[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":52,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":59,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":65,"vulnerability-29452":72},[4,17,27,34,41,47],{"title":5,"slug":5,"text":6,"link":7,"external":8,"targets":9,"cta":15,"variant":16,"campaign_id":5},"wp2shell","Validate wp2shell: one-click detection & exploitation confirms exposed or patched WP targets.","https://pentest-tools.com/pricing",false,[10,11,12,13,14],"/","/network-vulnerability-scanning/network-security-scanner-online","/cms-vulnerability-scanning/wordpress-scanner-online-wpscan","/website-vulnerability-scanning/website-scanner","/product","Confirm the risk","secondary",{"title":18,"slug":19,"text":20,"link":21,"external":22,"targets":23,"cta":25,"variant":26,"campaign_id":5},"wp2shell (pricing)","wp2shell-p","Validate *wp2shell* exposure & mitigation! Detect with any plan. Exploit with Pentest Suite.","https://pentest-tools.com/vulnerabilities-exploits/wordpress-core-69-701-pre-auth-blind-sql-injection-batch-route-confusion_29451",true,[24],"/pricing","See CVE details","primary",{"title":28,"slug":29,"text":30,"link":7,"external":8,"targets":31,"cta":33,"variant":16,"campaign_id":5},"wp2shell (Sniper)","wp2shell-sniper","Validate wp2shell: one-click detection & exploitation confirms exposed or patched WP targets",[32],"exploit-helpers/sniper","Get it with Pentest Suite",{"title":35,"slug":36,"text":37,"link":7,"external":8,"targets":38,"cta":40,"variant":16,"campaign_id":5},"wp2shell (CVE page - detection)","wp2shell-cve-page","Validate wp2shell exposure & mitigation! Detect with any plan. Exploit with Pentest Suite.",[39],"/vulnerabilities-exploits/wordpress-core-69-701-pre-auth-blind-sql-injection-batch-route-confusion_29451","Explore plans",{"title":42,"slug":43,"text":44,"link":21,"external":8,"targets":45,"cta":25,"variant":16,"campaign_id":5},"wp2shell (Vuln DB homepage)","wp2shell-vuln-db","Emergency CVE response: detection & exploitation now available for *wp2shell*, the critical WP RCE chain",[46],"/vulnerabilities-exploits/",{"title":48,"slug":49,"text":37,"link":7,"external":8,"targets":50,"cta":40,"variant":16,"campaign_id":5},"wp2shell (CVE page - exploitation)","wp2shell-cve-page-exploit",[51],"/vulnerabilities-exploits/wp2shell-wordpress-core-690-694-and-700-701-pre-auth-batch-route-confusion-leading-to-sql-injection_29452",["Island",53],{"key":54,"params":55,"result":57},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":56},"{}",{"head":58},{},["Island",60],{"key":61,"params":62,"result":63},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":56},{"head":64},{},["Island",66],{"key":67,"params":68,"result":70},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":69},"{\"text-color\":\"gray\"}",{"head":71},{},{"id":73,"detectable_with":74,"vuln_details":80,"vuln_id":101,"name":102,"published":103,"updated":103},29452,{"tool":75,"engine":78},{"id":76,"name":77},1,"Network Scanner",{"id":76,"name":79},"Sniper",{"id":73,"codename":5,"description":81,"severity":82,"risk_description":83,"public_description":84,"public_recommendation":85,"recommendation":86,"references":87,"cvssv3":90,"epss_score":91,"epss_percentile":92,"cve":93,"in_cisa_catalog":8,"date":95,"software_type":96,"vendor":97,"product":97,"ptt_exploit_capabilities":98},"We found that the target WordPress site is vulnerable to an unauthenticated SQL injection. The flaw chains a REST API batch-route confusion (CVE-2026-63030) with a UNION-based injection in the author_exclude parameter of the core /wp/v2/posts endpoint (CVE-2026-60137). The /?rest_route=/batch/v1 endpoint lets an unauthenticated request smuggle a nested call to the posts endpoint that reaches the injectable query. A remote attacker can read arbitrary data from the WordPress database without any credentials. We confirmed the impact by reading basic server metadata and dumping the WordPress users table, including the login, email and password hash of every account. When the database account holds the FILE privilege and a web-served directory is writable, the injection can also be escalated to remote code execution by writing a PHP webshell with INTO OUTFILE.","critical","The risk exists that a remote unauthenticated attacker reads the entire WordPress database, including user password hashes and secret keys, and uses them to take over the site or pivot to the internal network.","WordPress is vulnerable to an unauthenticated SQL injection. The flaw chains a REST API batch-route confusion (CVE-2026-63030) with a UNION-based injection in the author_exclude parameter of the core /wp/v2/posts endpoint (CVE-2026-60137). The batch endpoint lets an unauthenticated request smuggle a nested call to the posts endpoint that reaches the injectable query, so a remote attacker can read arbitrary data from the database without credentials.","Update WordPress core to the latest version.","We recommend updating WordPress core to a version that patches CVE-2026-60137 and CVE-2026-63030.",[88,89],"https://nvd.nist.gov/vuln/detail/CVE-2026-63030","https://nvd.nist.gov/vuln/detail/CVE-2026-60137",9.8,0.08946,0.94675,[94],"CVE-2026-63030","2026-07-10T00:00:00Z","CMS","WordPress",[99,100],"RCE","CUSTOM","NETSCAN-SNIPER-CVE-2026-63030","wp2shell - WordPress Core 6.9.0-6.9.4 and 7.0.0-7.0.1 - Pre-Auth Batch-Route Confusion leading to SQL Injection","2026-07-18T00:00:00Z"]