CVE-2026-63030

This PoC exploits a chained vulnerability in WordPress (CVE-2026-63030 + CVE-2026-60137) to achieve unauthenticated admin account creation. It leverages a REST API batch route misalignment to trigger a SQL injection via WP_Query's author__not_in parameter, then abuses WordPress's changeset reentry mechanism to elevate privileges.

This repository contains a functional exploit chain for CVE-2026-63030 (REST batch route confusion) chained with CVE-2026-60137 (WP_Query author__not_in SQL injection) to achieve unauthenticated remote code execution (RCE) in WordPress versions 6.9.0-6.9.4 and 7.0.0-7.0.1. The exploit includes version detection, SQL injection, and webshell deployment with token-gated command execution.

This repository contains a functional exploit for CVE-2026-63030, a critical WordPress REST API batch route confusion vulnerability chained with CVE-2026-60137 (SQL injection in WP_Query's author__not_in parameter) to achieve unauthenticated remote code execution. The exploit creates an admin user via SQL injection and deploys a webshell.

This repository contains a functional exploit for CVE-2026-63030, a WordPress pre-authentication RCE vulnerability chained with CVE-2026-60137 (SQL injection). The exploit leverages batch route confusion and UNION-based SQLi to perform database reconnaissance, oEmbed cache poisoning, and webshell deployment for command execution.

This PoC exploits a route confusion vulnerability (CVE-2026-63030) in WordPress's REST API batch endpoint, chained with a SQL injection (CVE-2026-60137) in WP_Query's `author__not_in` parameter, to achieve unauthenticated SQL injection and remote code execution via webshell deployment.

This repository contains a functional exploit for CVE-2026-63030, a critical WordPress REST API batch route confusion vulnerability chained with CVE-2026-60137 (SQL injection in `author__not_in`). The exploit demonstrates unauthenticated SQL injection leading to admin account creation and RCE via webshell deployment.

Exploits a REST API batch route confusion vulnerability (CVE-2026-63030) combined with blind SQL injection (CVE-2026-60137) in WordPress core. The PoC demonstrates time-based SQLi via crafted `author_exclude` parameter and structural route confusion to confirm exploitation.

This exploit targets a SQL injection vulnerability in the WordPress REST API batch endpoint (/wp-json/batch/v1) to achieve unauthenticated remote code execution. It uses time-based blind SQLi for detection and UNION-based injection to extract admin credentials, with fallback methods for writing webshells or uploading malicious plugins.

This exploit chains two WordPress core vulnerabilities (CVE-2026-63030 and CVE-2026-60137) to achieve unauthenticated remote code execution. The exploit leverages a REST batch handler desync to smuggle attacker-controlled input into a SQL injection primitive, then uses fabricated posts and oembed caching to escalate to admin privileges and execute commands.

This repository provides a functional exploit for CVE-2026-63030, a WordPress REST batch-route confusion SQL injection vulnerability. The exploit leverages route desync to achieve SQLi, data extraction via bitmask oracle, and RCE via INTO OUTFILE with FILE privilege.

This repository provides a non-destructive detector for CVE-2026-63030 (REST /batch/v1 route confusion) and CVE-2026-60137 (WP_Query::author__not_in SQL injection) in WordPress core. The PoC confirms the unauthenticated SQL injection via time-based differential probing and includes a Docker lab for safe testing.

This repository provides a functional exploit for CVE-2026-63030, a critical remote code execution (RCE) vulnerability in WordPress core (versions 6.9.0-6.9.4 and 7.0.0-7.0.1) due to REST API batch route confusion combined with a blind SQL injection (CVE-2026-60137). The exploit includes WAF bypass techniques (unicode escaping, path manipulation) and integrates with Metasploit for scanning and exploitation.

This repository provides a Docker-based reproduction environment for CVE-2026-63030, a vulnerability in WordPress 6.9.4. The PoC includes a vulnerable WordPress setup with MySQL and demonstrates the exploit via a crafted environment, though the exact exploit code is not explicitly visible in the provided files.

