33 matches found
wp2shell
wp2shell-check Nicht-intrusiver Prüfer für CVE-2026-63030 / CVE-2026-60137 "wp2shell", eine Pre-Authentifizierungs-RCE-Kette im WordPress-Kern REST-API-Batch-Routen-Konfusion → SQL-Injection → RCE. Betroffen: WordPress 6.9.0–6.9.4, 7.0.0–7.0.1, 7.1 beta vollständige RCE-Kette; 6.8.0–6.8.5 nur...
CVE-2026-60137_CVE-2026-63030
CVE-2026-60137 + CVE-2026-63030 — WordPress-RCE ohne Authentifizierung Schwachstelle: REST-Batch-Routenkonfusion + WPQuery SQL Injection → Vollständige RCE CVSS v3.1: 10.0 / 10.0 — KRITISCH | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Betroffen: WordPress 6.9.0–6.9.4, 7.0.0–7.0.1 | Behoben: 6.9.5, 7.0.2...
wp2shell
wp2shell - PoC de RCE no WordPress CVE-2026-63030 + CVE-2026-60137 Execução Remota de Código não Autenticada no WordPress Core por: JohenLastGen 📌 Visão Geral Esta ferramenta encadeia duas vulnerabilidades críticas do WordPress para obter RCE não autenticado : Vulnerabilidade| CVE| Descrição...
wp2shell-poc2
wp2shell-poc Prova de conceito para uma injeção de SQL não autenticada no núcleo do WordPress que encadeia até execução remota de código, por meio de confusão de rota no lote REST CVE-2026-63030. O exploit não exige credenciais nem configuração além de um alvo acessível. Ele alcança a injeção por...
CVE-2026-63030
CVE-2026-63030 + CVE-2026-60137 — WP2Shell WordPress Core RCE pre-autenticazione tramite confusione delle route batch REST + SQLi Panoramica CVE-2026-63030 CVSS 9.8 e CVE-2026-60137 CVSS 9.1 formano una catena critica di esecuzione remota di codice pre-autenticazione in WordPress Core. Le...
CVE-2026-63030
CVE-2026-63030 Proof of Concept per l'SQL Injection da Route-Confusion nel Batch REST di WordPress CVE-2026-63030 Ricerca, sviluppo dell'exploit e documentazione a cura diCh4120N ⚠️ Disclaimer Legale Questo repository e il relativo strumento exploit.py sono destinati esclusivamente a scopi...
WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion
WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...
wp2shell
wp2shell — RCE pre-auth nel core di WordPress PoC di RCE non autenticata nel core di WordPress che combina CVE-2026-63030 + CVE-2026-60137. Solo test autorizzati. wp2shell.py è una proof of concept a file singolo, basata solo sulla libreria standard, che incatena due vulnerabilità del core di...
wordpress-skelersecurity-core-security-CVE-2026-63030
Plugin di Sicurezza Core SkelerSecurity Una mitigazione temporanea e mirata per l'accesso non autenticato all'endpoint REST Batch API di WordPress Core. Panoramica Plugin di Sicurezza Core SkelerSecurity richiede l'autenticazione prima che WordPress elabori le richieste all'endpoint Core REST Bat...
wp2shell-checker
root@kitploit: \ \ / / \ / || | | | | | | | \ \ /\ / /| | | \ | || | | | | | | \ V V / | // / | | || || | // || ||/|| ||||| wp2shell-checker | WordPress Batch API Desync Detector Rivelatore checker per la RCE pre-auth della REST Batch API del WordPress Core Creato da 0xjessie21 — Cybersecurity...
wp2shell-scanner
wp2Shell Scanner – mit PoC CVE-2026-63030 und CVE-2026-60137 – Scanner für die WordPress-wp2shell-Schwachstellenkette Autorisiertes Sicherheitsforschungstool mit optionalem Befehlsverifizierungs-PoC. wp2shell-scanner erkennt die WordPress-wp2shell-Schwachstellenkette, indem es öffentliche...
wp-cve-2026-63030-check
wp2shell-check Verificatore di esposizione non intrusivo per la catena RCE pre-autenticazione "wp2shell" di WordPress CVE-2026-63030 + CVE-2026-60137. ⚠️ Solo uso autorizzato. Esegui questo strumento solo su istanze WordPress di tua proprietà o per le quali hai esplicita autorizzazione al test. È...
wp2shell-detect
wp2shell-detect Blackbox, rilevatore non intrusivo per wp2shell — la catena RCE pre-autenticazione nel core di WordPress divulgata il 2026-07-17: CVE-2026-63030 — confusione di route nell'endpoint REST batch /wp-json/batch/v1: una sub-request il cui percorso fa fallire wpparseurl finisce nell'arr...
wp2shell-scanner
wp2shell-scanner von@bahartanir katherinepierce Fork von ZephrFish/wp2shell-scanner mit zusätzlichen Verbesserungen. Forschung von Adam Kues Assetnote und Mustafa Can İPEKÇİ nukedx. Erkennungs- und Validierungswerkzeuge für die Offenlegung des WordPress-Kerns gegenüber wp2shell CVE-2026-63030 /...
WordPresShell
WordPresShell PoC de RCE pré-auth para CVE-2026-63030 + CVE-2026-60137 núcleo do WordPress. Confusão de rota REST /batch/v1 → SQLi via WPQuery authornotin → criação de admin sem autenticação → webshell. Arquivo único, apenas com stdlib do Python. Vulnerabilidade: Adam Kues Searchlight Cyber...
📄 WordPress 7.0.1 Remote Code Execution
A proof of concept exploit for WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 that contain an unauthenticated remote code execution vulnerability. The exploit chains a REST API batch route confusion vulnerability with a SQL injection vulnerability to write a PHP web shell to the w...
CVE-2026-52680 Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write
Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the REST batch upload endpoint can provide path traversal sequences in the filename and cause the Kyuubi server process to...
BIT-WORDPRESS-2026-63030 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...
