CVE-2026-63030

This repository contains a functional exploit chain for CVE-2026-63030 (REST batch route confusion) chained with CVE-2026-60137 (WP_Query author__not_in SQL injection) to achieve unauthenticated remote code execution (RCE) in WordPress versions 6.9.0-6.9.4 and 7.0.0-7.0.1. The exploit includes version detection, SQL injection, and webshell deployment with token-gated command execution.

This repository contains a functional exploit for CVE-2026-63030, a critical WordPress REST API batch route confusion vulnerability chained with CVE-2026-60137 (SQL injection in WP_Query's author__not_in parameter) to achieve unauthenticated remote code execution. The exploit creates an admin user via SQL injection and deploys a webshell.

This repository contains a functional exploit for CVE-2026-63030, a WordPress pre-authentication RCE vulnerability chained with CVE-2026-60137 (SQL injection). The exploit leverages batch route confusion and UNION-based SQLi to perform database reconnaissance, oEmbed cache poisoning, and webshell deployment for command execution.

This PoC exploits a route confusion vulnerability (CVE-2026-63030) in WordPress's REST API batch endpoint, chained with a SQL injection (CVE-2026-60137) in WP_Query's `author__not_in` parameter, to achieve unauthenticated SQL injection and remote code execution via webshell deployment.

This repository contains a functional exploit for CVE-2026-63030, a critical WordPress REST API batch route confusion vulnerability chained with CVE-2026-60137 (SQL injection in `author__not_in`). The exploit demonstrates unauthenticated SQL injection leading to admin account creation and RCE via webshell deployment.

Exploits a REST API batch route confusion vulnerability (CVE-2026-63030) combined with blind SQL injection (CVE-2026-60137) in WordPress core. The PoC demonstrates time-based SQLi via crafted `author_exclude` parameter and structural route confusion to confirm exploitation.

This exploit targets a SQL injection vulnerability in the WordPress REST API batch endpoint (/wp-json/batch/v1) to achieve unauthenticated remote code execution. It uses time-based blind SQLi for detection and UNION-based injection to extract admin credentials, with fallback methods for writing webshells or uploading malicious plugins.

This repository provides a functional exploit for CVE-2026-63030, a WordPress REST batch-route confusion SQL injection vulnerability. The exploit leverages route desync to achieve SQLi, data extraction via bitmask oracle, and RCE via INTO OUTFILE with FILE privilege.

This repository provides a non-destructive detector for CVE-2026-63030 (REST /batch/v1 route confusion) and CVE-2026-60137 (WP_Query::author__not_in SQL injection) in WordPress core. The PoC confirms the unauthenticated SQL injection via time-based differential probing and includes a Docker lab for safe testing.

This repository provides a Docker-based reproduction environment for CVE-2026-63030, a vulnerability in WordPress 6.9.4. The PoC includes a vulnerable WordPress setup with MySQL and demonstrates the exploit via a crafted environment, though the exact exploit code is not explicitly visible in the provided files.

This repository contains a functional exploit for CVE-2026-63030, a critical unauthenticated SQL injection vulnerability in WordPress's REST batch endpoint due to route-confusion. The exploit chains SQLi to pre-auth admin account creation and RCE via a self-destructing webshell plugin.

This exploit targets a route confusion vulnerability (CVE-2026-63030) in WordPress's REST API batch endpoint, chained with an SQL injection (CVE-2026-60137) to achieve pre-authentication remote code execution (RCE). The PoC includes version detection, vulnerability probing, and a full exploit chain for command execution.

This PoC exploits a pre-authentication vulnerability in WordPress (6.9.0-7.0.1) by chaining REST API batch route confusion, SQL injection via `author_exclude`, oEmbed cache poisoning, and Customizer changeset privilege escalation to achieve unauthenticated admin creation and RCE via plugin upload.

A defensive Bash script designed to detect and remediate compromise from CVE-2026-63030 (wp2shell), a pre-authentication RCE in WordPress. The tool scans for rogue administrator accounts and webshells left by attackers post-exploitation, with optional cleanup functionality.

