantive code file, wp2exp_2026.py, plus a README, license, and gitignore. The script is presented as an all-in-one tool that combines reconnaissance, vulnerability detection, exploitation, and post-exploitation actions against WordPress core and several plugins. Repository structure is minimal: README.md documents usage and claimed capabilities; wp2exp_2026.py is the operational entry point; there are no external modules besides Python standard library and optional SOCKS proxy support. The script supports single-target and multi-target execution, JSON reporting, threaded scanning, proxying, and multiple modes (scan, exploit, shell). Core capabilities described and partially evidenced in code/constants include: WordPress version fingerprinting; WAF detection from headers/body markers; XML-RPC probing; user enumeration through REST and author archives; plugin version enumeration; safe probing of the WordPress batch REST endpoint; CVE-specific checks for WordPress core and multiple plugins; exploitation chains for pre-auth admin creation; SQLi-based information extraction; content disclosure/dumping; and optional webshell deployment/verification. The code includes constants for vulnerable WordPress core ranges, plugin CVE metadata, SQLi/XPATH extraction regexes, union-based injection parameters, and a main workflow that runs scan_target() followed by exploit_chain() when exploit or shell mode is selected. Fingerprintable endpoints are primarily WordPress web paths and REST routes: /feed/, /readme.html, /wp-json/wp/v2/users, ?rest_route=, ?author=N, and /wp-json/batch/v1. The README also references POST /wp/v2/users as part of an admin-creation chain and system.listMethods for XML-RPC probing. A plugin namespace constant mcp/v1 appears in code for AI Engine targeting. The tool also supports a local SOCKS5/TOR proxy at socks5h://127.0.0.1:9050. Overall, this is not merely a detector script. It is an exploit-oriented framework with scanning and exploitation stages, optional shell deployment, and machine-readable reporting. Given the breadth of supported targets, chaining logic, and shell mode, its maturity is best characterized as weaponized.

Repository is a small standalone Python exploit project with 3 files: the main exploit script `CVE-2026-63030.py`, a target-discovery dork file, and a minimal README. The Python script is the only substantive component and is a multithreaded operational exploit rather than a simple detector. Based on the banner and visible constants/classes, it targets a claimed WordPress REST API batch route-confusion to SQL injection chain, then escalates to administrator access and finally to RCE using three strategies: plugin upload, theme overwrite, or SQLi-based file write. The script includes helper classes for ordered multithreaded output (`SequentialPrinter`), response parsing, queued target handling, created-admin tracking, and RCE result reporting. It supports batch processing of multiple targets, configurable threading/timeouts/commands, and summarizes counts of admin compromise, RCE success, and failures at the end. Notable hardcoded artifacts include the default command `id`, generated admin username/password prefixes (`Fx_`, `Fx!`), generated email domain `Fxshell.invalid`, a desync primer path `///`, and output files `vuln.txt` and `rce.txt`. `Dork.txt` contains `http.component:"wordpress"`, indicating the operator is expected to find exposed WordPress instances for mass targeting. Overall purpose: automate end-to-end exploitation of allegedly vulnerable WordPress versions from initial web attack surface through privilege escalation to command execution.

This repository is a standalone TypeScript/Node.js exploit utility, not just a scanner despite the README language. It contains 18 files, with the main entry point in `src/cli.ts`. The code implements a full unauthenticated WordPress exploitation chain for the claimed WP2Shell vulnerabilities (CVE-2026-63030 and CVE-2026-60137). Repository structure: `src/cli.ts` handles argument parsing, target loading, and result display; `src/scanner.ts` orchestrates exploitation; `src/sql/payloads.ts` and `src/sql/sql.ts` build and send nested REST batch and SQLi payloads; `src/utils/unionPosts.ts` and `src/utils/unionQuery.ts` construct UNION-based post rows and changeset objects; `src/utils/auth.ts` logs into wp-admin and uploads a malicious plugin ZIP; `src/command.ts` provides an interactive shell over HTTP; `src/menu.ts` adds post-exploitation actions such as connect/delete/export. Main exploit capabilities: it normalizes targets, probes the vulnerable REST batch route to determine SQL UNION column count, creates oEmbed cache entries, enumerates the WordPress table prefix from `INFORMATION_SCHEMA.TABLES`, extracts an administrator user ID from `<prefix>_users` and `<prefix>_usermeta`, abuses crafted changeset/nav menu item data to create a new administrator account through `/wp/v2/users`, logs in through `/wp-login.php`, uploads a plugin containing a PHP `system($_GET['cmd'])` webshell to `/wp-content/plugins/<slug>/<slug>.php`, and then offers an interactive remote shell. It also supports deleting the uploaded shell by issuing `rm -rf <shellFileName>` through the shell itself. The exploit is operational rather than a mere proof-of-concept because it includes end-to-end post-exploitation automation and a working payload, but it is not obviously framework-weaponized. It targets web-accessible WordPress instances and supports single or bulk target processing from CLI arguments or `targets.txt`.

Repository contains a single Python exploit script (main.py) and a detailed README. The project is a menu-driven unauthenticated SQL injection extractor for WordPress core that chains two issues described as CVE-2026-60137 (author__not_in SQLi in WP_Query) and CVE-2026-63030 (REST batch route confusion). The script is not a scanner-only utility; it is an active exploitation and data-extraction tool. Structure and purpose: main.py is the operational entry point. It implements HTTP transport using Python stdlib urllib, optional proxy/insecure TLS handling, retry logic, response timing, and a BatchClient abstraction for interacting with the WordPress batch API. The code resolves whether to use /wp-json/batch/v1 or /?rest_route=/batch/v1 and uses a malformed primer path ("///") to trigger the route confusion condition described in the README. The script appears to maintain an interactive session and supports repeated extraction tasks against a chosen host. Exploit capabilities: the tool performs database fingerprinting and extraction through three modes: (1) UNION-based in-band extraction for fast single-request retrieval, (2) 8-thread parallel boolean-blind extraction using binary search over printable ASCII, and (3) sequential time-based extraction using IF(condition,SLEEP(N),0) as a fallback. It can enumerate databases, tables, and columns; dump individual tables; dump all tables; and produce a full dump file. The README explicitly notes output formatting for WordPress user credential material (ID|user_login|user_pass) suitable for offline cracking workflows. Targeting: the README claims full unauthenticated exploitability for WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1, with earlier 6.8.x versions containing only part of the chain and later versions patched. It also notes that persistent object caching can interfere with the UNION path, causing fallback to blind modes. Overall assessment: this is a real exploit-oriented repository with operational code, not merely documentation or detection logic. It is best classified as an OPERATIONAL proof-of-concept extractor focused on unauthenticated SQLi-driven database dumping from vulnerable WordPress instances.

