shinthink/CVE-2026-63030
PoC files
4 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
A Python script (cve_2026_63030.py) that exploits CVE-2026-60137 (SQLi) and CVE-2026-63030 (REST batch route confusion) in WordPress to achieve unauthenticated remote code execution by creating a new administrator account and optionally deploying a webshell.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python exploit script (cve_2026_63030.py) that implements a documented pre-authentication remote code execution chain against WordPress. The script performs only the advertised exploit steps: batch endpoint desync verification, SQL injection for reconnaissance, oEmbed cache poisoning to create an administrator account, and optional webshell deployment. No concealed, deceptive, or unrelated harmful behavior was observed. The code is straightforward and its actions align with the described vulnerability chain.
Classification basis and observed behavior
Classification basis
The primary artifact cve_2026_63030.py contains code that actively exploits vulnerabilities to achieve remote code execution. It performs SQL injection, creates an administrator account, and deploys a webshell, which is the definition of an exploit.
cve_2026_63030.py:1-14cve_2026_63030.py:148-182cve_2026_63030.py:184-230Requirements
- Target must be a vulnerable WordPress instance (6.9.0-6.9.4 or 7.0.0-7.0.1) with at least one published post and REST API accessible.
README.md:16README.md:99-106
Observed behavior
- Sends crafted batch REST API requests to trigger a route confusion desync, then injects SQL via the author__not_in parameter to extract database information.
cve_2026_63030.py:112-126cve_2026_63030.py:128-146 - Uses UNION SELECT SQL injection to forge fake WordPress post objects in the database cache, then leverages oEmbed processing and changeset hijacking to create a new administrator account.
cve_2026_63030.py:148-182 - Optionally authenticates as the new administrator, uploads a malicious plugin containing a PHP webshell, activates it, and executes an arbitrary system command.
cve_2026_63030.py:184-230
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- The script creates a new administrator account on the target WordPress site via SQL injection and REST API manipulation.This is the advertised purpose of the PoC and is not a backdoor; it is the normal exploit behavior against the stated target.
cve_2026_63030.py:148-182 - Exploit Behavior
- The script optionally uploads and activates a webshell plugin to execute arbitrary commands.This is an advertised feature (--rce flag) and is part of the documented exploit chain, not a hidden backdoor.
cve_2026_63030.py:184-230 - Network Communication
- All HTTP requests are directed to the user-supplied --url target.No requests are made to external or attacker-controlled infrastructure; the script only interacts with the target specified by the user.
cve_2026_63030.py:50-60cve_2026_63030.py:151
What the analysis did not establish
- One file (unclassified, 33 bytes) was not included in the text analysis, but it is not a text file and is unlikely to affect classification.
- The evidence includes only the README, the exploit script, and a requirements file; no other supporting files were provided.
- One file (unclassified, 33 bytes) was omitted from the text evidence; its metadata indicates it is not a text file and was not analyzed, but its absence is noted.
- The review is limited to the supplied text content and does not include dynamic analysis or execution of the code.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.