j4ck3lsyn-gen2/cve-2026-63030-wp2r00t

This repository is a proof of concept tool for security researchers studying a specific WordPress vulnerability, CVE-2026-63030. It demonstrates a SQL injection flaw found in WordPress's REST API batch endpoint, the part of WordPress that lets multiple API requests be bundled and sent together. The author built this independently based on the public vulnerability details, and it targets WordPress versions before 6.9.5 and 7.0.2, which have since been patched. The README explains the underlying bug in detail: when the batch endpoint processes several sub-requests at once, a validation mistake can cause one sub-request to be handled by the wrong code path. By nesting this confusion twice, an attacker can eventually reach a spot where a value gets inserted directly into a database query without being checked, which is the classic definition of a SQL injection flaw. This allows an unauthenticated attacker to extract information from the site's database. The tool is built with safety in mind. It requires an explicit authorized flag before it will contact any real target, and it includes a no operation mode that only shows what it would send without actually sending anything. There is also a hard limit on the number of requests it will make. A separate flag called r00t gates any post authentication capability, meaning the more dangerous features cannot run without it. The author states plainly that a further weaponized persistence tool, used for maintaining long term access after a break in, was deliberately left out of this public repository due to legal concerns. It runs on Python 3.11 or newer with no external dependencies, and is operated entirely through a command line interface with modes for checking, reading data, and a gated post authentication shell. The author is explicit that this is meant strictly for authorized penetration testing and educational research in isolated lab environments, not for use against systems the user does not own or have permission to test.