wp2shell-poc

This repository is a proof of concept for a security vulnerability that was found in WordPress. It demonstrates a way an attacker could run commands on a vulnerable WordPress server without first needing to log in or guess an admin password. The vulnerability combines two separate flaws in how WordPress's REST API handles batch requests, tracked publicly as CVE-2026-63030 and CVE-2026-60137.

The code is a single Python script that a security researcher points at a target website's address. Running it with no extra arguments demonstrates the exploit, while optional arguments let the user run a specific database query or a specific system command against the target, purely to prove the vulnerability is present. The affected WordPress versions are 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, and the issue is already fixed in the 6.9.5 and 7.0.2 releases, so keeping WordPress updated closes this hole.

The README links out to writeups from two security research firms plus WordPress's own release announcement, which cover how the vulnerability was discovered and how it works in more depth. The author includes a clear disclaimer that this code is meant only for authorized security research, educational study, and incident response, and should only be run against systems the user owns or has explicit written permission to test.

For a non-technical reader, the practical takeaway is straightforward: this is not a tool for casual use. It exists to help defenders and researchers verify whether a WordPress site is vulnerable and confirm that patches actually fix the problem, and it underscores why keeping WordPress core updated matters.