{"uuid": "1138c686-89a0-400d-892c-24907fedf371", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63030", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wordpress_wp2shell_sqli.rb", "content": "{\"actions\": [{\"description\": \"Dump username and password hash for COUNT users via blind SQLi\", \"name\": \"List Users\"}], \"aliases\": [], \"arch\": \"\", \"author\": [\"dividesbyzer0\", \"Searchlight Cyber\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"WordPress core 6.9.0 - 6.9.4 and 7.0.0 - 7.0.1 are affected by an unauthenticated\\n          SQL injection reachable through the REST API batch endpoint (/batch/v1).\\n\\n          The batch controller builds parallel $matches (the matched handler per sub-request)\\n          and $validation (the validation result per sub-request) arrays, then indexes both by\\n          the same offset when dispatching. A sub-request whose path fails wp_parse_url() is\\n          appended to $validation but not to $matches, desynchronising the two arrays so a\\n          sub-request is dispatched under a different sub-request's handler (CVE-2026-63030).\\n\\n          Nesting the primitive twice lets a GET on the single-post item route\\n          /wp/v2/posts/999999, carrying the collection-only parameter author_exclude, be\\n          dispatched under the posts collection get_items() handler, where author_exclude maps\\n          to the WP_Query author__not_in query var. The vulnerable builds interpolate that value\\n          into SQL as a string (CVE-2026-60137), producing a pre-authentication boolean- and\\n          time-based blind SQL injection in the post_author NOT IN (...) clause.\\n\\n          This module confirms the route-confusion primitive with a benign marker probe, then\\n          uses a time-based blind injection to dump WordPress user logins and password hashes.\\n          It is read-only and does not create posts, users, or other content.\", \"disclosure_date\": \"2026-07-17\", \"fullname\": \"auxiliary/scanner/http/wordpress_wp2shell_sqli\", \"is_install_path\": true, \"mod_time\": \"2026-08-16 12:54:09 +0000\", \"name\": \"WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion\", \"needs_cleanup\": false, \"notes\": {\"RelatedModules\": [\"exploit/multi/http/wp_batch_desync_rce\"], \"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/scanner/http/wordpress_wp2shell_sqli.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/wordpress_wp2shell_sqli\", \"references\": [\"CVE-2026-63030\", \"CVE-2026-60137\", \"URL-https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core/\", \"URL-https://blog.zsec.uk/wp2shell-code-trace-deep-dive/\", \"URL-https://github.com/Icex0/wp2shell-poc\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:56.100809Z"}