Repository is a standalone Python exploit toolkit named wp2shell targeting WordPress via the claimed CVE-2026-63030 and CVE-2026-60137 chain. It is not just a detector: it contains end-to-end exploitation, credential extraction, admin creation, and post-auth RCE tooling. Structure: `wp2shell_core.py` is the main engine implementing HTTP session handling, WordPress version detection, batch endpoint discovery, route-confusion checks, SQLi confirmation, extraction helpers, admin creation, login, and plugin-upload-based command execution. `wp2shell_cli.py` is the practical operator entry point for full exploitation and interactive shell usage. `sqli_scanner.py` is a dedicated scanner that tests multiple SQLi styles (time-blind, boolean-blind, UNION, error-based, timing oracle) and recommends next steps. `exploit_advanced.py` extends exploitation with MySQL environment probing, FILE privilege checks, INTO OUTFILE webshell attempts, LOAD_FILE/wp-config extraction, application-password extraction, hash dumping, and secret extraction. `probe_posts.py` focuses on enumerating WordPress post/oEmbed-related content to make the exploit chain more reliable. `wp2shell_gui.py` and `wp2shell_explorer.py` provide GUI front-ends, while `启动.cmd` launches the GUI on Windows. Main exploit capability: the code crafts nested JSON requests to WordPress batch REST endpoints using malformed path primers like `///` and internal requests to `/wp/v2/posts` and `/wp/v2/posts/999999`, then injects SQL through the `author_exclude` parameter with payloads such as `0) UNION SELECT ... -- -`. Successful exploitation enables fast UNION-based extraction from the WordPress database. The toolkit can detect table prefixes, enumerate database metadata, dump user hashes and secrets, extract application passwords, and in some cases read `wp-config.php` or write files via MySQL FILE primitives. Post-exploitation capability: once SQLi is confirmed and UNION extraction works, the tool attempts to create a new WordPress administrator account. Using those credentials, it logs into WordPress and uploads a malicious plugin/webshell under `wp-content/plugins`, then exposes arbitrary command execution and remote file browsing. This makes the repository operational rather than a simple PoC, though payloading appears fairly fixed/hardcoded rather than framework-grade customizable.

Repository contains a small standalone exploit package with 3 files: a detailed README, a Docker Compose lab, and a Python exploit script. The main capability is a full unauthenticated WordPress compromise chain targeting CVE-2026-63030 and CVE-2026-60137. The Python script orchestrates multiple phases: (1) sends a batched REST request to /?rest_route=/batch/v1 using a malformed subrequest path '///' to confirm route confusion/auth bypass behavior; (2) uses the bypass to perform boolean-based blind SQL injection against the posts REST endpoint via author_exclude to extract administrator data; (3) attempts admin login using recovered information and common password guesses; (4) uploads and activates a malicious WordPress plugin containing a PHP webshell; and (5) verifies RCE and offers either one-shot command execution or an interactive shell. The exploit uses requests.Session, multithreading helpers for extraction, and hardcoded shell metadata including folder/file names and token. The README documents the vulnerability chain, expected output, remediation, and detection guidance, while docker-compose.yml provisions a local vulnerable WordPress 6.9.4 + MySQL 8.0 environment on localhost:8080 for testing. Overall, this is an operational end-to-end web exploit rather than a detector or framework module.

Repository contains a single substantial Python exploit script, wp2shell.py, plus a minimal README referencing an upstream project and noting SSL-skip support. The script is a standalone, standard-library-only WordPress exploitation utility branded 'wp2shell'. It implements multiple modes: exposure scanning, blind SQLi validation, blind SQLi data extraction, authenticated shell access using a cracked admin password, credential-less pre-auth RCE, interactive command execution, and a root-prerequisite check. The code includes custom HTTP handling, including preserved POST redirects and optional SSL certificate verification bypass, indicating practical support for real-world target behavior such as HTTP-to-HTTPS redirects and self-signed certificates. Based on the visible code and comments, the exploit targets WordPress core issues identified as CVE-2026-63030 and CVE-2026-60137. The script contains version comparison logic to determine affected releases and distinguishes between versions that are only SQL-injection vulnerable and those that can be chained to RCE. The exploit is not merely a detector: it includes active exploitation paths and operator-supplied command execution. It appears operational rather than framework-integrated, with CLI options for timing, route selection, proxying, cleanup control, and interactive use. Fingerprintable endpoints are sparse in the provided content because the script is target-driven and accepts URLs from the operator rather than hardcoding victim infrastructure. The only explicit endpoint visible is the example proxy URL http://127.0.0.1:8080. The README also references an upstream GitHub repository, but that is provenance rather than an exploit target. Overall, this repository is a compact but capable WordPress exploit tool combining reconnaissance, validation, data extraction, and RCE workflows in one Python entry point.

This repository is a small standalone Python exploit project centered on a single script, cve_2026_63030.py, with supporting README and a no-dependency requirements.txt. It is not part of a larger exploit framework. The script targets a claimed WordPress Core pre-authentication exploit chain combining CVE-2026-63030 (REST batch route confusion) and CVE-2026-60137 (SQL injection via author__not_in / author_exclude handling). Repository structure is minimal: README.md documents the vulnerability chain, prerequisites, usage modes, and expected output; cve_2026_63030.py contains all exploit logic; requirements.txt indicates stdlib-only execution. The Python script uses urllib and ssl with certificate verification disabled, sets a fixed User-Agent, and builds JSON POST requests to the WordPress REST batch endpoint. Core exploit capability: the script sends crafted nested batch requests to /?rest_route=/batch/v1. It uses a malformed path value of '///' as a primer to induce request/route desynchronization, then injects SQL through the posts endpoint query string using author_exclude. Helper functions such as _inner_batch, _render_union, and _extract construct UNION-based SQLi payloads and parse reflected results from HTTP responses. The script supports multiple modes: vulnerability check (--check), reconnaissance and extraction of DB/admin details, dumping wp_users/wp_usermeta data (--dump-users), full-chain unauthenticated administrator creation, and optional post-exploitation RCE (--rce) after admin creation. The exploit appears operational rather than a simple detector because it contains end-to-end logic for exploitation and post-exploitation. Based on the visible code and README, the intended outcome is creation of a fresh WordPress administrator account and, optionally, deployment of a webshell/plugin to execute arbitrary commands. The main fingerprintable targets are WordPress REST endpoints /?rest_route=/batch/v1, /wp/v2/posts, /batch/v1, /wp/v2/users, and the login page /wp-login.php, along with SQLi access to WordPress tables wp_users and wp_usermeta.

