wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain
-
Updated
Jul 23, 2026 - Python
#
wp2shell
Here are 14 public repositories matching this topic...
Non-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1
-
Updated
Jul 22, 2026 - Python
wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on WP 6.9.0–6.9.4 / 7.0.0–7.0.1.
wordpress wordfence wordpress-core codeb0ss realcodeb0ss thecodeb0ss wp2shell cve-2026-63030 cve-2026-60137
-
Updated
Jul 18, 2026 - Python
wp2shell - WordPress CVE-2026-63030 Exploit & Scanner
python wordpress exploit rce sql-injection security-tools vulnerability-scanner unauthenticated unauthenticated-rce wp2shell wp2shell-poc cve-2026-63030
-
Updated
Jul 18, 2026 - Python
A scanner and proof-of-concept toolkit for CVE-2026-63030 (wp2shell) - pre-authenticated remote code execution in WordPress core
-
Updated
Jul 18, 2026 - Python
WordPress REST API SQLi to RCE PoC (CVE-2026-63030 & CVE-2026-60137)
proof-of-concept poc sql-injection wordpress-rce wp2shell wp2shell-poc cve-2026-63030 wp2shell-exploit
-
Updated
Jul 21, 2026 - Python
Automated exploit chain for CVE-2026-63030 / CVE-2026-60137 — unauthenticated blind SQLi via WordPress REST batch route-confusion. Dumps user hashes, cracks credentials, deploys webshell. Supports single target and bulk site lists. For authorized security testing only.
-
Updated
Jul 18, 2026 - Python
WordPress Core Pre-Auth RCE via REST Batch Route Confusion + SQLi (CVE-2026-63030 + CVE-2026-60137)
python wordpress security exploit rce sql-injection vulnerability cve batch-api pre-auth wp2shell cve-2026-63030 cve-2026-60137
-
Updated
Jul 24, 2026 - Python
CVE-2026-60137Temporary Emergency Mitigation for CVE-2026-60137 & CVE-2026-63030 (wp2shell)
-
Updated
Jul 21, 2026 - PHP
WordPress wp2shell vulnerability-chain scanner for CVE-2026-63030 and CVE-2026-60137, with active detection, optional PoC, JSON export.
penetration-testing security-scanner vulnerability-scanner wordpress-security-scanner wp2shell cve-2026-63030 cve-2026-60137
-
Updated
Jul 20, 2026 - Python
PoC detector & safe validator for the WP2Shell WordPress vulnerability chain: CVE-2026-63030 (REST batch-route confusion) + CVE-2026-60137 (author__not_in SQL injection). For authorized security testing only.
python wordpress proof-of-concept penetration-testing poc sql-injection infosec wordpress-security cve security-tools vulnerability-scanner security-research rest-api-security wp2shell cve-2026-63030 cve-2026-60137
-
Updated
Jul 21, 2026 - Python
Non-intrusive checker for CVE-2026-63030 / CVE-2026-60137 ("wp2shell"), a pre-authentication RCE chain in WordPress core.
-
Updated
Jul 18, 2026 - Python
CVE-2026-63030 & CVE-2026-60137 Wp2shell Poc
python wordpress wordpress-api python-script python3 poc rce rce-exploit wp2shell wp2shell-poc cve-2026-63030 cve-2026-60137
-
Updated
Jul 22, 2026 - Python
Improve this page
Add a description, image, and links to the wp2shell topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the wp2shell topic, visit your repo's landing page and select "manage topics."