What is wp2shell?

wp2shell is a security research tool that demonstrates a serious, publicly disclosed vulnerability chain in core WordPress software, tracked as CVE-2026-63030 and CVE-2026-60137. Combined, these two bugs let an attacker with no login credentials at all take full control of a default WordPress site by creating a new administrator account and running their own code on the server. The first bug is a mix-up in how WordPress's REST API processes batches of requests sent together, where an error in one request accidentally causes a later request to be handled with the wrong instructions. The second bug is a SQL injection flaw in how WordPress filters posts by author, caused by a missing safety check on one specific input. Neither bug alone is enough to fully compromise a site on the newest WordPress versions, but chaining them together removes that protection, allowing database access and, from there, a path to running commands on the server. The repository provides a single Python file that combines ideas from six earlier, separately published proof of concept tools into one clean version with no extra software dependencies. It includes a safe, non destructive way to check whether a WordPress site is vulnerable, options for routing traffic through a proxy or adding delays between requests to avoid disruption, and Docker based lab setups so researchers can safely reproduce the issue against specific WordPress and database version combinations rather than testing on a live site. The author explains the underlying bugs in detail, including which WordPress versions are affected and which have already been patched. This project is intended for security researchers and WordPress site administrators who need to confirm whether their own sites are exposed and should be updated immediately, not for use against systems they do not own or have permission to test.