Repository contains a standalone Python exploit (`exploit.py`), documentation (`README.md`, `REPORT.md`), a reference copy of vulnerable WordPress REST server code (`src/class-wp-rest-server.php`), and a Docker lab (`wp2shell-lab/`) for reproducing the issue. The exploit is not tied to a common framework and is implemented with Python stdlib only. Main capability: a full unauthenticated WordPress exploit chain for CVE-2026-63030 and CVE-2026-60137. The script first probes for route confusion in the REST batch API by sending malformed batched subrequests. It then uses the desynchronization to bypass normal validation and inject attacker-controlled input into a `WP_Query` parameter (`author_exclude` / documented as `author__not_in`) to achieve SQL injection. From there, the documented chain escalates from database read access to write primitives, admin creation, malicious plugin upload, and finally arbitrary command execution or reverse shell. The Python script exposes three operator-facing modes: `check` for vulnerability detection and optional SQLi confirmation, `read` for extracting database information or running custom SQL expressions, and `shell` for post-exploitation command execution. Based on the README and embedded comments, the shell stage uploads or uses a webshell plugin and supports both direct command execution (`--cmd`) and reverse shell (`--reverse IP:PORT`). Fingerprintable targets are primarily WordPress REST API routes: the batch endpoint (`/?rest_route=/batch/v1` and documented `/wp-json/batch/v1`), `/wp/v2/posts`, `/wp/v2/posts/999999`, `/wp/v2/block-renderer/core/archives`, and `/batch/v1`. The lab environment additionally exposes local services on ports 8080 and 8081 and uses MySQL on 3306 internally. Overall purpose: this is an operational proof-of-concept repository for demonstrating and reproducing a pre-auth WordPress RCE chain, with both exploit automation and a self-contained vulnerable lab environment.

Repository contains a single Python exploit script (wp2shell.py) and a README. The script targets WordPress REST API route confusion in the batch endpoint together with SQL injection in the posts endpoint to achieve unauthenticated compromise and eventual RCE. The overall workflow is multi-phase: first it probes /batch/v1 and checks for the parse_path_failed plus block_cannot_read response pattern to confirm route confusion; then it attempts SQL injection through the author_exclude parameter on /wp/v2/posts using nested batch requests. If UNION/stacked SQLi is available, the exploit aims to identify the WordPress table prefix, create an administrator account by inserting into the users/usermeta tables, authenticate, deploy a plugin-based PHP webshell under wp-content/plugins, and execute arbitrary commands through token and command query parameters. If UNION is not available, it falls back to boolean/time-based blind extraction to recover database metadata and admin password hashes for offline cracking, after which supplied credentials can be used to log in and deploy the shell. The code includes HTTP client logic, proxy support, TLS verification disabling, batch endpoint helpers, login support, and command execution handling. Based on the available content, this is an operational exploit rather than a simple detector or README-only repository.

This repository is a small standalone Python exploit PoC consisting of one main script (`poc_wp_tot.py`), a README, and a `.gitignore`. It is not part of a larger exploitation framework. The script targets WordPress via the REST API batch interface and is explicitly described as chaining a time-based blind SQL injection into remote code execution. The README names CVE-2026-63030 and CVE-2026-60137 as the tested vulnerabilities. The exploit exposes three operator modes: `probe` to test whether the target appears vulnerable, `extract` to retrieve a single scalar value from the database using timing-based inference, and `rce` to execute an arbitrary OS command on the compromised target. The visible code confirms argument parsing for these modes, a `send_batch()` helper that posts crafted JSON to `/?rest_route=/batch/v1`, and a main flow that first calibrates timing thresholds (`calibrate()`), then either probes, extracts data (`get_scalar()`), or launches the full chain (`exploit_rce()`). From the README and visible code/comments, the exploit’s core capability is time-based blind SQLi using `SLEEP()` conditions over the WordPress batch REST API. It then uses binary-search-style extraction to recover strings/integers from the database. For the RCE chain, the README states that the exploit seeds oEmbed-related entries via SQL payloads, locates generated cache/post artifacts, builds a malicious changeset, creates a new administrator account, uploads a PHP plugin, and executes attacker-supplied shell commands. The script also appears to print the created administrator credentials and command output after successful exploitation. Fingerprintable endpoints found in code are centered on WordPress REST routes: `/?rest_route=/batch/v1`, `/wp/v2/posts`, and `/batch/v1`. The batch payload also contains a suspicious `http://:` path string, likely part of the exploit technique rather than a real remote destination. Overall, this is a real exploit PoC with offensive capability beyond detection, and because it includes a usable RCE chain with operator-supplied commands, its maturity is best classified as OPERATIONAL.

