0xBlackash/CVE-2026-63030

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Python script (wp2shell-poc.py) that exploits CVE-2026-63030 by sending a crafted batch REST API request with a SQL injection payload to write a webshell and execute arbitrary commands on a vulnerable WordPress instance.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README describing CVE-2026-63030 and a Python PoC script (wp2shell-poc.py). The PoC exploits the described vulnerability by sending a crafted batch REST API request to write a webshell and then executing commands via that webshell. This behavior is consistent with the stated exploit objective (Remote Code Execution via SQL Injection and route confusion). No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or deceptive behavior was observed in the reviewed text.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPythonMarkdown
Target softwareWordPress
Attack typesSQL InjectionRemote Code ExecutionWeb Shell Deployment
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The wp2shell-poc.py script actively exploits the vulnerability by sending a crafted request to write a webshell and execute commands, which is the definition of exploit code. The README.md provides documentation but the primary artifact is the exploit script.

wp2shell-poc.py:3wp2shell-poc.py:30-40wp2shell-poc.py:45-46

Requirements

  • Target must be a vulnerable WordPress instance (6.9.x before 6.9.5 or 7.0.x before 7.0.2) with the REST API batch endpoint exposed.README.md:33-35
  • The MySQL user must have FILE privilege to write the webshell via INTO OUTFILE.wp2shell-poc.py:35

Observed behavior

  • Sends a POST request to /wp-json/batch/v1 with a JSON payload containing a SQL injection in the author__not_in[] parameter.wp2shell-poc.py:30-40
  • The SQL injection payload uses UNION SELECT ... INTO OUTFILE to write a PHP webshell to /wp-content/uploads/poc.php.wp2shell-poc.py:35
  • Executes system commands (id, uname -a, cat /etc/passwd, whoami) by sending GET requests to the deployed webshell with the cmd parameter.wp2shell-poc.py:24wp2shell-poc.py:45-46
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
PoC sends a POST to /wp-json/batch/v1 with a SQL injection payload in author__not_in[] to write a PHP webshell to /wp-content/uploads/poc.php, then executes commands via the webshell.This is the normal exploit behavior for CVE-2026-63030 as described in the CVE context and README.wp2shell-poc.py:30-46
Author Contact
Ashraf Zaryouh "0xBlackash"Author attribution in the PoC script header.wp2shell-poc.py:4
Review boundaries

What the analysis did not establish

  • material evidence limitation
  • Only the two text files (README.md and wp2shell-poc.py) were reviewed. No binary files or other repository contents were inspected.
  • The PoC script uses verify=False for HTTPS requests, which disables TLS certificate verification, but this is a common practice in PoC scripts and not a backdoor indicator.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1