HackingLZ/wp2shell_stock_chain

GitHubRepository PoCExploit

PoC files

11 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python exploit for CVE-2026-60137 and CVE-2026-63030 in WordPress. It uses a REST API batch-route confusion to deliver a SQL injection via the author__not_in parameter, creates an administrator account, and then uploads and executes a one-shot plugin to achieve remote code execution.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence is a proof-of-concept exploit for CVE-2026-60137 and CVE-2026-63030. The code performs the documented SQL injection and REST API chain to create an administrator, then optionally uploads and activates a one-shot plugin that runs only the fixed command 'id' and self-removes. No concealed executable behavior, unrelated remote access, persistence, credential theft, or deceptive payload was observed. The plugin is generated locally, restricted to administrator-only access, and contains no arbitrary command input.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwarewordpress
Attack typessql injectionremote code executionprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, functional Python script (exploit.py) that actively exploits CVE-2026-60137 and CVE-2026-63030 to achieve SQL injection and remote code execution. It includes all necessary logic for the attack chain: SQL injection, administrator creation, login, plugin upload, and command execution. The README explicitly describes it as a 'proof of concept' and provides usage examples for exploitation.

README.md:3-4exploit.py:1-971

Requirements

  • Target must be a vulnerable WordPress instance (6.8.x < 6.8.6, 6.9.x < 6.9.5, 7.0.x < 7.0.2).README.md:101-103
  • Target must have at least one public post that can be oEmbedded.README.md:69-70
  • The default non-persistent WordPress object cache is expected.README.md:69

Observed behavior

  • Sends a crafted batch REST API request to exploit a route confusion and inject SQL via the author__not_in parameter.exploit.py:144-181
  • Uses UNION-based SQL injection to exfiltrate data, discover the table prefix, and find an existing administrator ID.exploit.py:237-243exploit.py:271-280exploit.py:283-295
  • Creates a new administrator account via a nested batch request that carries the SQL injection and a user creation payload.exploit.py:184-234exploit.py:480-540
  • Logs in as the new administrator, uploads a custom or built-in PHP plugin, activates it, and invokes a REST route to execute the shell command 'id'.exploit.py:568-597exploit.py:708-753exploit.py:765-796
  • The built-in proof plugin runs 'id', deactivates itself, and deletes its own file and directory.exploit.py:628-681
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Fixed Command Execution
shell_exec('id 2>&1')The generated proof plugin runs only the fixed command 'id' and has no mechanism for arbitrary command input.exploit.py:642-643
Self Removal
deactivate_plugins and unlink/rmdir in shutdown functionThe proof plugin deactivates itself and removes its file and directory after execution, leaving no persistent webshell.exploit.py:664-671
Target Restriction
require_private_target checks for loopback/private IPsExecution modes (--exec, --complete-chain) are restricted to loopback and private-network targets.exploit.py:543-561
Permission Check
current_user_can('activate_plugins')The proof plugin's REST route requires administrator-level capabilities.exploit.py:637-639
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false, indicating that 8 files (38,362 bytes) were not included in the analysis. The classification is based solely on the provided text files (README.md, exploit.py, test_exploit.py).
  • The artifact's execution modes are restricted to loopback and private-network targets by a guard function, but the exploit code itself is not restricted.
  • The built-in RCE proof is limited to executing the fixed command 'id' and does not accept arbitrary commands.
  • 8 unclassified files totaling 38,362 bytes were not inspected; their content and potential behavior are unknown.
  • Binary files were flagged as metadata-only and not analyzed.
  • The review is limited to the supplied text evidence and does not verify runtime behavior or network interactions.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

lab/docker-compose.yml

Created Vuln labCVE-2026-60137CVE-2026-63030Compose · images

1 Compose manifest · 3 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A disposable Docker Compose lab for a WordPress 6.9/7.0 REST batch-route confusion and SQL injection chain. It uses stock wordpress:7.0.1-apache and mariadb:11 images with a wpcli service for automated installation. Apache is configured to listen on port 8080 for same-site oEmbed callbacks.

lab/docker-compose.yml:1-83README.md:1-128

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a 'Disposable stock-install acceptance fixture' for a specific vulnerability chain (REST batch-route confusion and SQL injection). The Compose file sets up a vulnerable WordPress instance with core auto-update disabled to preserve the vulnerability, and the wpcli service automates installation for testing. The included test-matrix.sh script systematically tests multiple vulnerable versions.

