Bhanunamikaze/WP2Shell-CVE-2026-63030-POC

GitHubRepository PoCExploit

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script that implements a full exploitation chain for CVE-2026-63030 and CVE-2026-60137, including route confusion detection, timing-based SQL injection, credential extraction, webshell upload, and command execution. It also contains scanner-like fingerprinting and validation functions, but the primary purpose is exploitation.

Backdoor review

Suspicious behavior

The README presents the tool as a non-destructive scanner and validator, but the supplied Python script contains a fully implemented 'exploit' command that performs state-changing actions including webshell upload, credential extraction, and backdoor plugin installation. The README's claim that the 'remote' command is a stub is contradicted by the presence of a complete, functional 'run_remote' function. This material misrepresentation of the tool's capabilities creates concern.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareWordPress
Attack typessql injectionremote code executionauthentication bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's 'exploit' command implements a full attack chain: route confusion detection, SQL injection, credential theft, webshell upload, and arbitrary command execution. The README describes it as a 'PoC exploiter' and the code contains functions for data extraction, file writing, and backdoor installation, which are characteristic of an exploit.

WP2Shell_CVE-2026-63030_POC.py:1-11WP2Shell_CVE-2026-63030_POC.py:1344-1444README.md:1-18

Requirements

  • Target must be running a vulnerable version of WordPress (6.9.0-6.9.4 or 7.0.0-7.0.1) with the REST API batch endpoint exposed.README.md:84-90
  • The route confusion vulnerability (CVE-2026-63030) must be exploitable on the target.WP2Shell_CVE-2026-63030_POC.py:1361-1371

Observed behavior

  • Sends a safe route confusion probe to confirm the batch-route desynchronization vulnerability.WP2Shell_CVE-2026-63030_POC.py:1361-1371
  • Performs timing-based blind SQL injection to confirm the SQLi vulnerability.WP2Shell_CVE-2026-63030_POC.py:1383-1394
  • Attempts direct webshell upload by extracting DOCUMENT_ROOT via /proc/self/environ and using INTO OUTFILE.WP2Shell_CVE-2026-63030_POC.py:1399-1401
  • Extracts admin password hash via blind SQL injection and attempts to crack it or prompts for password.WP2Shell_CVE-2026-63030_POC.py:1294-1330
  • Creates a new administrator user and uploads a backdoor plugin for command execution.WP2Shell_CVE-2026-63030_POC.py:1413-1443
Safety-review evidence

Behaviors behind the backdoor verdict

Flagged behaviors

Material Misrepresentation
  • The README states the 'remote' command is a stub ('run_remote() is currently a stub and returns an error'), but the script contains a fully implemented 'run_remote' function (lines 1763-1828) that performs remote scanning, including active probing.README.md:292-293WP2Shell_CVE-2026-63030_POC.py:1763-1828
  • The README emphasizes non-destructive, safe validation and states the tool 'does not need to extract data or execute commands', but the script includes an 'exploit' command that performs credential extraction, webshell upload, and backdoor plugin installation.README.md:127WP2Shell_CVE-2026-63030_POC.py:1344-1444

Observables

Command
exploitThe script defines an 'exploit' subcommand that performs state-changing actions including webshell upload, credential extraction, and backdoor plugin installation, contradicting the README's focus on non-destructive scanning.WP2Shell_CVE-2026-63030_POC.py:1488-1503
Function
run_remoteThe README claims this function is a stub, but it is fully implemented and functional, indicating a discrepancy between documentation and code.WP2Shell_CVE-2026-63030_POC.py:1763-1828
Review boundaries

What the analysis did not establish

  • The evidence includes only two text files (README.md and the main Python script) out of six total files in the repository. The other four files are unclassified and not analyzed, so the full artifact may contain additional components.
  • The analysis is based solely on static code review; the code was not executed, and its effectiveness or safety is not verified.
  • Only the two text files (README.md and WP2Shell_CVE-2026-63030_POC.py) were reviewed; four other files in the repository were not inspected.
  • The review does not assess the safety or correctness of the exploit code itself, only the discrepancy between its presence and the documentation.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

compose.yaml

Created Vuln labCVE-2026-63030Compose · images

1 Compose manifest · 2 services

AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Environment assessment

A disposable local lab for the WP2Shell WordPress vulnerability chain, consisting of a MariaDB database and a WordPress 7.0.1 web server bound to localhost.

compose.yaml:1-71

Lab assessment

Vulnerability lab

The compose.yaml deploys a known-vulnerable WordPress 7.0.1 image, and the README explicitly describes it as a disposable local lab for validating CVE-2026-63030 and CVE-2026-60137.

compose.yaml:28-29README.md:1-10
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

database

WordPress database backend

MariaDB 11.4 container providing the WordPress database, with healthcheck and persistent volume.

compose.yaml:2-26

wordpress

Vulnerable WordPress target

WordPress 7.0.1 container with Apache, bound to 127.0.0.1:8080, with DISALLOW_FILE_MODS enabled as a safety measure.

compose.yaml:28-65

WP2Shell_CVE-2026-63030_POC.py

Vulnerability scannerExploit tool

Python script providing local version checks, remote fingerprinting (stub), and a full exploit chain (route confusion, SQLi, webshell upload, credential extraction, plugin backdoor).

WP2Shell_CVE-2026-63030_POC.py:1-10README.md:1-10
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-63030

Supported by supplied evidence

The README and script describe CVE-2026-63030 as a REST API batch-route confusion vulnerability, and the compose.yaml deploys WordPress 7.0.1, which is in the published affected range.

README.md:1-10compose.yaml:28-29
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.README.md:1-10
  • Network access to the authorized WordPress installation (for remote scanning).README.md:1-10
  • Python 3.9 or later.README.md:1-10

Evidence-described exercise path

  1. Start the lab with 'docker compose up -d'.README.md:1-10
  2. Complete the first-time WordPress setup in a browser at http://127.0.0.1:8080.README.md:1-10
  3. Run the local version check: python3 WP2Shell_CVE-2026-63030_POC.py local --wordpress-root /var/www/html.README.md:1-10
  4. Run the remote scanner (stub) or the exploit command against the lab target.README.md:1-10
  5. Stop and remove the lab with 'docker compose down -v'.README.md:1-10
Safety-review evidence

Behaviors behind the stored safety assessment

Suspicious behavior

The exploit command performs state-changing actions (webshell upload, credential extraction, admin creation, plugin backdoor) on the target. While documented as part of the lab exercise, these actions are destructive and could be misused against unauthorized targets. The script includes a hardcoded backdoor plugin name and creates a new admin user, which are concrete indicators of harmful capability beyond simple vulnerability validation.

WP2Shell_CVE-2026-63030_POC.py:1-10README.md:1-10

Indicators requiring review

  • The exploit command uploads a backdoor plugin named 'wp2shell-backdoor' and creates a new admin user 'wp2shell_admin' with a random password, leaving persistent access on the target.WP2Shell_CVE-2026-63030_POC.py:1-10
  • The script includes functionality to extract WordPress admin password hashes and crack them using a wordlist, which is a credential theft capability.WP2Shell_CVE-2026-63030_POC.py:1-10
Review boundaries

What the analysis did not establish

  • The remote scanning command is a stub and not fully implemented.
  • The exploit command's safety depends entirely on the operator using it only against authorized lab targets; the script itself does not enforce this restriction.
  • The compose.yaml uses hardcoded lab credentials, which are not suitable for production.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

2