wp2shell v1.0.0 — Pre-Auth RCE

wp2shell v1.0.0

WordPress pre-auth RCE exploit — CVE-2026-63030 + CVE-2026-60137

Pre-compiled binaries

File	Platform
wp2shell-linux-amd64	Linux x86_64
wp2shell-linux-arm64	Linux ARM64
wp2shell-darwin-amd64	macOS Intel
wp2shell-darwin-arm64	macOS Apple Silicon
wp2shell-windows-amd64.exe	Windows x64

Quick start

chmod +x wp2shell-linux-amd64
./wp2shell-linux-amd64 scan -f targets.txt -j -t 20
./wp2shell-linux-amd64 rce https://target.com --cmd id -y --waf

What's included

• Mass scanner with version fingerprinting
• Blind SQLi confirmation (time-based)
• Full RCE chain (SQLi → oEmbed → changeset → admin → shell)
• Built-in WAF bypass (Cloudflare, ModSecurity)
• Stealth webshell with header auth
• Interactive shell mode