47cid/wp2shell-lab

This repository is an educational proof of concept and practice lab for two related WordPress security vulnerabilities, tracked as CVE-2026-63030 and CVE-2026-60137. Both were discovered by an outside security researcher and have already been fixed in WordPress versions 6.9.5 and 7.0.2, so the project exists to help people study a real, disclosed bug rather than to attack live sites. The underlying issue lives in WordPress's REST API batch endpoint, which lets a single HTTP request bundle several API calls together. A bug in how that endpoint keeps track of which sub request goes to which handler causes the requests to get mismatched, so one sub request can end up processed by the wrong part of WordPress entirely. By nesting these batched requests and exploiting that mismatch twice, an attacker can get a request meant for one part of the API handled by a different part that does not expect it, in a way that lets attacker controlled text flow into a database query without being properly cleaned first. That is a SQL injection: a bug where the database ends up running commands hidden inside what should have been ordinary data. The lab spins up a deliberately vulnerable WordPress site inside Docker so the technique can be studied safely and locally. A companion Python tool lets you detect whether a target is vulnerable, extract data from its database, and, if the database user has the right privileges, even write files to the server as a way of demonstrating how far the bug could be pushed in the worst case. The repository's writeup walks through the bug step by step, from how the two internal tracking lists in WordPress's code drift out of sync, to how that drift is chained twice to reach the vulnerable code path, to the exact line where a check for an array type is bypassed by passing a string instead. The project also documents a faster way to pull data out through the vulnerable endpoint than the usual slow, one bit at a time approach, by reading information back through a response header WordPress normally uses to report result counts. This is aimed at security researchers and WordPress maintainers who want to understand exactly how the vulnerability works, not at anyone looking to attack a site they do not own or have permission to test.