This repository contains a functional exploit for CVE-2026-63030, a critical unauthenticated SQL injection vulnerability in WordPress's REST batch endpoint due to route-confusion. The exploit chains SQLi to pre-auth admin account creation and RCE via a self-destructing webshell plugin.

This exploit targets a route confusion vulnerability (CVE-2026-63030) in WordPress's REST API batch endpoint, chained with an SQL injection (CVE-2026-60137) to achieve pre-authentication remote code execution (RCE). The PoC includes version detection, vulnerability probing, and a full exploit chain for command execution.

This PoC exploits a pre-authentication vulnerability in WordPress (6.9.0-7.0.1) by chaining REST API batch route confusion, SQL injection via `author_exclude`, oEmbed cache poisoning, and Customizer changeset privilege escalation to achieve unauthenticated admin creation and RCE via plugin upload.

A defensive Bash script designed to detect and remediate compromise from CVE-2026-63030 (wp2shell), a pre-authentication RCE in WordPress. The tool scans for rogue administrator accounts and webshells left by attackers post-exploitation, with optional cleanup functionality.

This repository contains a functional exploit chain for CVE-2026-63030 (REST batch route confusion) and CVE-2026-60137 (WP_Query author__not_in SQL injection) in WordPress, enabling unauthenticated remote code execution. The exploit leverages route confusion to smuggle SQLi payloads, then escalates to RCE via admin user creation and webshell deployment.

This tool detects exposure to CVE-2026-63030 and CVE-2026-60137, a pre-authentication RCE chain in WordPress core (versions 6.9.0-6.9.4 and 7.0.0-7.0.1). It fingerprints WordPress versions from public sources and checks REST batch endpoint reachability without exploiting the vulnerability.

This repository contains a functional exploit for CVE-2026-63030, a WordPress REST batch route-confusion vulnerability chained with an unauthenticated SQL injection in WP_Query::author__not_in. The exploit achieves pre-auth RCE via INTO OUTFILE to write a PHP webshell.

This repository provides a non-destructive scanner for detecting WordPress core exposure to CVE-2026-63030 (RCE) and CVE-2026-60137 (SQLi). It checks the WordPress version and verifies the reachability of the REST `/batch/v1` route without sending exploit payloads.

This repository contains a functional exploit for CVE-2026-63030 and CVE-2026-60137, chaining a WordPress REST API batch endpoint SQL injection with HTTP request smuggling to achieve pre-authentication remote code execution. The exploit includes SQLi techniques (UNION-based, error-based, and blind) and a detailed scanner for vulnerability detection.

This exploit chains CVE-2026-63030 (WordPress Core Batch Route Confusion) and CVE-2026-60137 (SQL Injection) to achieve pre-authentication remote code execution. The exploit uses a malformed batch request to bypass authentication, then leverages SQLi to extract admin credentials and upload a PHP shell via plugin/theme installation.

This PoC exploits an unauthenticated remote code execution (RCE) vulnerability in the Backup Migration WordPress plugin (CVE-2023-6553) by manipulating the 'Content-Dir' HTTP header to control PHP's require_once path, leading to arbitrary code inclusion. The exploit demonstrates the attack flow with a staged payload delivery and execution.

This repository provides a functional exploit framework for CVE-2026-63030 (WordPress core HTTP request desync vulnerability leading to unauthenticated admin account creation via oEmbed cache poisoning) and CVE-2026-60137 (SQL injection). The PoC includes detection, scanning, exploitation, and post-exploitation (webshell deployment) capabilities with multi-CVE support.

This PoC exploits a route-confusion vulnerability in WordPress REST batch endpoints to achieve SQL injection (SQLi), which is then leveraged to create an admin user and gain remote code execution (RCE) via three distinct methods: plugin upload, theme overwrite, or SQLi-based file write. The exploit demonstrates a full attack chain from unauthenticated access to RCE.

This repository contains a functional exploit for CVE-2026-63030, a WordPress vulnerability allowing unauthenticated SQL injection leading to remote code execution (RCE). The exploit chains SQLi to create an admin account, then uploads a malicious plugin with a PHP webshell.

