admin/sergiointel-wp2shell-poc
1
0
Fork 0
mirror of https://github.com/sergiointel/wp2shell-poc synced 2026-07-18 19:05:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enhance README with command execution info and disclaimer

Browse Source 
Added details about command execution capabilities and updated disclaimer.
This commit is contained in:
Sergio
2026-07-18 18:25:04 +03:00
committed by GitHub
parent 98716c82d2
commit 5e912a9305
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+6 -1
View File
@@ -1,12 +1,17 @@
# wp2shell PoC
The first ever poc of the pre-auth timing-based SQL injection PoC for the WordPress REST API batch-route confusion chain ([CVE-2026-63030](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q) + [CVE-2026-60137](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf)); still working on command exec
The first ever poc of the pre-auth timing-based SQL injection PoC for the WordPress REST API batch-route confusion chain ([CVE-2026-63030](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q) + [CVE-2026-60137](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf))
Achieved command execution, without just trying to crack the admins password.
**Affected:** WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Fixed in 6.9.5 and 7.0.2.
```bash
python3 poc.py https://target.example
python3 poc.py https://target.example 'SELECT DATABASE()'
python3 poc.py https://target.example -c "echo "you got pwned" > /tmp/pwned.txt && id"
```
**Research:** [Searchlight Cyber](https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core) · [Aikido](https://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shell) · [Aikido Intel](https://intel.aikido.dev/cve/AIKIDO-2026-696183) · [WordPress](https://wordpress.org/news/2026/07/wordpress-7-0-2-release/)
> **Disclaimer:** This proof of concept is provided solely for authorized educational, security research, and incident response purposes; meaning, use it only on systems you own or have explicit permission to test.