44 matches found
wp2shell-checker
\ \ / / \ / || | | | | | | | \ \ /\ / /| | | \ | || | | | | | | \ V V / | // / | | || || | // || ||/|| ||||| wp2shell-checker | WordPress Batch API Desync Detector Checker detector for the WordPress Core REST Batch API pre-auth RCE Created by 0xjessie21 — Cybersecurity ILCS Overview | ---|---...
wp2shell-scanner
wp2Shell Scanner – with PoC CVE-2026-63030 and CVE-2026-60137 – WordPress wp2shell vulnerability-chain scanner Authorized security-research tool with optional command-verification PoC. wp2shell-scanner detects the WordPress wp2shell vulnerability chain by validating public WordPress evidence,...
wordpress-skelersecurity-core-security-CVE-2026-63030
SkelerSecurity Core Security Plugin A focused, temporary mitigation for unauthenticated access to WordPress Core’s REST Batch API endpoint. Overview SkelerSecurity Core Security Plugin requires authentication before WordPress processes requests to the Core REST Batch API route: /wp-json/batch/v1...
wp2shell-detect
wp2shell-detect Blackbox, non-intrusive detector for wp2shell — the pre-authentication RCE chain in WordPress core disclosed on 2026-07-17: CVE-2026-63030 — route confusion in the REST batch endpoint /wp-json/batch/v1: a sub-request whose path fails wpparseurl lands in the validation array but no...
wp2shell
wp2shell-check Non-intrusive checker for CVE-2026-63030 / CVE-2026-60137 "wp2shell", a pre-authentication RCE chain in WordPress core REST API batch-route confusion → SQL injection → RCE. Affected: WordPress 6.9.0–6.9.4, 7.0.0–7.0.1, 7.1 beta full RCE chain; 6.8.0–6.8.5 SQL injection only,...
wp2shell
wp2shell - WordPress RCE PoC CVE-2026-63030 + CVE-2026-60137 Unauthenticated Remote Code Execution in WordPress Core by: JohenLastGen 📌 Overview This tool chains two critical WordPress vulnerabilities to achieve unauthenticated RCE : Vulnerability| CVE| Description ---|---|--- REST Batch Route...
WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion
WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...
wp2shell-scanner
wp2shell-scanner by@bahartanir katherinepierce Fork of ZephrFish/wp2shell-scanner with additional improvements. Research by Adam Kues Assetnote and Mustafa Can İPEKÇİ nukedx. Detection and validation tooling for WordPress core exposure to wp2shell CVE-2026-63030 / CVE-2026-60137. Modes are select...
wp2shell-poc2
wp2shell-poc Proof-of-concept for an unauthenticated SQL injection in WordPress core that chains to remote code execution, via REST batch route confusion CVE-2026-63030. The exploit needs no credentials and no configuration beyond a reachable target. It reaches the injection through a single...
wp-cve-2026-63030-check
wp2shell-check Non-intrusive exposure checker for the WordPress "wp2shell" pre-authentication RCE chain CVE-2026-63030 + CVE-2026-60137. ⚠️ Authorized use only. Run this only against WordPress instances you own or have explicit permission to test. It is a triage aid, not an exploit. Scanning...
WordPresShell
WordPresShell Pre-auth RCE PoC for CVE-2026-63030 + CVE-2026-60137 WordPress core. REST /batch/v1 route confusion → WPQuery authornotin SQLi → unauthenticated admin creation → webshell. Single file, Python stdlib only. Vulnerability: Adam Kues Searchlight Cyber. Affected: 6.9.0–6.9.4, 7.0.0–7.0.1...
CVE-2026-63030
CVE-2026-63030 WordPress REST Batch Route-Confusion SQL Injection CVE-2026-63030 Proof of Concept Research, Exploit Development & Documentation by Ch4120N ⚠️ Legal Disclaimer This repository and the accompanying tool exploit.py are intended strictly for educational purposes, authorized penetration...
WP2Shell-Scanner
WP2Shell Scanner A command line tool that checks whether a WordPress site is exposed to WP2Shell CVE-2026-63030 and CVE-2026-60137. It reads the WordPress version and REST API surface over read-only requests and reports a verdict. It does not exploit anything. !WARNING For authorised testing only...
wp2shell
wp2shell — Pre-Auth RCE in WordPress core Unauthenticated WordPress core RCE PoC chaining CVE-2026-63030 + CVE-2026-60137. Authorized testing only. wp2shell.py is a single-file, standard-library-only proof of concept that chains two WordPress core vulnerabilities into unauthenticated remote code...
CVE-2026-60137_CVE-2026-63030
CVE-2026-60137 + CVE-2026-63030 — WordPress Unauthenticated RCE Vulnerability: REST Batch Route Confusion + WPQuery SQL Injection → Full RCE CVSS v3.1: 10.0 / 10.0 — CRITICAL | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Affected: WordPress 6.9.0–6.9.4, 7.0.0–7.0.1 | Patched: 6.9.5, 7.0.2 Zero credential...
CVE-2026-63030
CVE-2026-63030 + CVE-2026-60137 — WP2Shell WordPress Core Pre-Auth RCE via REST Batch Route Confusion + SQLi Overview CVE-2026-63030 CVSS 9.8 and CVE-2026-60137 CVSS 9.1 form a critical pre-authentication remote code execution chain in WordPress Core. The vulnerabilities affect all default...
abdal-cve-2026-60137
English | فارسی 🛡️ Abdal CVE-2026-60137 PoC Exploits Abdal CVE-2026-60137 is a defensive WordPress exposure verifier for the insufficient sanitization of the authornotin parameter in WPQuery, tracked as CVE-2026-60137. The vulnerability can allow SQL injection when untrusted input reaches the...
wp2shell-poc
wp2shell-poc Independent proof-of-concept for the unauthentic...