The repository contains a password-protected ZIP file with obfuscated Python code and a README that directs users to an external YouTube video rather than providing technical details or exploit code. The content lacks any legitimate vulnerability analysis or proof-of-concept.

This repository contains a Python-based scanner for CVE-2026-63030, a time-based SQL injection vulnerability in the WordPress Batch API. The tool measures response time deltas to detect potential SQLi without executing arbitrary commands or payloads.

This repository contains two Bash scripts designed to detect indicators of compromise (IoCs) related to CVE-2026-63030 (REST batch route confusion) and CVE-2026-60137 (SQL injection) in WordPress installations on HestiaCP servers. The scripts perform read-only scans, checking for rogue admin accounts, poisoned database entries, core file integrity, and malicious PHP/JS patterns.

This repository contains a functional exploit for CVE-2026-63030, a WordPress SQL injection vulnerability in the REST API batch endpoint. The exploit leverages UNION-based SQLi to extract database information, write webshells via INTO OUTFILE, and extract credentials, with detailed technical implementation for MySQL environment probing and exploitation.

This repository contains a functional exploit chain for CVE-2026-63030 (REST Batch Route Confusion) and CVE-2026-60137 (WP_Query SQL Injection) in WordPress, enabling unauthenticated RCE via SQLi, admin takeover, and webshell upload. The PoC includes detailed technical analysis, a vulnerable Docker environment, and a fully automated exploit script.

This repository provides a detailed technical analysis of CVE-2026-63030, a critical authorization bypass vulnerability in WordPress REST API endpoint handlers. The writeup includes root cause analysis (context bleed in batch requests), safe verification protocols, and remediation guidance without including exploit code.

This repository contains a functional exploit chain for CVE-2026-63030 (REST batch route confusion) and CVE-2026-60137 (SQL injection in `author__not_in`). The exploit achieves pre-authentication RCE by creating an admin user via cache poisoning and REST API desynchronization, then deploys a webshell.

This repository contains a functional exploit chain for CVE-2026-63030 (WordPress route confusion/auth bypass) and CVE-2026-60137 (SQL injection leading to RCE). The exploit leverages UNION-based SQLi to extract data, poison oEmbed caches, and create an admin account for webshell deployment.

This repository provides a functional exploit chain for CVE-2026-63030 (REST API batch endpoint route confusion) and CVE-2026-60137 (author__not_in SQL injection) in WordPress Core, enabling unauthenticated remote code execution via crafted batch requests and SQLi payloads to deploy webshells or execute commands.

This repository contains a functional exploit for CVE-2026-63030 (and CVE-2026-60137), demonstrating a time-based blind SQL injection in WordPress REST API batch endpoint chained to achieve remote code execution (RCE). The exploit uses binary search techniques to extract data and leverages WordPress functionality to create admin accounts and upload malicious plugins.

This repository provides an interactive JavaScript simulation demonstrating the logical flow of CVE-2026-63030, a WordPress REST Route Confusion vulnerability leading to SQL injection. The code illustrates how improper parameter sanitization in batch requests can bypass validation checks, enabling SQLi via crafted `author_exclude` parameters.

A non-destructive bash script that recursively scans directories for WordPress installations and checks version.php files to determine vulnerability to CVE-2026-63030 (REST API batch route confusion) and CVE-2026-60137 (SQL injection), classifying them by severity (RCE or SQLi-only).

This repository provides a functional exploit for CVE-2026-63030, a WordPress vulnerability chain combining route-confusion and SQL injection (CVE-2026-60137) to achieve remote code execution (RCE). The PoC includes timing-based SQLi confirmation, webshell upload via INTO OUTFILE, and credential extraction.

This repository provides a temporary mitigation plugin for WordPress that blocks two critical vulnerabilities (CVE-2026-60137 and CVE-2026-63030) in the 'wp2shell' exploit chain. The plugin sanitizes WP_Query parameters and disables the REST API batch endpoint to prevent unauthenticated RCE.