This repository contains a functional exploit chain for CVE-2026-63030 (REST batch route confusion) and CVE-2026-60137 (WP_Query author__not_in SQL injection) in WordPress, enabling unauthenticated remote code execution. The exploit leverages route confusion to smuggle SQLi payloads, then escalates to RCE via admin user creation and webshell deployment.

This tool detects exposure to CVE-2026-63030 and CVE-2026-60137, a pre-authentication RCE chain in WordPress core (versions 6.9.0-6.9.4 and 7.0.0-7.0.1). It fingerprints WordPress versions from public sources and checks REST batch endpoint reachability without exploiting the vulnerability.

This repository contains a functional exploit for CVE-2026-63030, a WordPress REST batch route-confusion vulnerability chained with an unauthenticated SQL injection in WP_Query::author__not_in. The exploit achieves pre-auth RCE via INTO OUTFILE to write a PHP webshell.

This repository provides a non-destructive scanner for detecting WordPress core exposure to CVE-2026-63030 (RCE) and CVE-2026-60137 (SQLi). It checks the WordPress version and verifies the reachability of the REST `/batch/v1` route without sending exploit payloads.

This repository provides a functional exploit for CVE-2026-63030, a WordPress vulnerability chain combining route-confusion and SQL injection (CVE-2026-60137) to achieve remote code execution (RCE). The PoC includes timing-based SQLi confirmation, webshell upload via INTO OUTFILE, and credential extraction.

This repository provides a temporary mitigation plugin for WordPress that blocks two critical vulnerabilities (CVE-2026-60137 and CVE-2026-63030) in the 'wp2shell' exploit chain. The plugin sanitizes WP_Query parameters and disables the REST API batch endpoint to prevent unauthenticated RCE.

This repository contains a functional exploit for CVE-2026-63030 (REST batch route confusion) and CVE-2026-60137 (SQL injection in `author__not_in` parameter). The exploit chains these vulnerabilities to achieve unauthenticated blind SQL injection and, with valid admin credentials, remote code execution via malicious plugin upload.

This PoC exploits a pre-authentication UNION-based SQL injection vulnerability (CVE-2026-63030) in WordPress's REST batch route via route-confusion. It includes a Cloudflare WAF bypass technique using JSON body padding to evade inspection limits, enabling in-band data extraction.

This exploit chains CVE-2026-63030 (REST API batch route confusion leading to SQL injection) with CVE-2026-60137 (customizer changeset re-entry for privilege escalation) to achieve pre-authentication remote code execution in WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. The PoC demonstrates a full exploit chain from SQLi to object cache poisoning, privilege escalation, and OS command execution.

This tool detects the pre-authentication RCE vulnerability (CVE-2026-63030) in WordPress Core's REST Batch API by sending a non-destructive probe to identify request handler desynchronization. It checks for specific error markers to determine vulnerability status without executing malicious payloads.

This repository contains a functional exploit chain for CVE-2026-63030 (REST API batch route confusion) and CVE-2026-60137 (WP_Query SQL injection in author__not_in parameter). The exploit achieves unauthenticated SQL injection leading to credential extraction from WordPress databases.

This repository provides a detailed technical demonstration of CVE-2026-63030, a REST batch request desync vulnerability in WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. The PoC includes a self-contained PHP model of the vulnerable loop, live HTTP probes, and a Docker-based lab environment to safely reproduce the array misalignment that allows unauthenticated requests to be dispatched under privileged handlers.

This repository demonstrates a SQL injection vulnerability (CVE-2026-63030) in WordPress's REST API posts collection endpoint. The flaw arises from improper handling of the `author_exclude` parameter, which is passed directly to `WP_Query` without proper sanitization in the SQL query construction, allowing arbitrary SQL injection via crafted input.

This repository provides a WordPress plugin that mitigates unauthenticated access to WordPress Core's REST Batch API endpoint (CVE-2026-63030) by enforcing authentication requirements. It does not exploit the vulnerability but blocks anonymous requests to the affected endpoint.

This tool checks for exposure to CVE-2026-63030 and CVE-2026-60137 by passively detecting WordPress versions and probing the REST batch endpoint for reachability. It does not exploit the vulnerabilities but identifies potentially vulnerable instances based on version and route availability.