Repository is a compact single-purpose exploit repo with two files: a detailed README and one substantial Python script, wp2shell.py. The Python file is a standard-library-only exploit tool targeting WordPress core by chaining CVE-2026-63030 (REST /batch/v1 route-confusion desync) with CVE-2026-60137 (WP_Query author__not_in SQL injection). The exploit is clearly operational rather than a simple detector: it supports vulnerability checking, multiple SQL extraction oracles (UNION reflection, boolean via X-WP-Total, and time-based SLEEP), credential dumping, user enumeration, content extraction, privilege escalation, temporary administrator creation, and final command execution via uploaded plugin/webshell, followed by cleanup. The attack flow described in the repo is: trigger desync with a malformed nested batch subrequest path (http://:), misroute a subsequent request into the public posts collection, inject SQL through author__not_in, fabricate rows with UNION, abuse embed/oEmbed caching to convert SQL read into write primitives, forge a changeset/request graph to cause WordPress to re-enter its request pipeline as an administrator, create a new admin through /wp/v2/users, then authenticate and execute an operator-supplied shell command. The README also notes that 6.8.x targets are only crash/DoS-capable, while 6.9.0-7.0.1 are RCE-capable. Code structure visible from the script includes transport helpers (_send), opener/proxy/TLS handling, randomized browser-like User-Agent selection, target orchestration via a WordPressTarget object, and a main dispatcher that supports single-target and multi-target execution. The script disables TLS verification for convenience against self-signed targets, supports proxying, concurrency, alternate REST routing, multipart/form-data delivery, WAF-evasion knobs, and configurable donor/users routes. Overall purpose: unauthenticated exploitation of vulnerable WordPress core instances for data extraction and remote code execution during authorized security testing.

Repository contains a standalone Python exploit/validator for the WordPress 'WP2Shell' vulnerability chain and a Docker Compose lab for local testing. The main file, WP2Shell_CVE-2026-63030_POC.py, is not just a detector: despite README language emphasizing validation, the script header explicitly describes it as a detector and PoC exploiter with route-confusion detection, timing-based SQL injection confirmation, direct webshell upload via INTO OUTFILE and /proc/self/environ, and credential extraction/login fallback. The CLI supports at least remote, local, and exploit modes, indicating both scanning and active exploitation workflows. Core exploit logic builds crafted JSON requests for the WordPress REST batch endpoint /batch/v1. It uses malformed batch members with path 'http://:' to trigger request/handler desynchronization, then routes a later request toward /wp/v2/categories with the author_exclude parameter carrying attacker-controlled SQL. Timing probes are generated with SQL like SELECT IF((1=1),SLEEP(delay),0), allowing blind timing-based confirmation of CVE-2026-60137 when chained through CVE-2026-63030. The script also references more invasive capabilities beyond validation, including database extraction attempts, file-write attempts, admin creation, plugin upload, and command execution. Repository structure is small: 1 primary Python code file, 1 compose file, and documentation/license files. compose.yaml provisions a localhost-only lab with WordPress 7.0.1 and MariaDB 11.4, exposing WordPress on 127.0.0.1:8080 and mounting /var/www/html and /var/lib/mysql volumes. This supports the README's stated purpose of disposable local validation, but the code itself is operationally capable of exploitation against vulnerable remote WordPress targets.

This repository is a Python proof-of-concept exploit toolkit for a pre-authenticated-to-unauthenticated WordPress RCE chain commonly referred to here as wp2shell. It targets two vulnerabilities described in the README as CVE-2026-63030 (REST batch route confusion) and CVE-2026-60137 (author__not_in SQL injection). The repo is not just a detector: it contains end-to-end exploitation logic from vulnerability checking through SQL extraction, administrator creation, authenticated plugin upload, command execution, and cleanup. Repository structure: the package is organized as a small CLI application. Entry points are wp2shell.py and wp2shell/__main__.py, both dispatching to wp2shell/cli.py. cli.py implements commands such as check, read, and shell, handles target parsing, and orchestrates the exploitation flow. client.py contains the HTTP transport and the crafted REST batch payload builders, including the marker probe and injection wrappers. sqli.py implements three SQLi techniques: BlindSQLi (boolean/timing extraction using X-WP-Total as an oracle), ErrorBasedSQLi (EXTRACTVALUE/XPATH error leakage), and UnionSQLi (forged wp_posts row rendered back through the REST response). exploit.py contains the pre-auth bridge logic that turns the UNION fake-post primitive into creation of a new administrator account by forging a multi-row poisoned post graph tied to WordPress core behaviors. shell.py handles authenticated post-exploitation by logging in, uploading a ZIP plugin containing a PHP webshell, executing commands, and cleaning up. version.py performs passive WordPress fingerprinting and version hint collection. Main exploit capabilities: (1) passive and active vulnerability checking against /?rest_route=/batch/v1 using a benign marker batch and optional SQLi confirmation; (2) SQL data extraction via union, error-based, or blind/timing methods; (3) recovery of WordPress table names and administrator IDs from the database; (4) pre-auth creation of a temporary administrator account using the SQLi-to-admin bridge; (5) authenticated upload of a temporary plugin webshell; (6) arbitrary command execution through the uploaded PHP payload; and (7) cleanup by deleting the generated admin and removing the plugin directory. A notable implementation detail is the UNION SQLi logic: unlike simpler public PoCs, this code uses a killed-base UNION form, `1) AND 1=0 UNION ALL SELECT ... -- -`, to keep the forged-row primitive working on WordPress sites behind persistent object caches. That makes the exploit more robust on managed WordPress deployments where naive populated-base UNION probes may fail. The payload is operational but basic rather than highly modular: the PHP shell is generated on the fly, token-protected, and hardcoded into a temporary plugin ZIP. It supports command execution via GET parameter c and a cleanup helper via delete_user/reassign parameters. Overall maturity is OPERATIONAL: it is a working exploit chain with a real payload and cleanup logic, but not part of a larger exploitation framework.

Repository contains a single Python exploit script, a README, and a requirements file. The main file, CVE-2026-63030.py, is a standalone Python exploit targeting a WordPress Core vulnerability chain involving CVE-2026-63030 (REST API batch route confusion) and CVE-2026-60137 (SQL injection). It is not part of a larger exploit framework. The exploit is operational rather than detection-only. The visible code shows a vulnerability check that first verifies WordPress REST API exposure via /wp-json/, then probes the batch endpoint at /wp-json/wp/v2/batch, and finally performs a timing-based SQL injection using a crafted batch request containing a sub-request to /wp/v2/posts with a SLEEP(5) payload. The truncated remainder of the script, corroborated by the README and visible main-flow logic, supports creating an administrator account, logging in with created or supplied credentials, deploying a PHP webshell, executing arbitrary commands non-interactively or through an interactive shell loop, and optionally cleaning up artifacts. Repository structure is minimal: requirements.txt lists requests and urllib3; README.md documents the vulnerability chain, affected versions, usage examples, mitigation guidance, and references. The exploit targets WordPress Core, especially versions 6.9.0-6.9.4 and 7.0.0-7.0.1 where the full unauthenticated RCE chain is described as reachable; README also mentions 7.1 Beta 1 and notes 6.8.x as affected by only one side of the chain. Fingerprintable endpoints include WordPress REST paths /wp-json/, /wp-json/wp/v2/batch, /wp/v2/posts, and documented /wp-json/batch/v1 plus ?rest_route=/batch/v1. The README also exposes an example shell deployment path under /wp-content/plugins/maint-xxx/maint-xxx.php. Overall, the repository’s purpose is to provide a research PoC that escalates from unauthenticated web access to SQLi validation, admin creation, authenticated access, webshell deployment, and command execution against vulnerable WordPress installations.

