wp2shell

wp2shell - WordPress RCE PoC CVE-2026-63030 + CVE-2026-60137 WordPress 核心中的未认证远程代码执行 作者：JohenLastGen 📌 概述 该工具利用两个关键的 WordPress 漏洞链实现 未认证 RCE ： 漏洞| CVE| 描述 ---|---|--- REST 批量路由混淆| CVE-2026-63030| 绕过验证，传输 SQLi 载荷 WPQuery authornotin SQL 注入| CVE-2026-60137| 原始字符串注入 → SQL 执行 影响： 未认证攻击者 → 创建管理员 → 执行命...

CVE-2026-63030

CVE-2026-63030 + CVE-2026-60137 — WP2Shell WordPress Core Pre-Auth RCE via REST Batch Route Confusion + SQLi Übersicht CVE-2026-63030 CVSS 9.8 und CVE-2026-60137 CVSS 9.1 bilden eine kritische Pre-Authentifizierung-Remote-Code-Execution-Kette im WordPress Core. Die Schwachstellen betreffen alle...

wp2shell

wp2shell-check Nicht-intrusiver Prüfer für CVE-2026-63030 / CVE-2026-60137 "wp2shell", eine Pre-Authentifizierungs-RCE-Kette im WordPress-Kern REST-API-Batch-Routen-Konfusion → SQL-Injection → RCE. Betroffen: WordPress 6.9.0–6.9.4, 7.0.0–7.0.1, 7.1 beta vollständige RCE-Kette; 6.8.0–6.8.5 nur...

wp-cve-2026-63030-check

wp2shell-check Verificatore di esposizione non intrusivo per la catena RCE pre-autenticazione "wp2shell" di WordPress CVE-2026-63030 + CVE-2026-60137. ⚠️ Solo uso autorizzato. Esegui questo strumento solo su istanze WordPress di tua proprietà o per le quali hai esplicita autorizzazione al test. È...

wp2shell-scanner

wp2shell-scanner von@bahartanir katherinepierce Fork von ZephrFish/wp2shell-scanner mit zusätzlichen Verbesserungen. Forschung von Adam Kues Assetnote und Mustafa Can İPEKÇİ nukedx. Erkennungs- und Validierungswerkzeuge für die Offenlegung des WordPress-Kerns gegenüber wp2shell CVE-2026-63030 /...

WordPresShell

WordPresShell PoC de RCE pré-auth para CVE-2026-63030 + CVE-2026-60137 núcleo do WordPress. Confusão de rota REST /batch/v1 → SQLi via WPQuery authornotin → criação de admin sem autenticação → webshell. Arquivo único, apenas com stdlib do Python. Vulnerabilidade: Adam Kues Searchlight Cyber...

📄 WordPress 7.0.1 Remote Code Execution

A proof of concept exploit for WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 that contain an unauthenticated remote code execution vulnerability. The exploit chains a REST API batch route confusion vulnerability with a SQL injection vulnerability to write a PHP web shell to the w...

wp2shell

wp2shell-check Non-intrusive checker for CVE-2026-63030 /...

wp2shell-PoC

wp2shell — CVE-2026-63030 + CVE-2026-60137 WordPress Pre-Auth...

Exploit for CVE-2026-60137

wp2shell-lab Educational PoC and lab for CVE-2026-63030 + C...

Exploit for CVE-2026-63030

WordPress REST API Batch Route Confusion + SQL Injection → RCE...

Exploit for CVE-2026-63030

wp2shell-poc Proof-of-concept for an unauthenticated SQL inje...

CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

PT-2026-60856

Name of the Vulnerable Software and Affected Versions WordPress versions 6.9.0 through 6.9.4 WordPress versions 7.0.0 through 7.0.1 Description A route confusion issue in the REST API batch endpoint, combined with a SQL injection in the WP Query class, allows a remote attacker to execute arbitrar...