This repository contains a Python-based scanner for CVE-2026-63030, a WordPress vulnerability affecting versions 6.9.0-6.9.4 and 7.0.0-7.0.1. The tool detects vulnerable instances by checking for structural and timing-based indicators of the flaw, but does not include exploit code for remote code execution (RCE).

This repository contains a WordPress plugin that performs a read-only forensic scan for artifacts left by the CVE-2026-63030 and CVE-2026-60137 exploit chain. It checks for indicators such as malicious oembed_cache entries, object-graph poisoning, suspicious user accounts, and webshell plugins, but does not exploit the vulnerability.

This repository contains a functional exploit chain for CVE-2026-63030 (REST API batch endpoint route confusion) and CVE-2026-60137 (WP_Query SQL injection via author__not_in parameter), enabling unauthenticated RCE in WordPress 6.9.x < 6.9.5 and 7.0.x < 7.0.2. The exploit uses UNION-based SQL injection to forge admin users and deploy webshells via the theme editor.

This repository contains a functional exploit for CVE-2026-63030, a pre-authentication blind SQL injection vulnerability in WordPress core (versions 6.9.0-6.9.4 and 7.0.0-7.0.1). The exploit leverages a route confusion vulnerability in the REST API batch endpoint to bypass authentication and execute time-based blind SQLi via the `author_exclude` parameter, enabling full database extraction.

This repository provides a functional exploit for CVE-2026-63030 (WordPress REST batch route confusion leading to pre-auth RCE) and CVE-2026-60137 (blind SQLi). The PoC includes scanning, SQLi data extraction, and unauthenticated RCE via admin forgery and webshell upload, with detailed version fingerprinting and attack chaining.

This repository contains a functional exploit chain for CVE-2026-63030 and CVE-2026-60137, combining a REST API batch endpoint authentication bypass with an unauthenticated SQL injection in WordPress's WP_Query via the `author__not_in` parameter. The PoC demonstrates data exfiltration and RCE capabilities through SQLi.

This repository contains a functional exploit chain for CVE-2026-63030 (WordPress batch route confusion) and CVE-2026-60137 (SQL injection), enabling pre-authentication remote code execution. The exploit leverages nested batch desync to achieve blind SQLi, then uses oEmbed cache poisoning and object cache manipulation to gain admin privileges and deploy a webshell.

This exploit chains CVE-2026-63030 (REST API batch route confusion) with CVE-2026-60137 (SQL injection in WP_Query) to achieve unauthenticated remote code execution in WordPress 6.9.0-7.0.1. The PoC demonstrates a complex desync attack to bypass schema validation, followed by UNION-based SQLi to extract data and create an admin user, culminating in webshell deployment.

This repository provides a functional scanner and exploit chain for CVE-2026-63030, a pre-authenticated SQL injection in WordPress Core's REST API batch endpoint. The vulnerability is chained to achieve remote code execution via INTO OUTFILE when the database user has FILE privileges. The tool includes non-destructive detection, Boolean/blind extraction, and full exploit validation.

This exploit leverages a route confusion vulnerability in WordPress REST API's batch endpoint combined with a SQL injection in the `author__not_in` parameter to create an unauthorized administrator account. It then uses this access to upload a malicious plugin for remote command execution.

This PoC exploits a pre-authentication SQL injection vulnerability in WordPress's REST API batch endpoint to achieve remote code execution by writing a PHP webshell to the filesystem via INTO OUTFILE. The exploit leverages UNION-based SQLi to inject malicious PHP code into a file in the uploads directory.

This repository contains a functional exploit for CVE-2026-63030 (REST batch desync) and CVE-2026-60137 (WP_Query SQLi), chained to achieve pre-authentication RCE in WordPress core. The exploit leverages REST route confusion to inject SQL, forges admin users via crafted posts, and deploys a webshell plugin.

This repository contains a Go-based scanner for CVE-2026-63030, a WordPress REST API batch route vulnerability. The tool detects vulnerable WordPress versions (6.9.0-6.9.4, 7.0.0-7.0.1, and 7.1 beta) by probing REST batch endpoints and analyzing version strings, but does not exploit the vulnerability for code execution or data extraction.

