PressVector — WordPress CVE-2026-63030 / CVE-2026-60137 Framework

Pre-Auth RCE & Blind SQLi Exploitation Framework for WordPress Core

🧨

PressVector

CVE-2026-63030 · Pre-Auth RCE · WordPress Core · CVSS 9.8 Critical

A full-featured, automated exploitation framework targeting CVE-2026-63030 and CVE-2026-60137 — critical vulnerabilities in WordPress Core (versions 6.8.0 to 7.0.1) that chain REST Batch Route Confusion with blind SQL injection to achieve unauthenticated remote code execution.

GitHub Repository
CVSS 9.8 Critical Zero Dependencies Docker Lab Included

Overview

PressVector automates the multi-stage attack chain known as wp2shell. By combining a route confusion flaw in the /batch/v1 REST endpoint with a time-based blind SQL injection in author__not_in, the framework extracts database table prefixes, forges administrator sessions via UNION-based injection, and deploys webshells without requiring any valid credentials.

Affected WordPress Versions

Version Range Applicable CVEs Impact Vulnerability Status
6.8.0 – 6.8.5 CVE-2026-60137 Blind SQLi ❌ Vulnerable
6.9.0 – 6.9.4 CVE-2026-63030 + CVE-2026-60137 Pre-Auth RCE 🔴 Vulnerable (Critical)
7.0.0 – 7.0.1 CVE-2026-63030 + CVE-2026-60137 Pre-Auth RCE 🔴 Vulnerable (Critical)
6.8.6+ / 6.9.5+ / 7.0.2+ None Patched ✅ Safe

Exploitation Chain Architecture

[Unauthenticated Attacker]
        │
        ▼
[1] REST Batch Route Confusion (/batch/v1)
        │  Bypasses authentication context
        ▼
[2] Blind SQLi via author__not_in
        │  Time-based binary search extraction
        ▼
[3] Extract Table Prefix & Admin User ID
        │
        ▼
[4] Forge Admin Session via UNION Injection
        │  Injects administrator privileges into wp_usermeta
        ▼
[5] Authenticate & Deploy Media Webshell
        │
        ▼
[6] Remote Code Execution (RCE) 🎯

Framework Features & Operating Modes

PressVector includes 4 operation modes built directly into pressvector.py using Python standard library:

  1. 🔎 scan: Multi-threaded vulnerability scanner for large-scale target list verification.
  2. ✅ check: Timing calibration module confirming blind SQLi presence on single targets.
  3. 💥 exploit: Full RCE chain execution with interactive shell and automatic artifact cleanup.
  4. 🔺 privesc: Post-exploitation privilege escalation module to achieve root privileges.

Nuclei Detection Template

Includes a production-grade Nuclei template (pressvector-wp2shell-detection.yaml) for passive vulnerability scanning across enterprise networks:

nuclei -t pressvector-wp2shell-detection.yaml -l targets.txt -o results.txt

Containerized Research Lab

PressVector includes a multi-instance Docker environment (pressvector-lab) running 4 vulnerable WordPress versions (6.8.5, 6.9.4, 7.0.1) alongside PHPMyAdmin and a web management dashboard on port 8085.

# Clone and run
git clone https://github.com/vulnquest58/PressVector.git
cd PressVector
python pressvector.py check http://target:8081