This repository is a small standalone Python exploit project centered on CVE-2026-63030, with 3 files total: a main Python exploit (CVE-2026-63030.py), a README, and requirements.txt. It is not part of a major exploitation framework. The Python script uses requests and implements a CLI-driven exploitation workflow against WordPress REST API endpoints. Based on the visible code and README, the exploit first validates that the target exposes the WordPress REST API, then probes the batch endpoint and performs a timing-based SQL injection test using a SLEEP(5) payload. The broader workflow described in the script and README includes creating an admin account, authenticating to WordPress, deploying a PHP webshell, executing arbitrary commands, optionally entering an interactive shell loop, and cleaning up artifacts afterward. This makes it more than a detector; it is an operational exploit with post-exploitation capability. The primary fingerprintable targets are the WordPress REST API endpoints /wp-json/, /wp-json/wp/v2/batch, and the batch-related route /wp-json/batch/v1 or ?rest_route=/batch/v1. The exploit targets WordPress Core, especially versions 6.9.0-6.9.4 and 7.0.0-7.0.1 for the unauthenticated route-confusion-to-SQLi-to-RCE chain, while 6.8.0-6.8.5 is also mentioned as affected by the SQLi component. The repository’s purpose is to demonstrate and operationalize a pre-authentication WordPress compromise chain from vulnerability verification through remote command execution.

Repository is a small standalone Python exploit project with 3 files: LICENSE, README.md, and a single executable script `wp2shell.py`. The script is the core of the repository and implements an unauthenticated exploit chain against vulnerable WordPress core versions by combining CVE-2026-63030 (REST batch route confusion) and CVE-2026-60137 (SQL injection via `author__not_in`/`author_exclude`). Structure and purpose: - `README.md` documents the vulnerability chain, affected versions, usage modes (`check`, `read`, `shell`), and the intended workflow from detection to SQLi extraction to authenticated RCE. - `wp2shell.py` is a standard-library-only Python CLI tool with banner/output helpers, HTTP request helpers, payload construction, timing-based SQLi primitives, argument parsing, and exploit orchestration. Main exploit capabilities observed from the code and README: - Builds crafted JSON requests for `POST /wp-json/batch/v1`. - Uses nested subrequests to abuse route confusion: outer `POST /wp/v2/posts` containing an inner `GET /wp/v2/users?...` request. - Injects SQL through the `author_exclude` parameter using a payload like `1) OR IF((condition), SLEEP(delay), 0) -- -`. - Detects truth values by measuring response latency, enabling time-based blind SQL injection. - Supports vulnerability checking and data extraction, including database/version info and WordPress user credential hashes. - Includes a later authenticated stage (`shell`) that accepts admin username/password and is intended to upload a malicious plugin/webshell and run arbitrary commands. This is not merely a detector: it contains exploit logic for both initial access (unauthenticated blind SQLi) and post-authenticated code execution. Based on the available content, it is best classified as OPERATIONAL rather than framework-weaponized.

Small Python exploit repository centered on a single script, sxwp2shell.py, with README and disclaimer files. The script is a standalone CLI tool using only Python standard library modules (argparse, urllib, ssl, json, csv, etc.). It implements multiple modes: check, exploit, read, and scan. Based on the README and visible code, its purpose is to target WordPress via REST API endpoints, detect vulnerable versions, test batch-route confusion, confirm SQL injection, perform blind SQLi extraction, and execute a full pre-auth RCE chain. The HTTP client supports proxying, custom User-Agent, timeout control, optional SSL verification bypass, and request delay/jitter. Observable target endpoints include the site root (/), REST API root (/wp-json/), and batch endpoints /wp-json/batch/v1 and /?rest_route=/batch/v1. The exploit appears operational rather than a mere PoC because it includes end-to-end exploitation logic and command execution support, though payload customization is basic and driven mainly by the --cmd argument.

Repository contains a single primary Python exploit script, a README, and a requirements file. The main file, CVE-2026-63030.py, is a standalone Python exploit targeting a WordPress REST API route-confusion vulnerability chained with SQL injection. Based on the visible code and README, the exploit workflow is: initialize an HTTP session, probe /wp-json/ to confirm WordPress REST API exposure, test /wp-json/wp/v2/batch, send a timing-based SQLi payload using a crafted batch sub-request to /wp/v2/posts, and if successful proceed to post-exploitation steps. Those post-exploitation capabilities include creating a WordPress administrator account, logging in, deploying a PHP webshell/plugin, executing arbitrary commands, offering an interactive shell loop, and optionally cleaning up the created admin account and shell artifacts. The exploit is not part of a known framework; it is a custom standalone tool using the requests library. The code uses a fixed browser-like User-Agent, optional HTTP/HTTPS proxy support, disabled TLS verification, and command-line modes for testing, exploitation, shell access, and cleanup. Overall, this is an operational exploit chain for unauthenticated web compromise of vulnerable WordPress versions, escalating from REST API abuse and SQL injection to authenticated persistence and remote command execution.

