CVE-2026-60137

This repository contains a functional exploit for CVE-2026-60137, a WordPress REST API batch endpoint route-confusion vulnerability leading to SQL injection (UNION-based) and pre-authentication admin account creation. The exploit chains desynchronized request handling with oEmbed cache poisoning to achieve privilege escalation.

This repository contains a functional exploit for CVE-2026-63030, a critical WordPress REST API batch route confusion vulnerability chained with CVE-2026-60137 (SQL injection in WP_Query's `author__not_in` parameter). The exploit achieves unauthenticated RCE by creating an admin user via SQL injection and deploying a webshell.

The repository contains obfuscated Python code using PyArmor, a commercial code protection tool. The `WordpressCore.py` file is heavily obfuscated with a large binary blob, and the `pytransform` module is designed to load encrypted payloads, which is atypical for legitimate PoCs. The code does not demonstrate any actual vulnerability for CVE-2026-60137 and appears to be a trojanized payload delivery mechanism.

This exploit targets a SQL injection vulnerability in the WordPress REST API batch endpoint (`/wp-json/batch/v1`), allowing unauthenticated attackers to execute arbitrary SQL queries. The PoC includes time-based blind SQLi detection, UNION-based data extraction (admin credentials), and outlines a path to RCE via file writes or plugin uploads.

This exploit chains CVE-2026-63030 (REST batch handler desync) and CVE-2026-60137 (WP_Query SQL injection in `author__not_in`) to achieve unauthenticated RCE in WordPress. The PoC fabricates posts via SQLi, uses oembed caching as a write primitive, and pivots privileges to create an admin account for plugin-based command execution.

This repository contains a functional exploit for CVE-2026-60137, a WordPress REST batch-route confusion SQL injection vulnerability chained with CVE-2026-63030 to achieve unauthenticated remote code execution (RCE) via INTO OUTFILE. The exploit includes detection, data extraction, and RCE capabilities with detailed technical implementation.

This repository contains a functional exploit for CVE-2026-60137, a SQL injection vulnerability in WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1, chained with CVE-2026-63030 (REST API batch-route confusion) to achieve pre-authentication remote code execution (RCE). The exploit includes version detection, vulnerability confirmation, and SQLi data extraction capabilities.

This repository contains a functional exploit chain for CVE-2026-60137 (WordPress SQL Injection) combined with CVE-2026-63030 (Batch Route Confusion), enabling pre-authentication remote code execution. The exploit leverages nested batch desync to achieve blind SQLi, then uses oEmbed cache poisoning and object cache manipulation to gain admin privileges and deploy a webshell.

This repository provides a functional exploit chain for CVE-2026-60137 (WP_Query author__not_in SQL injection) and CVE-2026-63030 (REST batch route confusion), enabling unauthenticated remote code execution in WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. The exploit leverages route confusion to smuggle SQLi payloads and achieve RCE via a webshell.

This repository contains a functional exploit for CVE-2026-60137, a SQL injection vulnerability in WordPress's batch API endpoint. The exploit leverages UNION-based SQLi to extract database information, write webshells via INTO OUTFILE, and extract credentials, with detailed technical implementation for MySQL environment probing and exploitation.

This repository contains a functional exploit chain for CVE-2026-60137 (SQL injection) and CVE-2026-63030 (REST batch route confusion) in WordPress, enabling unauthenticated RCE via SQLi, admin takeover, and webshell upload. The PoC includes detailed technical analysis, Docker-based testing environment, and multi-phase exploitation logic.

This PoC exploits CVE-2026-60137, a blind SQL injection vulnerability in WordPress core (via the `author__not_in` parameter), chained with CVE-2026-63030 (REST batch route confusion) to achieve pre-authentication RCE. The exploit includes scanning, blind SQLi confirmation, data extraction, and interactive shell capabilities.

This repository contains a functional exploit chain for CVE-2026-60137 (SQL injection via `author__not_in` parameter) and CVE-2026-63030 (REST batch route confusion) in WordPress 6.9.x/7.0.x. The PoC achieves pre-authentication RCE by chaining SQLi, oEmbed cache poisoning, and `customize_changeset` hijacking to create an admin user and deploy a webshell.

This repository contains a functional exploit chain for CVE-2026-60137 (SQL injection) and CVE-2026-63030 (route confusion/auth bypass) in WordPress, enabling pre-authentication remote code execution. The exploit leverages UNION-based SQL injection, oEmbed cache poisoning, and customize_changeset manipulation to create an admin account and upload a webshell.

This PoC exploits a time-based blind SQL injection vulnerability in the WordPress REST API batch endpoint (CVE-2026-60137) to achieve remote code execution. The exploit chains SQLi to extract data, creates an admin account, and uploads a malicious plugin for command execution.

This repository contains a functional exploit for CVE-2026-60137 (SQL injection) and CVE-2026-63030 (route-confusion) in WordPress, chaining them to achieve RCE via webshell upload. The PoC includes timing-based SQLi confirmation, route-confusion detection, and direct webshell deployment via INTO OUTFILE.

This repository provides a temporary mitigation plugin for WordPress that sanitizes `author__not_in` parameters in `WP_Query` to prevent SQL injection (CVE-2026-60137) and blocks REST API batch endpoints (CVE-2026-63030) to thwart authentication bypass, part of the 'wp2shell' exploit chain enabling unauthenticated RCE.