This repository contains a functional exploit for CVE-2026-63030 (REST batch route confusion) and CVE-2026-60137 (SQL injection in `author__not_in` parameter). The exploit chains these vulnerabilities to achieve unauthenticated blind SQL injection and, with valid admin credentials, remote code execution via malicious plugin upload.

This PoC exploits a pre-authentication UNION-based SQL injection vulnerability (CVE-2026-63030) in WordPress's REST batch route via route-confusion. It includes a Cloudflare WAF bypass technique using JSON body padding to evade inspection limits, enabling in-band data extraction.

This exploit leverages a route confusion vulnerability (CVE-2026-63030) and SQL injection (CVE-2026-60137) in WordPress's REST API batch endpoint to achieve pre-authentication remote code execution. It uses UNION-based SQLi to create an admin user or blind extraction to obtain admin credentials, then deploys a webshell via the REST API.

This exploit leverages a route confusion vulnerability (CVE-2026-63030) in WordPress's REST API batch endpoint combined with an unauthenticated SQL injection (CVE-2026-60137) in the `author_exclude` parameter to achieve pre-authentication remote code execution. The exploit supports UNION-based admin creation, blind SQLi extraction, and webshell deployment via plugin upload.

This exploit chains CVE-2026-63030 (REST API batch route confusion leading to SQL injection) with CVE-2026-60137 (customizer changeset re-entry for privilege escalation) to achieve pre-authentication remote code execution in WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. The PoC demonstrates a full exploit chain from SQLi to object cache poisoning, privilege escalation, and OS command execution.

This tool detects the pre-authentication RCE vulnerability (CVE-2026-63030) in WordPress Core's REST Batch API by sending a non-destructive probe to identify request handler desynchronization. It checks for specific error markers to determine vulnerability status without executing malicious payloads.

This repository contains a functional exploit chain for CVE-2026-63030 (REST API batch route confusion) and CVE-2026-60137 (WP_Query SQL injection in author__not_in parameter). The exploit achieves unauthenticated SQL injection leading to credential extraction from WordPress databases.

This repository provides a detailed technical demonstration of CVE-2026-63030, a REST batch request desync vulnerability in WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. The PoC includes a self-contained PHP model of the vulnerable loop, live HTTP probes, and a Docker-based lab environment to safely reproduce the array misalignment that allows unauthenticated requests to be dispatched under privileged handlers.

This repository demonstrates a SQL injection vulnerability (CVE-2026-63030) in WordPress's REST API posts collection endpoint. The flaw arises from improper handling of the `author_exclude` parameter, which is passed directly to `WP_Query` without proper sanitization in the SQL query construction, allowing arbitrary SQL injection via crafted input.

This repository provides a WordPress plugin that mitigates unauthenticated access to WordPress Core's REST Batch API endpoint (CVE-2026-63030) by enforcing authentication requirements. It does not exploit the vulnerability but blocks anonymous requests to the affected endpoint.

This tool checks for exposure to CVE-2026-63030 and CVE-2026-60137 by passively detecting WordPress versions and probing the REST batch endpoint for reachability. It does not exploit the vulnerabilities but identifies potentially vulnerable instances based on version and route availability.

This repository contains a Python-based scanner for CVE-2026-63030, a WordPress vulnerability affecting versions 6.9.0-6.9.4 and 7.0.0-7.0.1. The tool detects vulnerable instances by checking for structural and timing-based indicators of the flaw, but does not include exploit code for remote code execution (RCE).

This repository contains a WordPress plugin that performs a read-only forensic scan for artifacts left by the CVE-2026-63030 and CVE-2026-60137 exploit chain. It checks for indicators such as malicious oembed_cache entries, object-graph poisoning, suspicious user accounts, and webshell plugins, but does not exploit the vulnerability.