Repository contains a single substantial Python exploit script (wp2shell.py) plus documentation. The tool targets a chained pre-authentication WordPress exploit affecting versions 6.9.0–6.9.4 and 7.0.0–7.0.1 by combining CVE-2026-63030 (REST API batch route confusion leading to SQL injection) with CVE-2026-60137 (customizer changeset re-entry / privilege escalation). The script is a standalone CLI utility, not tied to a common exploitation framework. The exploit supports four operational modes: check (passive vulnerability confirmation), read (SQL-based arbitrary data extraction, including credential dumping presets), exploit (full unauthenticated admin creation followed by webshell deployment and command execution), and shell (authenticated webshell deployment using supplied admin credentials). This makes it more than a simple PoC; it is an operational exploit with built-in post-exploitation capability. The documented chain abuses the /batch/v1 REST endpoint to desynchronize validation and dispatch, then routes requests across mismatched handlers. It uses /wp/v2/widgets as a validation source route and /wp/v2/posts, /wp/v2/categories, and /wp/v2/users as mis-dispatched targets. SQL injection is achieved through author__not_in and related query parameters, with per_page=500 specifically chosen to avoid split-query behavior so UNION-selected fake rows poison WordPress object cache. The poisoned cache is then used to trigger changeset publication, temporary admin context, REST re-entry, and finally unauthenticated administrator creation. For full RCE, the exploit requires environmental conditions noted in the script header and README: at least one published post, no persistent object cache such as Redis or Memcached, and REST API accessibility via pretty permalinks or ?rest_route=. Once elevated, the tool deploys a plugin-based webshell and can execute either a single command or interactive shell commands. Overall, the repository is a focused, single-file Python exploit implementing end-to-end unauthenticated compromise of vulnerable WordPress instances.

Repository contains a small, self-contained exploit lab for the WordPress 'wp2shell' chain. Structure is simple: README.md explains the vulnerability chain and lab usage, docker-compose.yml provisions a vulnerable local environment, and exploit.py is the main Python exploit using only the standard library. The exploit targets two chained issues in WordPress Core: CVE-2026-63030 (REST API batch route confusion in /batch/v1) and CVE-2026-60137 (SQL injection in WP_Query author__not_in when a string is accepted instead of an array). The Python script builds a nested batch payload with a malformed primer path `///` to desynchronize validation and dispatch arrays. This lets a POST request validated as `/wp/v2/posts` be dispatched as `/batch/v1`, effectively smuggling inner GET requests that would normally fail schema validation. A second desync causes `GET /wp/v2/users?author_exclude=<payload>` to execute under the posts controller, reaching the vulnerable author__not_in SQL sink. Operationally, the script supports exploit confirmation, boolean-based or time-based blind SQLi, arbitrary SQL expression extraction via `--sql`, database fingerprinting, and dumping WordPress user IDs, logins, and password hashes from the users table. It tracks request counts and offers verbose output. The code appears to stop at credential/hash extraction; the README describes the broader path to RCE as offline cracking of the leaked bcrypt hashes followed by authenticated `/wp-admin` access and malicious plugin upload. The docker-compose lab stands up MySQL 8.0 and WordPress 7.0.1 on localhost:8080, plus a WP-CLI helper that installs WordPress, creates admin and victim administrator accounts, and ensures at least one published post exists so the boolean oracle has observable results. Overall, this is a real exploit repository with runnable code and a reproducible vulnerable environment, best classified as an operational unauthenticated web exploit for pre-auth SQLi and credential extraction against vulnerable WordPress Core.

Repository contains an operational Python exploit toolkit plus a demo vulnerable WordPress plugin and Docker lab. The main PoC (cve-2026-63030_poc.py) targets a chain between CVE-2026-60137 (SQL injection in WP_Query::get_posts via unsanitized author__not_in when treated as a string) and CVE-2026-63030 (REST batch endpoint route confusion allowing unauthenticated subrequests). It detects WordPress and REST exposure, probes /wp-json/batch/v1, and supports quick time-based SQLi checks, user/database dumping, arbitrary query execution, blind extraction, and multiple RCE-oriented paths such as admin creation and file/webshell techniques. The second Python tool (wp-hunter.py) expands this into an automated scanner/exploiter: it discovers REST roots, checks vulnerable version ranges, enumerates custom REST namespaces/endpoints, fuzzes WP_Query-related parameters, confirms likely vulnerable routes, and then exploits them with options for webshell write, file read, admin creation, and cookie-forging workflows. The PHP file (vuln-plugin.php) is a deliberately vulnerable demo plugin registering the unauthenticated route vuln-demo/v1/search with allow_batch enabled and directly passing author__not_in/author_exclude into WP_Query, illustrating the exact sink required by the chain. docker-compose.yml provisions a reproducible lab using wordpress:7.0.1-php8.2-apache and mysql:8.0, exposing WordPress on localhost:8080. Overall purpose: demonstrate and automate exploitation of an unauthenticated WordPress SQLi-to-RCE chain via REST batch abuse and vulnerable plugin/theme endpoints.

This repository is a defensive research and lab project centered on the WordPress wp2shell chain: CVE-2026-63030 (REST batch endpoint array desync / wrong-handler dispatch) and CVE-2026-60137 (WP_Query author__not_in SQL injection). It is not a weaponized exploit repo and does not include a working RCE payload; instead it provides a safe proof-of-concept for the batch desync, a safe SQLi sink demonstration, patch/restore tooling, and detection/mitigation content. Repository structure: the top level contains a GitHub Pages/Jekyll writeup site (README.md, index.md, analysis/*.md, _layouts/default.html, playground.html). The analysis documents explain the bug mechanism, detection guidance, indicators, mitigations, and the SQLi chain at a conceptual level. The interactive playground.html reproduces the array desync logic client-side in JavaScript. The practical lab lives under batch-rce-lab/. docker-compose.yml provisions a local-only environment with MariaDB, a real vulnerable WordPress image (wordpress:7.0.1-php8.3-apache), and a wp-cli installer. setup/wp-setup.sh installs WordPress and disables pretty permalinks so the batch endpoint is reachable via ?rest_route=. probe.sh is the main live PoC: it POSTs JSON to /?rest_route=/batch/v1 using a malformed sub-request path (http://:) followed by /wp/v2/settings and a nonexistent route, then determines vulnerability by observing whether /wp/v2/settings incorrectly returns rest_no_route instead of rest_batch_not_allowed. demo-desync.php is a standalone PHP model of the vulnerable loop in WP_REST_Server::serve_batch_request_v1(), showing how $matches and $validation become misaligned unless the one-line fix is applied. For the second CVE, sqli/lab-author-sink.php is a lab-only mu-plugin that forwards a request parameter into WP_Query author__not_in, modeling the real-world precondition of a vulnerable plugin/theme. sqli/probe-sqli.sh deploys that sink and sends a benign marker to show whether unsanitized input reaches SQL by causing only a benign DB syntax/error condition. apply-fix.sh and restore-vuln.sh toggle the vulnerable/patched state by editing or restoring the two affected WordPress core files: class-wp-rest-server.php and class-wp-query.php. Detection and mitigation artifacts are included in batch-rce-lab/detect/ and batch-rce-lab/mitigate/. These include a non-destructive Nuclei template for CVE-2026-63030, Sigma rules for batch abuse and SQLi indicators, a mu-plugin that blocks anonymous batch requests, and WAF snippets for nginx, Apache, and ModSecurity. Main exploit capability: safe confirmation of the pre-auth batch desync against vulnerable WordPress via observable response-code confusion on the batch endpoint. Secondary capability: safe confirmation that unsanitized author__not_in input reaches SQL in vulnerable core when a sink exists. Overall, the repo’s purpose is education, validation, detection engineering, and mitigation testing for the WordPress wp2shell vulnerability chain.

