icex0/wp2shell-poc

wp2shell-poc is a proof of concept tool for a security flaw in WordPress, tracked as two CVEs, that was originally reported by Searchlight Cyber. This project is an independent recreation of the exploit, not the official checker from the company that found it. It targets WordPress versions between 6.9.0 and 7.0.1, and the tool documents exactly how the bug works alongside the code that exploits it. The underlying issue lives in WordPress's REST batch endpoint, a feature that lets several API requests be bundled and sent together without logging in first. Internally, the batch handler keeps two lists in step with each other, one tracking which code should handle each sub request and one tracking whether that sub request passed validation. A malformed sub request throws those two lists out of sync, so one request ends up being processed by a different handler than the one it was validated against. By carefully choosing which requests to bundle, an attacker can use this mismatch to slip a request past checks it should have failed, reaching a database query building path that does not properly escape one of its parameters. That opens the door to a SQL injection an attacker can trigger without any account on the site. From there the tool chains several more steps entirely without authentication: it uses the injection to plant fake blog post rows, tricks WordPress into generating real cached preview posts from them, reads the resulting post IDs back out through the same injection, and reshapes those IDs inside one more batch request until WordPress creates a brand new administrator account. Only the very last step, running a command on the server through the admin account's plugin upload feature, requires being logged in, and it uses the account the attack just created. The tool itself is a single Python script with no dependencies beyond the standard library, offering three modes: a safe check that looks for signs of the bug without touching the database, a read mode that pulls data like usernames and password hashes out through the injection, and a shell mode that runs commands on the target, either using given credentials or by first running the full unauthenticated chain. Any webshell or account the shell command creates is cleaned up automatically once the session ends.