[POC] CVE-2026-63030 — wp2shellJul 19, 2026
pocexploitCVE-2026-63030
Automated exploit chain for CVE-2026-63030 / CVE-2026-60137 — unauthenticated blind SQLi via WordPress REST batch route-confusion. Dumps user hashes, cracks credentials, deploys webshell. Supports single target and bulk site lists. For authorized security testing only.
wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on WP 6.9.0–6.9.4 / 7.0.0–7.0.1.
A critical unauthenticated "remote code execution" vulnerability affecting WordPress Core
A fully red-team(offensive security) weaponized variant of wp2shell, built for authorized penetration testing & educational purposes.
Advisory for CVE-2026-51385. Needed to publish it as GRAPHIFY hasnt recognized the advisory neither publish it, and MITRE assigned CVE-2026-51385, this is the advisory for it.
CVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated RCE in WordPress core
CVE-2026-43499 reproduce in Xiaomi 17T. (kernelsu incomplete)
PoC Exploit of WordPress Core Unauthenticated RCE known as WP2Shell
CVE-2026-63030 (wp2shell) POC.
Non-intrusive checker for CVE-2026-63030 / CVE-2026-60137 ("wp2shell"), a pre-authentication RCE chain in WordPress core.
PoC for CVE-2023-44487 ( HTTP/2 Rapid Reset Attack ) Concept
CVE-2026-43499 (IonStack/GhostLock) pure-C re-root POC for Samsung SM-T878U / gts7l (T878USQS8DXE1)
A kernel exploit for Pico 4 devices based on cve-2023-33107
WP2Shell - CVE-2026-63030 / CVE-2026-60137 This tool exploits a critical SQL injection vulnerability in the WordPress REST API `/wp-json/batch/v1` endpoint, allowing unauthenticated attackers to execute arbitrary SQL queries and achieve Remote Code Execution (RCE) on vulnerable WordPress installations.
CVE-2026-63030 (RCE) + CVE-2026-60137 (SQLi)
（CVE-2026-43499）内核漏洞利用程序，适用于未解锁 Bootloader 的一加设备。
wp2shell - WordPress CVE-2026-63030 Exploit & Scanner
Technical analysis of the cPanel/WHM auth bypass