Repository contains a small standalone exploit toolkit for WordPress REST API batch-route confusion and blind SQL injection associated with CVE-2026-63030 and CVE-2026-60137. Structure is simple: a Python CLI exploit (cve-2026-63030.py), a Nuclei detection template (cve-2026-63030.yaml), a README, and .gitignore. The Python script is the main exploit component. It uses requests and BeautifulSoup, supports single-target and bulk scanning, optional HTTP proxying, configurable concurrency, timeout, and delay values. Its workflow is: normalize target URLs, fetch the homepage, parse the generator meta tag to identify WordPress version, compare against hardcoded affected ranges, probe REST availability, resolve the preferred batch endpoint order (/wp-json/batch/v1 then /?rest_route=/batch/v1), and send crafted nested JSON batch bodies that exploit route confusion. The payload builder places a URL-encoded SQL injection into the author_exclude parameter of a nested REST request. The script can either confirm exploitation with a SLEEP-based timing oracle or exfiltrate arbitrary SQL query output via blind extraction logic. Based on the visible code and README, this is an operational SQLi exploitation tool rather than a full post-exploitation RCE implant. The Nuclei YAML is an active detection template, not a full exploit. It first checks whether the target looks like WordPress, then sends two POST requests to the fallback batch endpoint using crafted nested requests: one false condition expected to return quickly and one true condition expected to delay for at least 7 seconds. It uses HTTP 207 responses, JSON content type, and timing behavior as confirmation signals. Notable fingerprintable targets are the WordPress REST batch endpoints (/wp-json/batch/v1 and /?rest_route=/batch/v1), REST probe /?rest_route=/, and nested API routes such as /wp/v2/posts, /wp/v2/users, /wp/v2/categories, and /wp/v2/block-renderer/core/archives. The exploit is clearly web/network based, unauthenticated, and intended to identify and exploit vulnerable WordPress instances for blind SQL data extraction.

Repository contains a single Python exploit script and a README. The script is a standalone stdlib-only WordPress exploit chain targeting CVE-2026-63030 and CVE-2026-60137. Its structure includes an HTTP client with cookie handling and optional proxy support, a route-confusion/SQLi phase that abuses the REST batch endpoint at /?rest_route=/batch/v1, logic for UNION-based data extraction from wp_posts-backed responses, pre-auth administrator creation via forged posts/customizer/oEmbed side effects, authentication into wp-admin, and a webshell deployment/execution phase. Exposed operator modes include --check, --dump-users, --read, --cmd, --shell, and credential-based shortcut options. The exploit’s main capability is unauthenticated RCE against vulnerable WordPress versions by chaining REST request desynchronization, SQL injection, admin creation, and theme-file modification. It is not merely a detector: it includes full post-exploitation, command execution, interactive shell support, and cleanup routines.

Repository contains a single substantial Python script, `wp2shell-scanner.py`, plus a README and dependency file. The tool is a standalone CLI scanner/PoC for a claimed WordPress vulnerability chain affecting specific WordPress versions tied to CVE-2026-63030 and CVE-2026-60137. It is not part of a major exploit framework. Structure and purpose: the Python script implements terminal/UI helpers, URL normalization, target list loading, concurrent scanning with `ThreadPoolExecutor`, result aggregation, and JSON export. The README describes a workflow that first fingerprints WordPress through public HTML/header/REST evidence, then checks REST batch behavior and performs repeated timing-based probes for active confirmation. If `--poc` is enabled and the target is actively confirmed, the tool attempts a state-changing command-verification PoC, executing `whoami` by default or a user-provided command. Main exploit capabilities: (1) single-target and multi-target scanning, (2) WordPress detection and version fingerprinting, (3) active timing-differential confirmation of the vulnerability chain, (4) optional remote command execution verification, (5) concurrent operation and JSON reporting. Because it includes an optional command-execution PoC rather than pure detection alone, it should be treated as an exploit-capable research tool rather than only a detector. Notable observables/endpoints: the code clearly handles HTTP/HTTPS targets and normalizes scheme-less input to `http://`. The repository references WordPress REST probing, including `?rest_route=/`, and verbose PoC output may expose the `X-Action-Redirect` response header. Example target URLs and local file paths for input/output are present in the README. Overall maturity appears OPERATIONAL: it is a usable standalone tool with a built-in, basic command-execution PoC, but not obviously a modular weaponized framework.

Repository contains a compact exploit toolkit with 3 files: a large standalone Python script (wp2shell.py), a Nuclei exposure template (wp2shell-exposure.yaml), and a README documenting usage and attack flow. The Python script is the main artifact and implements several modes: non-destructive scanning, blind SQLi validation, blind SQL data extraction, authenticated RCE using recovered admin credentials, credential-less pre-auth RCE by forging an administrator and deploying a self-cleaning webshell/plugin, root-prerequisite diagnostics, and a full Linux LPE chain. The Nuclei template is limited to detection/fingerprinting and checks the homepage, RSS feed, and REST batch route for vulnerable WordPress versions and exposed /batch/v1 behavior. The exploit targets WordPress core vulnerabilities CVE-2026-60137 (pre-auth blind SQLi via REST batch route confusion / author__not_in path) and CVE-2026-63030 (unauthenticated RCE via admin forge + webshell upload). README and script also describe optional post-exploitation privilege escalation attempts against Linux using CVE-2023-2640/CVE-2023-32629, CVE-2023-4911, and CVE-2024-1086, plus SUID/sudo fallback. Overall, this is not just a detector: it is a multi-stage operational exploit chain with customizable command execution and optional interactive shell behavior.

