Dungsocool/CVE-2026-60137_CVE-2026-63030

GitHubRepository PoCExploit

PoC files

16 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is an automated exploit script (exploit.py) and supporting documentation (README.md) for CVE-2026-60137 and CVE-2026-63030. The exploit chains REST Batch Route Confusion to bypass authentication and then performs SQL injection to extract admin credentials, logs in, uploads a webshell, and achieves remote code execution on vulnerable WordPress instances.

Backdoor review

No backdoor observed in reviewed code

The repository contains a documented proof-of-concept exploit for CVE-2026-60137 and CVE-2026-63030 targeting WordPress. The exploit chain (route confusion, SQL injection, admin login, webshell upload, RCE) is fully disclosed in the README and implemented in exploit.py. All actions are directed at the operator-supplied target URL. No concealed, unrelated, or operator-harmful behavior was found. The code does not exfiltrate data to a third party, establish unauthorized persistence on the operator's machine, or contain any materially misrepresented functionality.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPythonMarkdown
Target softwareWordPress
Attack typesSQL InjectionAuthentication BypassRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, automated Python script (exploit.py) that exercises the described vulnerabilities to achieve remote code execution. The script implements all phases of the attack chain: route confusion, SQL injection, login, webshell upload, and command execution. The README.md provides a detailed technical analysis and instructions for running the exploit. This is clearly code intended to exploit the vulnerabilities, not merely detect or analyze them.

exploit.py:1-449README.md:1-809

Requirements

  • Target must be running a vulnerable WordPress version (6.9.0-6.9.4 or 7.0.0-7.0.1) with the REST API enabled (default).README.md:7README.md:112-115exploit.py:13
  • The target must have at least one published post (default 'Hello World' exists).README.md:120
  • The attacker must be able to send HTTP requests to the target's REST API batch endpoint.exploit.py:45-48

Observed behavior

  • Sends a batch request with a malformed path ('///') to trigger route confusion and bypass authentication.exploit.py:54-88README.md:326-339
  • Performs boolean-based blind SQL injection via the 'author_exclude' parameter to extract the admin username and password hash from the database.exploit.py:94-202README.md:341-361
  • Attempts to log in to the WordPress admin panel using a list of common passwords.exploit.py:208-244README.md:363-367
  • Uploads a malicious PHP webshell as a WordPress plugin and activates it.exploit.py:250-333README.md:369-376
  • Executes arbitrary operating system commands on the target server via the uploaded webshell.exploit.py:339-346README.md:378-383
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Target Url
operator-supplied argument (args.target)All HTTP requests in exploit.py are sent to the target URL provided by the operator via command-line argument.exploit.py:391-397
Webshell Token
secret123The webshell uploaded to the target uses a hardcoded token for access control. This is a standard practice in PoC exploits to prevent unauthorized use of the shell on the target.exploit.py:31
Exploit Chain
Route Confusion -> SQLi -> Admin Login -> Webshell Upload -> RCEThe entire exploit chain is explicitly described in the README and implemented in exploit.py, targeting the operator-specified WordPress instance.README.md:9-11exploit.py:1-5
Review boundaries

What the analysis did not establish

  • The evidence packet includes only the README.md and exploit.py files; 14 other files (including images and a docker-compose.yml) are omitted from the text content.
  • The analysis is based solely on static review of the provided source code; the code was not executed, and its effectiveness or safety is not verified.
  • 13 non-text media files and 1 unclassified file in the repository were not inspected; they are not referenced or executed by the reviewed exploit code.
  • The review does not assess the validity of the CVE claims or the exploit's effectiveness against a real target.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2026-60137CVE-2026-63030Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment defining a WordPress 6.9.4 service with a MySQL 8.0 database, intended as a vulnerable lab for CVE-2026-60137 and CVE-2026-63030.

docker-compose.yml:1-40

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a 'Vulnerable Lab' for reproducing CVE-2026-60137 and CVE-2026-63030, and the exploit script targets this setup.

README.md:1-3README.md:17-19
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

wordpress

vulnerable target application

WordPress 6.9.4-php8.2-apache service exposed on host port 8080, configured with a MySQL database backend. It is the target of the exploit chain.

docker-compose.yml:4-18

db

database backend

MySQL 8.0 service providing the database for WordPress, with a healthcheck and persistent volume.

docker-compose.yml:20-35

exploit.py

automated exploit script

Python script that chains CVE-2026-63030 (Route Confusion) and CVE-2026-60137 (SQL Injection) to achieve unauthenticated RCE on the WordPress target, including credential extraction, login, webshell upload, and command execution.

exploit.py:1-15
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-60137

Supported by supplied evidence

The README and exploit script describe CVE-2026-60137 as an SQL injection in WP_Query's author__not_in parameter, exploitable when combined with CVE-2026-63030. The exploit script implements boolean-based blind SQLi extraction consistent with this description.

README.md:1-3exploit.py:1-5

CVE-2026-63030

Supported by supplied evidence

The README and exploit script describe CVE-2026-63030 as a REST Batch Route Confusion vulnerability that bypasses authentication. The exploit script's Phase 1 confirms the desync using a malformed path '///'.

README.md:1-3exploit.py:1-5
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.README.md:19
  • Target WordPress instance running a vulnerable version (6.9.0-6.9.4 or 7.0.0-7.0.1) with REST API public.README.md:1-3
  • Python 3 and the 'requests' library installed to run the exploit.README.md:33-34

Evidence-described exercise path

  1. Clone the repository and start the vulnerable lab with 'docker compose up -d'.README.md:21-25
  2. Run the exploit script against the target to confirm Route Confusion (Phase 1).README.md:33-35exploit.py:55-82
  3. Extract admin credentials via SQL injection (Phase 2).README.md:33-35exploit.py:85-170
  4. Attempt login with common passwords or crack the hash (Phase 3).README.md:33-35exploit.py:173-210
  5. Upload a webshell via plugin upload (Phase 4).README.md:33-35exploit.py:213-280
  6. Execute commands on the target via the webshell (Phase 5).README.md:33-35exploit.py:283-310
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior targets the lab's own WordPress container. The exploit script performs expected vulnerability demonstration steps (SQLi, login, webshell upload, command execution) against the local lab target. No evidence of host escape, external connections, persistence outside the lab, credential theft beyond the lab's own database, or destructive actions beyond the intended exercise.

exploit.py:1-449docker-compose.yml:1-40
Review boundaries

What the analysis did not establish

  • The exploit script contains a hardcoded webshell with a static token ('secret123') and multiple command execution methods, which is expected for a vulnerability lab but could be misused if deployed outside the lab context.
  • The README references images that are not included as text evidence, so their content cannot be verified.
  • The packet does not include the 'chain-rce.md' file mentioned in the README, so its contents are unknown.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

2