This repository contains a functional exploit chain for CVE-2026-63030 (REST API batch endpoint route confusion) and CVE-2026-60137 (WP_Query SQL injection via author__not_in parameter), enabling unauthenticated RCE in WordPress 6.9.x < 6.9.5 and 7.0.x < 7.0.2. The exploit uses UNION-based SQL injection to forge admin users and deploy webshells via the theme editor.

This repository contains a functional exploit for CVE-2026-63030, a pre-authentication blind SQL injection vulnerability in WordPress core (versions 6.9.0-6.9.4 and 7.0.0-7.0.1). The exploit leverages a route confusion vulnerability in the REST API batch endpoint to bypass authentication and execute time-based blind SQLi via the `author_exclude` parameter, enabling full database extraction.

This repository provides a functional exploit for CVE-2026-63030 (WordPress REST batch route confusion leading to pre-auth RCE) and CVE-2026-60137 (blind SQLi). The PoC includes scanning, SQLi data extraction, and unauthenticated RCE via admin forgery and webshell upload, with detailed version fingerprinting and attack chaining.

This repository contains a functional exploit chain for CVE-2026-63030 and CVE-2026-60137, combining a REST API batch endpoint authentication bypass with an unauthenticated SQL injection in WordPress's WP_Query via the `author__not_in` parameter. The PoC demonstrates data exfiltration and RCE capabilities through SQLi.

This repository contains a functional exploit chain for CVE-2026-63030 (WordPress batch route confusion) and CVE-2026-60137 (SQL injection), enabling pre-authentication remote code execution. The exploit leverages nested batch desync to achieve blind SQLi, then uses oEmbed cache poisoning and object cache manipulation to gain admin privileges and deploy a webshell.

This exploit chains CVE-2026-63030 (REST API batch route confusion) with CVE-2026-60137 (SQL injection in WP_Query) to achieve unauthenticated remote code execution in WordPress 6.9.0-7.0.1. The PoC demonstrates a complex desync attack to bypass schema validation, followed by UNION-based SQLi to extract data and create an admin user, culminating in webshell deployment.

This repository provides a functional scanner and exploit chain for CVE-2026-63030, a pre-authenticated SQL injection in WordPress Core's REST API batch endpoint. The vulnerability is chained to achieve remote code execution via INTO OUTFILE when the database user has FILE privileges. The tool includes non-destructive detection, Boolean/blind extraction, and full exploit validation.

This exploit leverages a route confusion vulnerability in WordPress REST API's batch endpoint combined with a SQL injection in the `author__not_in` parameter to create an unauthorized administrator account. It then uses this access to upload a malicious plugin for remote command execution.

This PoC exploits a pre-authentication SQL injection vulnerability in WordPress's REST API batch endpoint to achieve remote code execution by writing a PHP webshell to the filesystem via INTO OUTFILE. The exploit leverages UNION-based SQLi to inject malicious PHP code into a file in the uploads directory.

This repository contains a functional exploit for CVE-2026-63030 (REST batch desync) and CVE-2026-60137 (WP_Query SQLi), chained to achieve pre-authentication RCE in WordPress core. The exploit leverages REST route confusion to inject SQL, forges admin users via crafted posts, and deploys a webshell plugin.

This repository contains a Go-based scanner for CVE-2026-63030, a WordPress REST API batch route vulnerability. The tool detects vulnerable WordPress versions (6.9.0-6.9.4, 7.0.0-7.0.1, and 7.1 beta) by probing REST batch endpoints and analyzing version strings, but does not exploit the vulnerability for code execution or data extraction.

This PoC exploits a chained vulnerability in WordPress 6.9.0-6.9.4 / 7.0.0-7.0.1 involving REST API batch misalignment (CVE-2026-63030) and SQL injection (CVE-2026-60137) to achieve unauthenticated RCE. The exploit poisons the object cache, triggers identity switching via changesets, and creates an admin account to deploy a webshell.

This tool is a non-intrusive detection scanner for CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection in WP_Query). It passively fingerprints WordPress versions and checks for the presence of the vulnerable REST API batch endpoint without exploiting the vulnerabilities.

