dtro

Metasploit · Author

Source-scoped identity with 1 associated PoC and 2 linked vulnerabilities.

Showing 1 PoC on this page

Metasploit

WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE

Metasploit exploitby Adam KuesAdded to Metasploit 2026-07-31ExploitCVE-2026-60137CVE-2026-630301 file

exploit_multi/http/wp_batch_desync_rce · Ruby

MetasploitPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit exploit module that chains CVE-2026-60137 (SQL injection) and CVE-2026-63030 (REST API batch route confusion) to achieve unauthenticated remote code execution on WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. It uses SQL injection to read the database prefix and admin ID, poisons the object cache to publish a crafted customizer changeset, re-enters the REST API with admin privileges to create a new administrator account, logs in, uploads a plugin containing a Metasploit payload, and executes it.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit exploit that chains two WordPress CVEs to achieve unauthenticated RCE. It creates an admin account, uploads a payload plugin, executes it, and cleans up. No concealed operator-directed harm, unrelated payloads, or deceptive behavior was found.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRuby
Target softwareWordPress
Attack typesSQL InjectionRemote Code ExecutionPrivilege Escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises the vulnerabilities to achieve remote code execution. It includes code to check for vulnerability, perform SQL injection, poison the object cache, escalate privileges, create an admin account, upload a payload, and execute it. The module type is 'exploit' and the description states it 'gain[s] unauthenticated remote code execution'.

modules/exploits/multi/http/wp_batch_desync_rce.rb:1-812modules/exploits/multi/http/wp_batch_desync_rce.rb:42-58

Requirements

  • Target must be running a vulnerable version of WordPress (6.9.0-6.9.4 or 7.0.0-7.0.1) with the REST API batch endpoint reachable.modules/exploits/multi/http/wp_batch_desync_rce.rb:44-46
  • At least one published post or page must exist on the target for oEmbed resolution.modules/exploits/multi/http/wp_batch_desync_rce.rb:193
  • The target must not use a persistent object cache that prevents forged UNION rows from surviving into the cache.modules/exploits/multi/http/wp_batch_desync_rce.rb:163

Observed behavior

  • Checks if the target is running a vulnerable WordPress version and confirms the batch route-confusion SQL injection is exploitable via in-band UNION.modules/exploits/multi/http/wp_batch_desync_rce.rb:125-171
  • Discovers the WordPress database table prefix and an existing administrator user ID via SQL injection.modules/exploits/multi/http/wp_batch_desync_rce.rb:255-286
  • Seeds oEmbed cache posts by injecting forged posts containing embed shortcodes, then extracts their post IDs.modules/exploits/multi/http/wp_batch_desync_rce.rb:301-321
  • Builds a poison graph and forged wp_posts rows to poison the object cache, then triggers the escalation chain to create a new administrator account via the REST API.modules/exploits/multi/http/wp_batch_desync_rce.rb:323-347
  • Logs in as the newly created administrator, uploads a plugin containing a Metasploit payload, and executes it to obtain a session.modules/exploits/multi/http/wp_batch_desync_rce.rb:215-222
  • Cleans up by removing the uploaded plugin and the created administrator account (unless KeepAdmin is set).modules/exploits/multi/http/wp_batch_desync_rce.rb:224-238
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Creation
Payload withheldThe module creates a new WordPress administrator account to upload and execute a payload. This is documented exploit behavior, not a backdoor.modules/exploits/multi/http/wp_batch_desync_rce.rb:328-333
Payload Upload
Payload withheldThe module uploads a plugin containing the user-selected Metasploit payload and triggers it. This is standard Metasploit exploit behavior.modules/exploits/multi/http/wp_batch_desync_rce.rb:427-443
Cleanup
Payload withheldThe module removes the created admin account and uploaded plugin after obtaining a session, unless KeepAdmin is set. This is normal cleanup, not concealment.modules/exploits/multi/http/wp_batch_desync_rce.rb:224-238
Review boundaries

What the analysis did not establish

  • Only the module source code and metadata are provided; Metasploit framework mixins, libraries, and external payloads are not included.
  • The analysis is based solely on static review of the source code; the module was not executed, and its behavior is inferred from the code logic.
  • Only the module source and metadata were reviewed; framework mixins, libraries, and external payloads were not expanded or analyzed.
  • Binary files were not inspected; metadata-only analysis was performed for any non-text content.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.