README.md:1-6lab/docker-compose.yml:1-3lab/docker-compose.yml:40-42
Lab shapeCompose · images
Services3
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

database server

MariaDB 11 database for WordPress. Uses a tmpfs for /var/lib/mysql, making it non-persistent. Configured with a healthcheck.

lab/docker-compose.yml:6-16

wp

web servervulnerable target

WordPress 7.0.1 Apache image (version overridable via WP_IMAGE_VERSION). Exposes port 8080 on 127.0.0.1. Mounts custom Apache configs to listen on 8080 and sets WP_HOME/WP_SITEURL accordingly. Core auto-update is disabled to keep the fixture vulnerable.

lab/docker-compose.yml:18-42lab/apache/ports.conf:1-10lab/apache/000-default.conf:1-8

wpcli

automated installerlab readiness indicator

WordPress CLI image that waits for wp-config.php, optionally downloads a specific core version, installs WordPress with a fixed admin user, sets permalink structure, and prints 'LAB READY' when done. Runs as user 33:33.

lab/docker-compose.yml:44-72

test-matrix.sh

automated testing harness

Bash script that iterates over vulnerable (and optionally fixed) WordPress versions, brings up the lab, runs exploit phases (check, select, add-user, exec, complete-chain, custom-plugin), and records results in a TSV report.

lab/test-matrix.sh:1-232
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-60137

Insufficient evidence

The README mentions 'REST batch-route confusion and author__not_in SQL injection chain' but does not map these to specific CVE IDs. No CVE description, advisory, or patch reference is provided in the evidence. The association is a repository claim without supporting documentation.

README.md:1-6

CVE-2026-63030

Insufficient evidence

Same as CVE-2026-60137: the README describes a vulnerability chain but does not link it to this CVE. No CVE-specific details, references, or proof of association are present in the supplied evidence.

README.md:1-6
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the lab.README.md:88-90
  • Python 3 is required to run the exploit script (exploit.py, not included in evidence).README.md:18-20
  • The target WordPress site must have at least one public post for oEmbed to function.README.md:72-73
  • The lab must be reachable on 127.0.0.1:8080 from the host running the exploit.lab/docker-compose.yml:25

Evidence-described exercise path

  1. Start the lab: docker compose -f lab/docker-compose.yml up -dREADME.md:88-90
  2. Run a non-persistent sentinel probe: python3 exploit.py http://TARGET --checkREADME.md:18-20
  3. Execute a SELECT via UNION primitive: python3 exploit.py http://TARGET "SELECT @@version"README.md:22-23
  4. Create an administrator and verify login: python3 exploit.py http://TARGET --add-user --username audit-admin --password 'Use-A-Lab-Only-Password'README.md:25-29
  5. Execute the fixed 'id' command via one-shot plugin: python3 exploit.py http://127.0.0.1:8080 --exec --username audit-admin --password 'Use-A-Lab-Only-Password'README.md:31-34
  6. Run the full chain with generated credentials: python3 exploit.py http://127.0.0.1:8080 --complete-chainREADME.md:36-37
  7. Tear down the lab: docker compose -f lab/docker-compose.yml down -vREADME.md:88-90
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The lab is a self-contained vulnerability research environment. The exploit targets only the local WordPress container via 127.0.0.1:8080. The default impact is a fixed 'id' command, and the one-shot plugin deactivates and removes itself. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior beyond the intended lab target.

README.md:7-12README.md:31-34README.md:75-82lab/docker-compose.yml:25
Review boundaries

What the analysis did not establish

  • The exploit script (exploit.py) is not included in the evidence, so its exact behavior cannot be verified.
  • The custom-marker.php plugin fixture is listed in file inventory but its content is not provided in evidence_files.
  • CVE associations are repository claims without supporting documentation, making CVE verdicts 'insufficient_evidence'.
  • The lab uses privileged: false and no dangerous capabilities, but the absence of a Dockerfile or further security analysis limits full safety assessment.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

2