WP2Shell RCE

An assessment and scanning utility designed to detect exposure to the WP2Shell exploit chain in WordPress Core installations across single endpoints or large target lists.

⚠️ Disclaimer
Only scan systems you own or are authorized to assess.
Unsanctioned scanning or testing of third-party systems is illegal. The maintainers assume no responsibility or liability for unauthorized usage or collateral damage caused by this utility.

---

Vulnerability Overview

WP2Shell is a critical, pre-authentication Remote Code Execution (RCE) vulnerability chain affecting default WordPress Core installations without requiring plugin dependencies or authentication.

Attribute	Value
Impact	Pre-Authentication Remote Code Execution (RCE)
CVE Identifiers	CVE-2026-63030 (REST API Route Confusion) - July 17, 2026 CVE-2026-60137 (WP_Query SQL Injection) - July 17, 2026
Affected Versions	WordPress Core 6.9.0 – 6.9.4 and 7.0.0 – 7.0.1
Patched Versions	WordPress Core 6.9.5 and 7.0.2

---

Prerequisites

• Runtime: Node.js version 18.0.0 or higher.
• Package Manager: npm (included with Node.js).

---

DEMO

The following demonstration shows the proof-of-concept running against a controlled local WordPress environment. It illustrates the complete testing flow and resulting behavior in an isolated, authorized lab setup.

---

Installation

Clone the repository and install dependencies:

git clone https://github.com/johnlodan/wp2shell-rce.git
cd wp2shell-rce
npm install

Commands

Single target:

npm run scan -- -t https://google.com

Multiple comma-separated targets:

npm run scan -- -t https://google.com,https://github.com,https://example.com

Multiple targets from a file:

npm run scan -- -f targets.txt

References & Disclosures

• Proof of Concept Repository:
  Icex0/wp2shell-poc (GitHub) – Proof-of-concept exploit implementation for the WordPress unauthenticated REST batch route collision SQLi to RCE vulnerability.

• Proof of Concept Video Demonstration:
  NightR4id – WP2Shell | CVE-2026-63030 + CVE-2026-60137 Demo (YouTube) – Video demonstration showing the execution flow of the SQLi-to-RCE chain against a vulnerable WordPress instance.

• Technical Analysis & Threat Research:

  • Akamai Security Research: Mitigating a Critical Unauthenticated RCE Chain in WordPress – Technical deep-dive into the REST API route confusion logic, customizer changesets, and mitigation strategies.
  • CrowdSec Vulnerability Report: WordPress “WP2Shell” SQLi-to-RCE (CVE-2026-63030) Under Rapid Escalation – Real-world exploitation activity monitoring and vulnerability tracking report.
  • Picus Security: CVE-2026-63030 and CVE-2026-60137 (WP2Shell) WordPress RCE Explained – Detailed breakdown of the attack chain and detection guidance.

Credits & Authors

• Credits: Icex0/wp2shell-poc
• Authors: @THEJOLOTOPROJECT