Repository contains a single Python exploit script (exploit.py) and a README. The script is a standalone, standard-library-only operational PoC for a pre-authenticated remote code execution chain against vulnerable WordPress Core versions. It is not part of a larger exploit framework. Structure and purpose: - README.md documents the vulnerability chain, affected versions, usage, mitigation, and expected output. - exploit.py is the main entry point and implements the full attack workflow plus a re-use mode for an already deployed shell. Main exploit capabilities: 1. Verifies the WordPress REST batch endpoint is reachable and that route-confusion/desynchronization works. 2. Uses nested batch request confusion to bypass schema sanitization and reach the vulnerable WP_Query author_exclude/author__not_in path. 3. Performs UNION-based SQL injection to extract database version, DB user, DB name, table prefix, and administrator credential material reflected in REST JSON responses. 4. Uses the SQLi primitive to create a fresh administrator account by poisoning oEmbed/cache-related rows and triggering a WordPress Customizer changeset publish path that results in wp_insert_user() with administrator role. 5. Logs into wp-admin with the created credentials, uploads a ZIP containing a single-file PHP plugin webshell, activates it, and executes arbitrary OS commands. 6. Supports a re-use mode where the operator supplies prior admin credentials and the deployed plugin path to skip the SQLi/admin-creation phases and directly run commands. Operational characteristics: - Attack vector is remote web/network exploitation over HTTP(S). - The exploit accepts a target URL, command to execute, and an insecure TLS option for self-signed certificates. - It appears to manage cookies/session state for authenticated wp-admin actions and dynamically generates usernames/passwords/plugin slugs. - The payload is basic but functional: a hardcoded PHP webshell plugin uploaded through legitimate WordPress admin functionality. Overall, this is a real exploit repository implementing an end-to-end unauthenticated WordPress RCE chain, not merely a detector or README-only proof.

Repository contains a complete exploit-and-mitigation toolkit for a claimed WordPress Core pre-auth RCE chain combining CVE-2026-63030 (REST API batch route confusion) and CVE-2026-60137 (SQL injection). Structure is split into two main directories: wp2shell-exploit/ with offensive tooling and wp2shell-patch/ with defensive mitigations, plus Docker assets for a local vulnerable lab. The offensive side includes three Python scripts. detect.py is a non-destructive scanner that probes the REST batch endpoint using malformed nested requests and optionally confirms SQL injection with a timing oracle based on author_exclude and SQL SLEEP(). exploit.py is the main unauthenticated RCE chain: it targets /?rest_route=/batch/v1, abuses nested batch desync to reach public handlers with attacker-controlled GET requests, uses blind SQLi to extract data and support UNION-based write/cache-poisoning primitives, escalates privileges by causing a re-entrant REST dispatch under admin context, creates a new administrator via /wp/v2/users, then logs in and uploads a malicious plugin ZIP through wp-admin/update.php?action=upload-plugin. That plugin exposes a random REST route used as a webshell for arbitrary command execution. exploit_hash.py provides an alternate path that extracts password hashes via the same blind SQLi primitive and then, once cracked credentials are supplied, performs authenticated plugin upload and command execution. The exploit’s main capabilities are: vulnerability detection, timing-based SQLi confirmation, arbitrary database extraction, admin account creation, authenticated plugin deployment, and OS command execution. The code uses only Python standard library modules and disables TLS certificate verification, indicating ease of use against arbitrary HTTPS targets. The defensive side includes patch.sh, which modifies WordPress core files to add batch-array alignment, REST re-entrancy guards, and author__not_in sanitization; wp2shell-shield.php, a mu-plugin that blocks unauthenticated access to /batch/v1; and web-server rules for Nginx and Apache to block batch endpoints. docker-compose.yml and Dockerfile.debug provide a reproducible WordPress 7.0.1 + MariaDB lab with Xdebug tracing for research. Overall, this is a real exploit repository rather than a simple detector or README-only project. It is best classified as OPERATIONAL: it contains working exploit logic and a hardcoded attack flow, but it is not embedded in a larger exploitation framework.

This repository contains a single-file Python exploit, `WordPresShell.py`, plus a README and two Docker Compose lab files for vulnerable and fixed WordPress environments. The exploit is not part of a larger framework and is implemented with Python standard library modules only. Its purpose is to weaponize a chained WordPress core attack path targeting CVE-2026-63030 and CVE-2026-60137. According to the code comments and README, the chain abuses the REST batch endpoint (`/batch/v1`) via request desynchronization/route confusion, then reaches a `WP_Query author__not_in` SQL injection primitive. That SQLi is used for in-band data extraction and to support a crack-free privilege escalation flow that forges application state to create a new administrator account without authentication. After that, the script authenticates as the created admin (or uses supplied admin credentials), uploads a webshell plugin, and executes arbitrary commands on the server. Repository structure: - `WordPresShell.py`: main exploit implementation and CLI entry point. - `README.md`: usage examples, affected/fixed versions, and lab notes. - `docker-compose.yml`: vulnerable WordPress 7.0.1 + MariaDB lab on port 8092. - `docker-compose.fixed.yml`: fixed WordPress 7.0.2 + MariaDB lab on port 8093. - `.gitignore`: standard Python ignores. Exploit capabilities exposed by the CLI: - `check`: non-destructive verification of likely vulnerability. - `dump`: SQL extraction / arbitrary scalar query execution via the SQLi primitive. - `shell`: full exploitation path leading to admin creation, webshell deployment, and command execution; also supports interactive mode and optional existing admin credentials. Notable implementation details visible in the code snippet: - The `Client` class automatically chooses between `/wp-json/batch/v1` and `/?rest_route=/batch/v1`. - Requests are sent as JSON POST bodies to the batch endpoint. - The script includes logic for authentication, deployment of a webshell plugin, and execution of commands after successful compromise. Overall, this is a real operational exploit PoC for unauthenticated WordPress core compromise leading to RCE, not merely a detector. It includes both exploitation and post-exploitation steps, but payload customization appears limited to command execution through the uploaded shell rather than a modular framework, so OPERATIONAL is the best maturity fit.