This PoC exploits a chained vulnerability in WordPress 6.9.0-6.9.4 / 7.0.0-7.0.1 involving REST API batch misalignment (CVE-2026-63030) and SQL injection (CVE-2026-60137) to achieve unauthenticated RCE. The exploit poisons the object cache, triggers identity switching via changesets, and creates an admin account to deploy a webshell.

This tool is a non-intrusive detection scanner for CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection in WP_Query). It passively fingerprints WordPress versions and checks for the presence of the vulnerable REST API batch endpoint without exploiting the vulnerabilities.

This PoC exploits CVE-2026-63030, a critical WordPress Core vulnerability involving REST API route confusion chained with SQL injection (CVE-2026-60137) to achieve unauthenticated remote code execution. The exploit writes a webshell via SQLi and executes arbitrary commands.

This repository contains a functional exploit chain for CVE-2026-63030, a WordPress REST API batch route-confusion vulnerability leading to unauthenticated blind SQL injection. The exploit automates vulnerability checking, hash extraction via SQLi, authentication via password spraying, and webshell deployment for RCE.

This repository contains a functional exploit for CVE-2026-63030, a WordPress REST API batch route-confusion vulnerability enabling unauthenticated SQL injection (CVE-2026-60137). The exploit demonstrates blind SQLi for database enumeration and credential extraction via timing attacks.

This exploit leverages a SQL injection vulnerability in WordPress REST API's batch endpoint via route confusion, enabling time-based blind SQLi to extract usernames and password hashes. The PoC uses binary search and sleep-based timing to exfiltrate data without authentication.

This PoC exploits a pre-authentication blind SQL injection vulnerability (CVE-2026-63030) in WordPress's Batch API via HTTP request desynchronization. The exploit extracts user credentials and password hashes using binary search on ASCII values.

This script demonstrates a proof-of-concept for CVE-2026-63030, a WordPress vulnerability where unauthenticated attackers can inject malicious data into SQL queries via the `author__not_in` parameter in a nested REST API batch request. The PoC confirms the vulnerability by instrumenting a fixed sink (`/usr/bin/id`) when attacker-controlled data reaches the SQL query.

This script is a non-intrusive vulnerability scanner for CVE-2026-63030 and CVE-2026-60137, a pre-authentication RCE chain in WordPress core. It fingerprints WordPress versions and checks for the exposure of a vulnerable REST API batch route without sending any exploit payloads.

This exploit combines a time-based blind SQL injection (CVE-2026-60137) with a WordPress plugin upload mechanism to achieve unauthenticated remote code execution (CVE-2026-63030). The SQLi leverages route confusion in the WordPress REST API batch endpoint to bypass sanitization, while RCE is achieved by uploading a malicious plugin after extracting admin credentials.

The repository contains only a README.md file with a title referencing CVE-2026-63030 as a WordPress exploit and scanner, but no actual exploit code, technical details, or implementation is provided. The content is minimal and non-functional.

This repository contains a functional exploit for CVE-2026-63030, a REST batch route confusion vulnerability in WordPress, chained with CVE-2026-60137 (SQL injection) to enable time-based blind SQL data exfiltration. The PoC demonstrates unauthenticated data extraction via crafted batch requests.

This YAML file is a Nuclei template designed to detect unauthenticated time-based blind SQL injection in WordPress core via REST API batch endpoint route confusion. It sends crafted batch requests to measure response delays, confirming SQLi without exploiting it for data extraction or command execution.

Exploit chain leveraging a REST API batch route confusion (CVE-2026-63030) and SQL injection in WP_Query's author__not_in parameter (CVE-2026-60137) to achieve unauthenticated time-based blind SQL injection, enabling potential RCE in vulnerable WordPress versions.

This repository contains a functional proof-of-concept exploit for CVE-2026-63030, a route-confusion SQL injection vulnerability in WordPress's REST batch endpoint. The exploit chains unauthenticated SQLi to RCE by recovering admin credentials and deploying a webshell plugin.

This exploit chains CVE-2026-60137 (SQLi in WordPress WP_Query's author_exclude parameter) with CVE-2026-63030 (REST API batch-route confusion) to achieve unauthenticated RCE. The PoC uses time-based blind SQLi to extract database info, corrupts oEmbed cache entries, injects a malicious changeset, creates an admin user, and executes commands via a self-destructing plugin.