gagaltotal/CVE-2026-63030-CVE-2026-60137-wp2shell-poc

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script (poc_wp_tot.py) that exploits CVE-2026-63030 and CVE-2026-60137 to achieve remote code execution on vulnerable WordPress instances via time-based blind SQL injection in the REST API batch endpoint.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC (poc_wp_tot.py) is a Python script that exploits CVE-2026-63030 and CVE-2026-60137 to achieve time-based blind SQL injection and remote code execution on vulnerable WordPress instances. The script's behavior is consistent with its stated purpose: it probes for the vulnerability, extracts data via blind SQLi, and chains the exploit to create an administrator account, upload a plugin, and execute an attacker-supplied OS command. No concealed backdoor, unrelated payload, or deceptive behavior was observed in the reviewed text. The plugin it deploys is a temporary command-execution endpoint that self-deactivates and deletes itself after use, which is part of the advertised exploit chain, not a hidden backdoor.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareWordPress
Attack typesSQL InjectionRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, functional exploit chain that actively performs SQL injection and achieves remote code execution. The script includes functions to send malicious payloads (send_batch, probetime), extract data (get_scalar, get_int), and escalate to RCE (exploit_rce) by creating an admin user and uploading a plugin. The README explicitly describes it as a 'proof‑of‑concept (PoC) untuk mengeksploitasi kerentanan' (PoC to exploit vulnerabilities) and provides usage examples for probe, extract, and RCE modes.

README.md:5-7poc_wp_tot.py:351-718

Requirements

  • Target WordPress site must be vulnerable to CVE-2026-63030 and CVE-2026-60137 (versions 6.8.x < 6.8.6, 6.9.x < 6.9.5, 7.0.x < 7.0.2).poc_wp_tot.py:1
  • Target must have at least one published post for oEmbed seeding.poc_wp_tot.py:354-361
  • Network connectivity to the target WordPress REST API endpoint.README.md:25

Observed behavior

  • Sends crafted batch requests to the WordPress REST API to perform time-based blind SQL injection.poc_wp_tot.py:146-197
  • Extracts database information (table names, user IDs) using binary search over response timing.poc_wp_tot.py:245-308
  • Seeds oEmbed cache posts via SQL injection to manipulate the WordPress post cache.poc_wp_tot.py:379-409
  • Creates a new administrator user account through a poisoned changeset and batch request.poc_wp_tot.py:470-573
  • Logs in as the new administrator, uploads a malicious plugin, and executes arbitrary OS commands.poc_wp_tot.py:575-718
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Chain
The script performs a multi-phase exploit: blind SQLi calibration, oEmbed seeding, table/prefix extraction, admin user ID recovery, changeset poisoning, admin account creation, plugin upload, and command execution.This is the advertised RCE chain for CVE-2026-63030/CVE-2026-60137. All steps are documented in the README and implemented in the script.poc_wp_tot.py:351-718
Plugin Payload
The uploaded plugin registers a REST route that executes a base64-decoded command via passthru(), then deactivates and deletes itself.This is a temporary RCE payload, not a persistent backdoor. It is part of the documented exploit chain and cleans up after execution.poc_wp_tot.py:610-630
Admin Creation
The script creates a new WordPress administrator account with a random username and password.This is a necessary step in the exploit chain to gain authenticated access for plugin upload. The credentials are printed to the operator.poc_wp_tot.py:472-474poc_wp_tot.py:545-550
Review boundaries

What the analysis did not establish

  • Evidence includes only the README.md and poc_wp_tot.py files; one non-text media file (screenshot) and one additional text file are omitted from the packet.
  • The artifact's behavior is inferred from static code analysis; the code was not executed, and its effectiveness against live targets is not verified.
  • Two files (one non-text media file and one unclassified file) were present in the repository but not included in the text evidence. Their content was not reviewed.
  • The analysis is based solely on static review of the provided source code and documentation; no dynamic execution or behavioral analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2