Educational and defensive Proof of Concept (PoC) for validating exposure to the WordPress Core vulnerabilities CVE-2026-60137 and CVE-2026-63030 (WP2Shell).
This repository provides a defensive detection and validation proof of concept for the WordPress Core vulnerabilities collectively known as WP2Shell.
According to publicly available security research, WP2Shell describes a vulnerability chain involving CVE-2026-60137 and CVE-2026-63030 that, under specific conditions, can result in unauthenticated Remote Code Execution (RCE).
The objective of this project is to help:
- Security researchers
- Penetration testers
- Blue teams
- Incident responders
- System administrators
identify vulnerable WordPress installations, reproduce the issue in authorized laboratory environments, and verify successful remediation after applying official security updates.
This repository is intended strictly for educational, defensive, and authorized security research purposes.
| CVE | Description |
|---|---|
| CVE-2026-60137 | WordPress Core vulnerability involved in the WP2Shell vulnerability chain. |
| CVE-2026-63030 | Critical WordPress Core Remote Code Execution (RCE) vulnerability, publicly referred to as WP2Shell. |
According to the public advisories, the following WordPress Core versions are affected:
- WordPress 6.9.0 – 6.9.4
- WordPress 7.0.0 – 7.0.1
Users should upgrade to the latest patched release provided by the WordPress Security Team.
This project is designed to assist defenders in:
- Validating exposure to WP2Shell
- Detecting vulnerable WordPress installations
- Verifying remediation after patching
- Reproducing the issue within isolated lab environments
- Supporting incident response and forensic investigations
- Improving technical understanding of the disclosed vulnerabilities
- Defensive vulnerability validation
- Detection of affected WordPress versions
- Research-oriented implementation
- Patch verification
- Lightweight detector / scanner
- Educational reference implementation
This repository has been published solely for:
- Academic research
- Security education
- Defensive security validation
- Authorized penetration testing
- Incident response
- Patch verification
- Vulnerability assessment
The software must only be executed against:
- Systems you own, or
- Systems for which you have received explicit authorization.
Unauthorized testing against systems that you do not own or administer may violate local laws, organizational policies, or international regulations.
The author does not encourage or support:
- Unauthorized access
- Internet-wide exploitation
- Mass scanning of third-party systems
- Malicious activity
- Abuse of vulnerable infrastructure
This repository demonstrates publicly disclosed vulnerability behavior for defensive validation and educational purposes only.
It is not intended to function as an offensive exploitation framework or to facilitate unauthorized access.
Users are expected to comply with all applicable laws, regulations, and responsible disclosure practices.
The proof of concept was developed and validated in the following environment:
- Operating System: Microsoft Windows
- Python Version: 2.7.17
Execution on other operating systems or Python versions may require minor modifications.
Administrators are strongly encouraged to:
- Upgrade WordPress to an officially patched release
- Apply all available security updates
- Review authentication and web server logs
- Monitor for suspicious administrative activity
- Deploy Web Application Firewall (WAF) protections
- Follow WordPress security hardening recommendations
- Continuously monitor official WordPress security advisories
- Rapid7 — WP2Shell Research
- The Hacker News — WP2Shell Analysis
- CVE-2026-60137
- CVE-2026-63030
- WordPress Security Releases
Telegram
This project is released for educational and defensive security research.
Users are solely responsible for ensuring that all testing is conducted with proper authorization and in accordance with applicable laws, regulations, and organizational policies.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
IN NO EVENT SHALL THE AUTHOR OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
By using this repository, you acknowledge that you are solely responsible for ensuring that your activities are authorized and comply with all applicable laws, regulations, and organizational policies.