{"uuid": "a9cfabe7-3226-42f1-b4e0-43b56c1db225", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_batch_desync_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"Adam Kues\", \"TF1T\", \"dtro\", \"haongo\", \"Crypto-Cat\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module chains two WordPress core vulnerabilities, together known as\\n          WP2Shell, to gain unauthenticated remote code execution against default\\n          installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1.\\n          The vulnerabilities are fixed in WordPress 6.9.5 and 7.0.2.\\n\\n          CVE-2026-60137 is an SQL injection in WP_Query's author__not_in parameter, and\\n          CVE-2026-63030 is a REST API batch endpoint route-confusion bug that lets an\\n          unauthenticated request reach that injection.\\n\\n          The module uses the injection to read the database table prefix and the\\n          administrator user ID, poisons WordPress' object cache to publish a crafted\\n          customizer changeset, and re-enters the REST API with administrator privileges\\n          to create a new administrator account. It then logs in as that account, uploads\\n          a plugin containing a Metasploit payload, and executes it for a session. Once a\\n          session is obtained the uploaded plugin is removed, and the created administrator\\n          account is removed as well unless KeepAdmin is set.\", \"disclosure_date\": \"2026-07-17\", \"fullname\": \"exploit/multi/http/wp_batch_desync_rce\", \"is_install_path\": true, \"mod_time\": \"2026-08-06 12:35:36 +0000\", \"name\": \"WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/wp_batch_desync_rce.rb\", \"platform\": \"Linux,PHP,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/wp_batch_desync_rce\", \"references\": [\"CVE-2026-63030\", \"CVE-2026-60137\", \"URL-https://wordpress.org/news/2026/07/wordpress-7-0-2-release/\", \"URL-https://slcyber.io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6/\", \"URL-https://github.com/Crypto-Cat/wp2shell\", \"URL-https://wp2shell.com/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP In-Memory\", \"Unix/Linux Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-08-10T10:02:08.868132Z"}