44 matches found
📄 WordPress 7.0.1 Remote Code Execution
A proof of concept exploit for WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 that contain an unauthenticated remote code execution vulnerability. The exploit chains a REST API batch route confusion vulnerability with a SQL injection vulnerability to write a PHP web shell to the w...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal in Utils.writeToTempFile in the REST batch multipart upload handling code. An attacker can write controlled content outside the intended upload directory by supplying a multipart filename containing traversal sequenc...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal in Utils.writeToTempFile in the REST batch multipart upload handling code. An attacker can write controlled content outside the intended upload directory by supplying a multipart filename containing traversal sequenc...
CVE-2026-52680 Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write
Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the REST batch upload endpoint can provide path traversal sequences in the filename and cause the Kyuubi server process to...
CVE-2026-52680: Improper Limitation of a Pathname to a Restricted Directory
Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the REST batch upload endpoint can provide path traversal sequences in the filename and cause the Kyuubi server process to...
BIT-WORDPRESS-2026-63030 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...
Exploit for Interpretation Conflict in Wordpress
CVE-2026-63030 + CVE-2026-60137 — WP2Shell WordPress Core Pre-Au...
WordPress wp2shell RCE (CVE-2026-63030 + CVE-2026-60137)
Exploits CVE-2026-63030 REST batch route confusion chained with CVE-2026-60137 WPQuery authornotin SQLi on WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1: unauthenticated administrator creation, plugin upload, and command execution. Patched in 6.9.5 and 7.0.2. !/usr/bin/env python3 -- coding: utf-8 --...
Exploit for CVE-2026-63030
CVE-2026-63030 — WordPress wp2shell Exploit Unauthenticated d...
Exploit for CVE-2026-60137
wp2shell-detect Blackbox, non-intrusive detector for wp...
wp2shell_stock_chain
wp2shell stock-core chain Authorized-testing proof of concept...
wp2shell
wp2shell WordPress REST batch route-confusion blind SQL injec...
wp2shell
wp2shell-check Non-intrusive checker for CVE-2026-63030 /...
wp2shell-PoC
wp2shell — CVE-2026-63030 + CVE-2026-60137 WordPress Pre-Auth...
Exploit for CVE-2026-60137
wp2shell-lab Educational PoC and lab for CVE-2026-63030 + C...
Exploit for CVE-2026-63030
wp2shell CVE-2026-63030 + CVE-2026-60137: Independent Root C...
Exploit for CVE-2026-63030
WordPress REST API Batch Route Confusion + SQL Injection → RCE...
Exploit for CVE-2026-63030
wp2shell-poc Proof-of-concept for an unauthenticated SQL inje...
CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core
Overview On July 17, 2026, a GitHub Security Advisory was published for CVE-2026-63030, a critical unauthenticated remote code execution vulnerability affecting WordPress Core. While the official GitHub security advisory classifies the severity as Critical, the vulnerability has currently been...