CVE-2026-63030-60137-wp2shell-lab

CVE-2026-63030 SQL Injection Python #poc #github #cve-2026-63030 #sqlinjection

Author

jed-parsec

Published

2026-09-27

Stars

0

Forks

0

Repository

jed-parsec/CVE-2026-63030-60137-wp2shell-lab

Description

Unauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) — a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Includes Docker Compose lab setup and a Python exploitation script. For authorized security research only.

View on GitHub More PoCs for CVE-2026-63030

CVE-CVE-2026-63030 Details

Severity

CRITICAL

CVSS Score

9.8

CWE

CWE-436

Description

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution....

View on NVD

Related PoCs for CVE-2026-63030

wp2shell-PoC...

39 arvindear

wp2shell-Exploit-Waf-Bypass...

1 M4xSec

WP2Shell...

0 g0d150ne

POC-CVE-2026-63030-CVE-2026-60137-...

0 TranDongA3

CVE-2026-63030-poc...

0 TomorrowX6

CVE-2026-63030...

0 fl0ydsec

View all PoCs for CVE-2026-63030 (7 total)