Check whether your own WordPress install is running a version vulnerable to CVE-2026-60137 or CVE-2026-63030.
Spin up a local vulnerable and patched WordPress environment to study the bug safely.
Learn how a read-only SQL injection was chained into full remote code execution on stock WordPress.
| dinosn/wp2shell-lab | akmessi/vex | fredantb/spec-driven-development | |
|---|---|---|---|
| Stars | 36 | 36 | 36 |
| Language | Python | Python | Python |
| Setup difficulty | moderate | moderate | easy |
| Complexity | 4/5 | 3/5 | 2/5 |
| Audience | researcher | vibe coder | developer |
Figures from each repo's GitHub metadata at analysis time.
Requires Docker with Compose v2 and Python 3.8+, make commands drive the lab and checks.
wp2shell-lab is a security research project built around two real vulnerabilities in WordPress core, tracked as CVE-2026-60137 and CVE-2026-63030. The first is a SQL injection bug that lets an unauthenticated attacker read the entire site database, including admin password hashes, without needing any plugin or misconfiguration. The second is a route confusion bug in WordPress's REST batch API that, when chained with the first, can lead to full remote code execution on a completely default, unpatched install. The affected versions are WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, and the issues are already fixed in 6.8.6, 6.9.5, and 7.0.2. The README is explicit that the purpose of this repository is defensive: to help site owners verify whether their own WordPress installation is patched, and to help researchers understand how the underlying bug works, not to provide a tool for attacking other people's sites. It credits the researchers who originally found and reported each part of the vulnerability chain. The project provides three things. A non-destructive detector checks whether a target WordPress site is running a vulnerable version without altering any data. A Docker Compose lab spins up a deliberately vulnerable WordPress and MySQL environment locally, along with a matching patched version, so the difference in behavior can be compared side by side. And a proof-of-concept script demonstrates the full chain against the local lab environment only, showing step by step how the database read bug can be escalated into administrator account creation and code execution. To use it, you need Docker with Docker Compose v2, Python 3.8 or newer using only its standard library, plus make and curl. Simple make commands bring the vulnerable environment up, run the safe detector check, gather read-only proof of the SQL injection, run the full exploit chain against the local lab, and rebuild against the patched WordPress version to confirm the check reports no vulnerability. The README does not state a license for the project.
A non-destructive detector and Docker lab for verifying whether a WordPress site is vulnerable to a real pre-auth SQL injection and remote code execution chain, for defensive patch verification.
Mainly Python. The stack also includes Python, Docker, Docker Compose.
No license file is included, so terms of use are unclear.
Setup difficulty is rated moderate, with roughly 30min to a first successful run.
Mainly researcher.
This repo across BitVibe Labs
Don't trust strangers blindly. Verify against the repo.