It demonstrates a novel chain of vulnerabilities enabling unauthenticated RCE on WordPress, affecting recent versions, and provides a working exploit with command execution, not just credential theft.
The first ever poc of the pre-auth timing-based SQL injection PoC for the WordPress REST API batch-route confusion chain (CVE-2026-63030 + CVE-2026-60137)
Achieved command execution, without just trying to crack the admins password.
Affected: WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Fixed in 6.9.5 and 7.0.2.
python3 poc.py https://target.example
python3 poc.py https://target.example 'SELECT DATABASE()'
python3 poc.py https://target.example -c "echo "you got pwned" > /tmp/pwned.txt && id"
Research: Searchlight Cyber · Aikido · Aikido Intel · WordPress
Disclaimer: This proof of concept is provided solely for authorized educational, security research, and incident response purposes; meaning, use it only on systems you own or have explicit permission to test.
Stock vulnerable wordpress RCE poc for wp2shell.
Similar projects matched by category, topics, and programming language.
Harness Engineering is a methodology for improving coding agent outputs by carefully crafting the environment around them—providing curated context, tools, and executable constraints that encode an organization’s nonfunctional requirements and cumulative lessons.
A 28.9 million parameter language model runs on an $8 ESP32-S3 microcontroller entirely on-device, generating simple stories at about 9.5 tokens per second.
mimic captures traffic from any iOS or web app and automatically generates a Python client library that lets you call the app's API like a regular library.