gichirimaku/wp2shell-PoC
Can I trust it?
Be careful with this one.
Warnings Check
Very new: it was created 5 days ago. Wait a little before installing it.
Stars from real accounts No data
We haven't checked its stars for fakes yet.
Active OK
Last change today.
Licence Careful
No licence: legally you can't reuse the code, unless the README says otherwise.
Quick checks from public data. They help, but they are no guarantee.
What it is
Python proof-of-concept that chains CVE-2026-63030 and CVE-2026-60137 in WordPress core: a pre-authentication route confusion in the REST batch endpoint combined with a WP_Query SQL injection. Includes check, data read and shell modes against affected WordPress versions.
Who it's for
Security researchers and authorized testers assessing WordPress 6.9.x and 7.0.x sites
How to use it
Ask your AI to set it up
Paste this into Claude, ChatGPT or your coding assistant.
Help me install and set up gichirimaku/wp2shell-PoC in my project. Follow its README: https://github.com/gichirimaku/wp2shell-PoC. Explain each step and check it is safe before running anything.
Star curve
On the radar
Its place among the radar's top 100, day by day, with #1 at the top. Gaps are days it was out of the top 100.
Records
- Best place on RepoAlerts: #72, on 18 Oct 2026
- In the top 100 for 2 days since 18 Oct 2026
Get alerts for repos like this
We'll email you when something in Web & UI starts rising. Free, once a week, only what matches.
18,263 GitHub repos watched and ranked every hour. Figures as of 20 October 2026.
What arrives: one email on Mondays with the repos that match, never more. See last week's. Privacy
For maintainers
Add this badge to your README. It shows the repo's place on the radar, updates every hour and links back to this page.
[](https://repoalerts.com/repo/gichirimaku/wp2shell-PoC?ref=badge)Similar repos
- sakidekin/CVE-2026-41940-PoC
Python proof-of-concept exploit for CVE-2026-41940, a critical authentication bypass in cPanel & WHM. Scans targets for the flaw and offers post-exploitation commands for listing accounts, running OS
- opentrap/opentrap
An open-source, Linux-only web application security testing suite offering an intercepting proxy, Repeater, Intruder, a Collaborator for out-of-band interactions and a scanner built on the OWASP ZAP e
- qkaiser/broadcom-wps
A Python toolkit for detecting Broadcom 802.11 SDK implementations in WiFi access points. It offers YARA rules for statically scanning extracted router firmware and a script that fingerprints live acc
- ZeroDayEvil/ai-security-tool
Desktop and web terminal client with SSH, SFTP, RDP, VNC, serial and other protocols, CVE and SBOM supply chain scanning, and a set of AI agents that automate security workflows. The README also lists
- vibheksoni/stealth-browser-mcp
Python MCP server that lets AI agents control a stealth Chrome-family browser via the Chrome DevTools Protocol. It covers navigation, network inspection and hooks, DOM and element extraction, and CDP-
- SplendorCooper/ExitLag
Distributes a pre-activated Windows installer for a program called Exitlag, described as an optimized desktop utility. The README gives a PowerShell command that downloads and runs a remote script and