This PoC exploits CVE-2026-63030, a critical WordPress Core vulnerability involving REST API route confusion chained with SQL injection (CVE-2026-60137) to achieve unauthenticated remote code execution. The exploit writes a webshell via SQLi and executes arbitrary commands.

This repository contains a functional exploit chain for CVE-2026-63030, a WordPress REST API batch route-confusion vulnerability leading to unauthenticated blind SQL injection. The exploit automates vulnerability checking, hash extraction via SQLi, authentication via password spraying, and webshell deployment for RCE.

This repository contains a functional exploit for CVE-2026-63030, a WordPress REST API batch route-confusion vulnerability enabling unauthenticated SQL injection (CVE-2026-60137). The exploit demonstrates blind SQLi for database enumeration and credential extraction via timing attacks.

This exploit leverages a SQL injection vulnerability in WordPress REST API's batch endpoint via route confusion, enabling time-based blind SQLi to extract usernames and password hashes. The PoC uses binary search and sleep-based timing to exfiltrate data without authentication.

This PoC exploits a pre-authentication blind SQL injection vulnerability (CVE-2026-63030) in WordPress's Batch API via HTTP request desynchronization. The exploit extracts user credentials and password hashes using binary search on ASCII values.

This script demonstrates a proof-of-concept for CVE-2026-63030, a WordPress vulnerability where unauthenticated attackers can inject malicious data into SQL queries via the `author__not_in` parameter in a nested REST API batch request. The PoC confirms the vulnerability by instrumenting a fixed sink (`/usr/bin/id`) when attacker-controlled data reaches the SQL query.

This script is a non-intrusive vulnerability scanner for CVE-2026-63030 and CVE-2026-60137, a pre-authentication RCE chain in WordPress core. It fingerprints WordPress versions and checks for the exposure of a vulnerable REST API batch route without sending any exploit payloads.

This exploit combines a time-based blind SQL injection (CVE-2026-60137) with a WordPress plugin upload mechanism to achieve unauthenticated remote code execution (CVE-2026-63030). The SQLi leverages route confusion in the WordPress REST API batch endpoint to bypass sanitization, while RCE is achieved by uploading a malicious plugin after extracting admin credentials.

The repository contains only a README.md file with a title referencing CVE-2026-63030 as a WordPress exploit and scanner, but no actual exploit code, technical details, or implementation is provided. The content is minimal and non-functional.

This repository contains a functional exploit for CVE-2026-63030, a REST batch route confusion vulnerability in WordPress, chained with CVE-2026-60137 (SQL injection) to enable time-based blind SQL data exfiltration. The PoC demonstrates unauthenticated data extraction via crafted batch requests.

This YAML file is a Nuclei template designed to detect unauthenticated time-based blind SQL injection in WordPress core via REST API batch endpoint route confusion. It sends crafted batch requests to measure response delays, confirming SQLi without exploiting it for data extraction or command execution.

Exploit chain leveraging a REST API batch route confusion (CVE-2026-63030) and SQL injection in WP_Query's author__not_in parameter (CVE-2026-60137) to achieve unauthenticated time-based blind SQL injection, enabling potential RCE in vulnerable WordPress versions.

This repository contains a functional proof-of-concept exploit for CVE-2026-63030, a route-confusion SQL injection vulnerability in WordPress's REST batch endpoint. The exploit chains unauthenticated SQLi to RCE by recovering admin credentials and deploying a webshell plugin.

This Metasploit module exploits a REST API batch route-confusion vulnerability (CVE-2026-63030) chained with an SQL injection (CVE-2026-60137) in WordPress to achieve unauthenticated remote code execution. The exploit creates an administrator account, uploads a malicious plugin, and executes a payload via PHP.

This exploit chains CVE-2026-60137 (SQLi in WordPress WP_Query's author_exclude parameter) with CVE-2026-63030 (REST API batch-route confusion) to achieve unauthenticated RCE. The PoC uses time-based blind SQLi to extract database info, corrupts oEmbed cache entries, injects a malicious changeset, creates an admin user, and executes commands via a self-destructing plugin.