This exploit chains CVE-2026-63030 (REST API batch route confusion leading to SQL injection) with CVE-2026-60137 (customizer changeset re-entry for privilege escalation) to achieve pre-authentication remote code execution in WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. The PoC includes SQLi, object cache poisoning, and REST API re-entry to create an administrator and deploy a webshell.

This tool checks for exposure to CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (WP_Query SQL injection) in WordPress by passively detecting the version and probing the REST batch endpoint. It does not exploit the vulnerabilities but identifies potentially vulnerable instances.

This repository contains a Python-based scanner for CVE-2026-60137, a WordPress vulnerability affecting versions 6.9.0-6.9.4 and 7.0.0-7.0.1. The tool detects vulnerable instances by checking for structural and timing-based indicators (e.g., REST batch endpoint behavior, error code markers) but does not include exploit code for RCE.

This repository contains a WordPress plugin that performs a forensic scan for artifacts left by the CVE-2026-60137 and CVE-2026-63030 exploit chain. It checks the database and plugin directory for indicators of compromise (IoCs) such as suspicious oembed_cache entries, high parent IDs, wp2shell-themed user accounts, and webshell files, but does not exploit the vulnerability.

This repository contains a Go-based scanner for CVE-2026-60137, a WordPress REST API vulnerability related to the `author_exclude` query parameter. The tool detects vulnerable WordPress instances by probing the REST endpoint and analyzing responses, but does not contain exploit code for command execution or data manipulation.

This exploit chains CVE-2026-63030 (REST batch route desync) and CVE-2026-60137 (WP_Query author__not_in SQL injection) to achieve pre-authentication RCE in WordPress core. The PoC demonstrates a full attack chain: SQLi via UNION injection, crack-free admin creation via forged posts and customizer changesets, and webshell deployment.

This PoC exploits a chained vulnerability in WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1, combining a REST API batch array misalignment (CVE-2026-63030) with an SQL injection in `author__not_in` (CVE-2026-60137) to achieve unauthenticated RCE via cache poisoning, changeset identity switching, and admin user creation.

This repository contains a non-intrusive detection scanner for CVE-2026-60137 and CVE-2026-63030, a pre-authentication RCE chain in WordPress. The tool passively fingerprints WordPress versions and checks for the presence of the vulnerable REST API batch endpoint without exploiting the vulnerabilities.

This repository contains a functional exploit chain for CVE-2026-60137, a WordPress REST API batch route-confusion vulnerability leading to unauthenticated blind SQL injection. The exploit extracts user credentials, performs authentication, and deploys a webshell via plugin ZIP upload for RCE.

This PoC exploits a pre-authentication RCE chain in WordPress Core by combining CVE-2026-60137 (SQLi in WP_Query's author_exclude parameter) with CVE-2026-63030 (REST API batch-route confusion). The exploit uses time-based blind SQLi to extract admin credentials, injects a malicious changeset, creates a new admin user, and uploads a command plugin for RCE.

This repository contains a functional proof-of-concept exploit for CVE-2026-60137 (SQL injection in WordPress WP_Query via author__not_in parameter) chained with CVE-2026-63030 (REST API batch route confusion) to achieve unauthenticated time-based blind SQL injection, which can lead to RCE in vulnerable WordPress versions.

This exploit leverages a route confusion vulnerability (CVE-2026-63030) and a SQL injection flaw (CVE-2026-60137) in WordPress's REST API batch endpoint to achieve pre-authentication remote code execution. The PoC includes UNION-based admin creation, blind SQLi extraction, and webshell deployment via plugin upload.

This repository provides a functional exploit for CVE-2026-60137 (SQL injection in WordPress `author__not_in` parameter) chained with CVE-2026-63030 (REST batch route confusion) to achieve unauthenticated blind SQL injection and remote code execution via plugin upload. The exploit includes time-based blind SQLi with binary search extraction and a webshell deployment mechanism.

This repository provides a functional exploit for CVE-2026-60137 (blind SQLi) and CVE-2026-63030 (REST batch route confusion leading to pre-auth RCE) in WordPress. The PoC includes scanning, blind SQLi data extraction, and unauthenticated RCE via webshell upload, with detailed version fingerprinting and attack chain validation.

This exploit combines a time-based blind SQL injection (CVE-2026-60137) via WordPress REST API batch endpoint route confusion with a subsequent RCE (CVE-2026-63030) through malicious plugin upload. The SQLi leverages unsafe author_exclude parameter interpolation to extract credentials, then authenticates as admin to deploy a webshell plugin.

This repository provides a non-destructive detector for CVE-2026-60137 (WP_Query::author__not_in SQL injection) combined with CVE-2026-63030 (REST /batch/v1 route confusion) in WordPress core. The PoC confirms the unauthenticated SQL injection via time-based differential probing and includes a Docker lab for local testing.

This repository provides a functional exploit chain for CVE-2026-60137 (WordPress WP_Query author__not_in SQL injection) chained with CVE-2026-63030 (REST batch route confusion) to achieve unauthenticated remote code execution (RCE) on WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. The PoC includes version detection, SQL injection, webshell deployment, and a reliability testing matrix across database engines.