Non-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1
-
Updated
Jul 22, 2026 - Python
#
cve-2026-60137
Here are 20 public repositories matching this topic...
Pre-auth RCE PoC for CVE-2026-63030 / CVE-2026-60137 (WordPress core)
-
Updated
Jul 18, 2026 - Python
WP2Shell - CVE-2026-63030 / CVE-2026-60137 This tool exploits a critical SQL injection vulnerability in the WordPress REST API `/wp-json/batch/v1` endpoint, allowing unauthenticated attackers to execute arbitrary SQL queries and achieve Remote Code Execution (RCE) on vulnerable WordPress installations.
-
Updated
Jul 18, 2026 - Python
wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on WP 6.9.0–6.9.4 / 7.0.0–7.0.1.
wordpress wordfence wordpress-core codeb0ss realcodeb0ss thecodeb0ss wp2shell cve-2026-63030 cve-2026-60137
-
Updated
Jul 18, 2026 - Python
PoC for the WordPress 6.9/7.0 REST batch-route confusion and author__not_in SQL injection chain.
docker wordpress wp-cli proof-of-concept sql-injection wordpress-security security-research vulnerability-research cve-2026-63030 cve-2026-60137
-
Updated
Jul 18, 2026 - Python
Blackbox, non-intrusive detector for wp2shell (WordPress core pre-auth RCE, CVE-2026-63030 / CVE-2026-60137). Detection only.
-
Updated
Jul 19, 2026 - Python
Abdal CVE-2026-60137 is an advanced WordPress security scanner for identifying systems potentially affected by the CVE-2026-60137 SQL Injection vulnerability. Developed by Ebrahim Shafiei (EbraSha) for vulnerability assessment, security research, and authorized penetration testing.
wordpress security penetration-testing sqli bug-bounty sql-injection wordpress-security wordpress-scanner offensive-security security-scanner ethical-hacking red-team security-tools vulnerability-scanner blue-team abdal exposure-detection cve-2026-60137 wordpress-sqli wordpress-security-tools
-
Updated
Jul 24, 2026 - Go
WordPress Core Unauthenticated RCE (CVE-2026-63030, CVE-2026-60137)
-
Updated
Jul 20, 2026 - Python
Critical Wordpress to Shell (unauthenticated)
-
Updated
Jul 20, 2026 - Python
WordPress wp2shell vulnerability-chain scanner for CVE-2026-63030 and CVE-2026-60137, with active detection, optional PoC, JSON export.
penetration-testing security-scanner vulnerability-scanner wordpress-security-scanner wp2shell cve-2026-63030 cve-2026-60137
-
Updated
Jul 20, 2026 - Python
Automated exploit chain for CVE-2026-63030 / CVE-2026-60137 — unauthenticated blind SQLi via WordPress REST batch route-confusion. Dumps user hashes, cracks credentials, deploys webshell. Supports single target and bulk site lists. For authorized security testing only.
-
Updated
Jul 18, 2026 - Python
CVE-2026-63030 & CVE-2026-60137 Wp2shell Poc
python wordpress wordpress-api python-script python3 poc rce rce-exploit wp2shell wp2shell-poc cve-2026-63030 cve-2026-60137
-
Updated
Jul 22, 2026 - Python
Read-only CLI to check whether a WordPress site is exposed to WP2Shell (CVE-2026-63030 / CVE-2026-60137)
python cli wordpress security rce infosec security-tools vulnerability-scanner wp2shell cve-2026-63030 cve-2026-60137
-
Updated
Aug 30, 2026 - Python
WordPress Core Pre-Auth RCE via REST Batch Route Confusion + SQLi (CVE-2026-63030 + CVE-2026-60137)
python wordpress security exploit rce sql-injection vulnerability cve batch-api pre-auth wp2shell cve-2026-63030 cve-2026-60137
-
Updated
Jul 24, 2026 - Python
CVE-2026-63030 + CVE-2026-60137 WordPress Core pre-auth RCE mass exploit
-
Updated
Oct 12, 2026 - Python
Non-destructive proof-of-concept and verification harness for CVE-2026-60137, a blind SQL injection in WordPress core (`WP_Query::author__not_in`), reachable via the REST API's `author_exclude` parameter.
wordpress sql exploit rest-api db sql-injection wordpress-security cve appsec blind-sqli cve-2026-60137
-
Updated
Aug 5, 2026 - Python
PoC detector & safe validator for the WP2Shell WordPress vulnerability chain: CVE-2026-63030 (REST batch-route confusion) + CVE-2026-60137 (author__not_in SQL injection). For authorized security testing only.
python wordpress proof-of-concept penetration-testing poc sql-injection infosec wordpress-security cve security-tools vulnerability-scanner security-research rest-api-security wp2shell cve-2026-63030 cve-2026-60137
-
Updated
Jul 21, 2026 - Python
CVE-2026-60137Temporary Emergency Mitigation for CVE-2026-60137 & CVE-2026-63030 (wp2shell)
-
Updated
Jul 21, 2026 - PHP
CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept
-
Updated
Oct 3, 2026 - Python
Port WordPress sites to any stack by measuring, not guessing.
wordpress-plugin parameters wpf blade desktop astro business-intelligence wp wordpress-security elementor visual-regression wordpress-login wordpress-optimization wordpress-exploit claude-code claude-code-plugin cve-2026-63030 cve-2026-60137
-
Updated
Oct 12, 2026 - JavaScript
Add this topic to your repo
To associate your repository with the cve-2026-60137 topic, visit your repo's landing page and select "manage topics."