wp2shell

wp2shell-check Неинвазивная проверка для CVE-2026-63030 / CVE-2026-60137 «wp2shell», цепочки pre-authentication RCE в ядре WordPress конфуз batch-route в REST API → SQL-инъекция → RCE. Затронуты: WordPress 6.9.0–6.9.4, 7.0.0–7.0.1, 7.1 beta полная цепочка RCE; 6.8.0–6.8.5 только SQL-инъекция,...

wp2shell

wp2shell - WordPress RCE PoC CVE-2026-63030 + CVE-2026-60137 WordPress Core에서 인증되지 않은 원격 코드 실행 제작: JohenLastGen 📌 개요 이 도구는 두 가지 치명적인 WordPress 취약점을 연계하여 인증되지 않은 RCE 를 달성합니다: 취약점| CVE| 설명 ---|---|--- REST 배치 라우트 혼동| CVE-2026-63030| 검증 우회, SQLi 페이로드 밀반입 WPQuery authornotin SQLi| CVE-2026-60137| 원시...

wp2shell-scanner

wp2shell-scanner от@bahartanir katherinepierce Форк ZephrFish/wp2shell-scanner с дополнительными улучшениями. Исследование: Adam Kues Assetnote и Mustafa Can İPEKÇİ nukedx. Инструменты обнаружения и валидации для проверки ядра WordPress на подверженность wp2shell CVE-2026-63030 / CVE-2026-60137...

wp-cve-2026-63030-check

wp2shell-check Vérificateur d'exposition non intrusif pour la chaîne RCE pré-authentification "wp2shell" de WordPress CVE-2026-63030 + CVE-2026-60137. ⚠️ Utilisation autorisée uniquement. Exécutez ceci uniquement sur des instances WordPress que vous possédez ou pour lesquelles vous avez une...

WordPresShell

WordPresShell Доаутентификационный PoC RCE для CVE-2026-63030 + CVE-2026-60137 ядро WordPress. Путаница маршрутов REST /batch/v1 → SQLi WPQuery authornotin → создание неаутентифицированного администратора → вебшелл. Один файл, только стандартная библиотека Python. Уязвимость: Adam Kues Searchligh...

CVE-2026-63030

CVE-2026-63030 + CVE-2026-60137 — WP2Shell RCE без аутентификации в ядре WordPress через путаницу пакетных маршрутов REST + SQLi Обзор CVE-2026-63030 CVSS 9.8 и CVE-2026-60137 CVSS 9.1 образуют критическую цепочку удалённого выполнения кода без аутентификации в ядре WordPress. Уязвимости...

📄 WordPress 7.0.1 Remote Code Execution

A proof of concept exploit for WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 that contain an unauthenticated remote code execution vulnerability. The exploit chains a REST API batch route confusion vulnerability with a SQL injection vulnerability to write a PHP web shell to the w...

wp2shell

wp2shell-check Non-intrusive checker for CVE-2026-63030 /...

wp2shell-PoC

wp2shell — CVE-2026-63030 + CVE-2026-60137 WordPress Pre-Auth...

Exploit for CVE-2026-60137

wp2shell-lab Educational PoC and lab for CVE-2026-63030 + C...

Exploit for CVE-2026-63030

WordPress REST API Batch Route Confusion + SQL Injection → RCE...

Exploit for CVE-2026-63030

wp2shell-poc Proof-of-concept for an unauthenticated SQL inje...

CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion

WordPress core 6.9.0 - 6.9.4 and 7.0.0 - 7.0.1 are affected by an unauthenticated SQL injection reachable through the REST API batch endpoint /batch/v1. The batch controller builds parallel $matches the matched handler per sub-request and $validation the validation result per sub-request arrays,...

PT-2026-60856

Name of the Vulnerable Software and Affected Versions WordPress versions 6.9.0 through 6.9.4 WordPress versions 7.0.0 through 7.0.1 Description A route confusion issue in the REST API batch endpoint, combined with a SQL injection flaw in the WP Query class, allows a remote attacker to execute...