CVE-2026-63030

KO | EN

gitlite — search

#python #llm #go #android #machine-learning #rust #docker #macos #java #kubernetes #vue #pytorch #openai #open-source

(★ 9)

CVE-2026-63030 (wp2shell) POC.

CVE-2026-63030 Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# CVE-2026-63030: wp2shell

**WordPress Batch API Desynchronization SQL Injection Exploit**

Proof of Concept tool for extracting users and password hashes via the CVE-2026-63030 (wp2shell) vulnerability.

---

## Vulnerability Information

- **CVE**: CVE-2026-63030 (wp2shell)
- **Companion CVE**: CVE-2026-60137
- **Type**: Pre-Auth Blind SQL Injection
- **Affected**: WordPress 6.9.0–6.9.4, 7.0.0–7.0.1
- **Fixed**: 6.9.5, 7.0.2+

---

## Usage

```bash
python POC.py <target_url> [options]

```
### Basic usage
```bash
python POC.py --rest-route http://target.com
```
---

### Options

| Argument       | Description                              | Default   |
|----------------|------------------------------------------|-----------|
| `target`       | Single target URL                        | -         |
| `-l, --list`   | File with list of targets (one per line) | -         |
| `--prefix`     | Database table prefix                    | `wp_`     |
| `--rest-route` | Use `?rest_route=`                       | Disabled  |
| `--timeout`    | Request timeout (seconds)                | 30        |
| `--proxy` | HTTP proxy (Burp/ZAP compatible) | None |
| `--max-len`    | Maximum extraction length                | 255       |

---

### Example output:

```
[*] Scanning: http://127.0.0.1/
[*] 1 users found
[+] ID:1 User:admin Hash:$wp$2y$10$Z6gwPduKb7wAbm0bHht1be7SxrgbyxgnbPmTVcVz9nP1KBX811xQy
[*] Requests: 553

```

---

## References

- [Penligent Analysis - CVE-2026-63030 wp2shell](https://www.penligent.ai/hackinglabs/cve-2026-63030-wp2shell/)
- [Rapid7 Labs - CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core](https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core/)
- [WordPress 7.0.2 Security Release](https://wordpress.org/news/2026/07/wordpress-7-0-2-release/)

CVE-2026-63030

CVE-2026-63030 Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

CVE-2026-63030

CVE-2026-63030 Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README