nomi-sec/PoC-in-GitHub
1
0 Fork 0
mirror of https://github.com/nomi-sec/PoC-in-GitHub.git synced 2026-11-07 08:30:25 -10:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
PoC-in-GitHub/2026/CVE-2026-63030.json
T

2660 lines
94 KiB
JSON
Raw Permalink Blame History

[
{
"id": 1304360266,
"name": "wp2shell-poc",
"full_name": "Icex0\/wp2shell-poc",
"owner": {
"login": "Icex0",
"id": 99045665,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/99045665?v=4",
"html_url": "https:\/\/github.com\/Icex0",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Icex0\/wp2shell-poc",
"description": "wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain",
"fork": false,
"created_at": "2026-07-17T20:18:33Z",
"updated_at": "2026-11-04T11:36:19Z",
"pushed_at": "2026-08-11T13:41:27Z",
"stargazers_count": 812,
"watchers_count": 812,
"has_discussions": false,
"forks_count": 190,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cve-2026-63030",
"wp2shell",
"wp2shell-poc"
],
"visibility": "public",
"forks": 190,
"watchers": 812,
"score": 0,
"subscribers_count": 3
},
{
"id": 1304452819,
"name": "wp2shell-poc2",
"full_name": "attackercan\/wp2shell-poc2",
"owner": {
"login": "attackercan",
"id": 17142772,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/17142772?v=4",
"html_url": "https:\/\/github.com\/attackercan",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/attackercan\/wp2shell-poc2",
"description": "CVE-2026-63030",
"fork": false,
"created_at": "2026-07-17T23:10:07Z",
"updated_at": "2026-08-25T20:05:25Z",
"pushed_at": "2026-07-17T22:50:06Z",
"stargazers_count": 7,
"watchers_count": 7,
"has_discussions": false,
"forks_count": 4,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 4,
"watchers": 7,
"score": 0,
"subscribers_count": 0
},
{
"id": 1304455460,
"name": "wp2shell-scanner",
"full_name": "ZephrFish\/wp2shell-scanner",
"owner": {
"login": "ZephrFish",
"id": 5783068,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/5783068?v=4",
"html_url": "https:\/\/github.com\/ZephrFish",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/ZephrFish\/wp2shell-scanner",
"description": "CVE-2026-63030, CVE-2026-60137, wp2shell scanner",
"fork": false,
"created_at": "2026-07-17T23:15:57Z",
"updated_at": "2026-11-01T15:29:16Z",
"pushed_at": "2026-07-18T22:07:34Z",
"stargazers_count": 71,
"watchers_count": 71,
"has_discussions": false,
"forks_count": 16,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 16,
"watchers": 71,
"score": 0,
"subscribers_count": 0
},
{
"id": 1304492477,
"name": "wordpress-cve-2026-63030",
"full_name": "Senanfurkan\/wordpress-cve-2026-63030",
"owner": {
"login": "Senanfurkan",
"id": 33626136,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/33626136?v=4",
"html_url": "https:\/\/github.com\/Senanfurkan",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Senanfurkan\/wordpress-cve-2026-63030",
"description": "Pre-auth RCE in WordPress Core via REST API batch route confusion + WP_Query SQLi (CVE-2026-63030 \/ CVE-2026-60137). Detection PoC.",
"fork": false,
"created_at": "2026-07-18T00:44:18Z",
"updated_at": "2026-08-10T13:24:20Z",
"pushed_at": "2026-07-18T00:44:21Z",
"stargazers_count": 5,
"watchers_count": 5,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 5,
"score": 0,
"subscribers_count": 0
},
{
"id": 1304546006,
"name": "wp2shell-cve-2026-63030-root-cause",
"full_name": "tcyph3r\/wp2shell-cve-2026-63030-root-cause",
"owner": {
"login": "tcyph3r",
"id": 124600702,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/124600702?v=4",
"html_url": "https:\/\/github.com\/tcyph3r",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/tcyph3r\/wp2shell-cve-2026-63030-root-cause",
"description": null,
"fork": false,
"created_at": "2026-07-18T02:49:21Z",
"updated_at": "2026-07-19T18:54:43Z",
"pushed_at": "2026-07-19T18:54:40Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1304553327,
"name": "wp2shell-lab",
"full_name": "dinosn\/wp2shell-lab",
"owner": {
"login": "dinosn",
"id": 3851678,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/3851678?v=4",
"html_url": "https:\/\/github.com\/dinosn",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/dinosn\/wp2shell-lab",
"description": "Non-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST \/batch\/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 \/ 7.0.0-7.0.1",
"fork": false,
"created_at": "2026-07-18T03:04:50Z",
"updated_at": "2026-10-21T19:39:16Z",
"pushed_at": "2026-07-22T11:36:51Z",
"stargazers_count": 66,
"watchers_count": 66,
"has_discussions": false,
"forks_count": 22,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cve-2026-60137",
"cve-2026-63030",
"security",
"sql-injection",
"vulnerability-lab",
"wordpress",
"wp2shell"
],
"visibility": "public",
"forks": 22,
"watchers": 66,
"score": 0,
"subscribers_count": 1
},
{
"id": 1304559478,
"name": "wp2shell-lab",
"full_name": "47Cid\/wp2shell-lab",
"owner": {
"login": "47Cid",
"id": 62759468,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/62759468?v=4",
"html_url": "https:\/\/github.com\/47Cid",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/47Cid\/wp2shell-lab",
"description": "Educational PoC + lab for CVE-2026-63030 + CVE-2026-60137: pre-auth SQLi in WordPress core via REST batch-route confusion",
"fork": false,
"created_at": "2026-07-18T03:16:37Z",
"updated_at": "2026-08-29T07:10:17Z",
"pushed_at": "2026-07-18T03:53:29Z",
"stargazers_count": 15,
"watchers_count": 15,
"has_discussions": false,
"forks_count": 2,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 2,
"watchers": 15,
"score": 0,
"subscribers_count": 0
},
{
"id": 1304667289,
"name": "wp2shell",
"full_name": "ekomsSavior\/wp2shell",
"owner": {
"login": "ekomsSavior",
"id": 161806886,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/161806886?v=4",
"html_url": "https:\/\/github.com\/ekomsSavior",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/ekomsSavior\/wp2shell",
"description": "CVE-2026-63030 (RCE) + CVE-2026-60137 (SQLi)",
"fork": false,
"created_at": "2026-07-18T06:40:10Z",
"updated_at": "2026-10-16T16:26:03Z",
"pushed_at": "2026-07-19T00:32:57Z",
"stargazers_count": 10,
"watchers_count": 10,
"has_discussions": false,
"forks_count": 2,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 2,
"watchers": 10,
"score": 0,
"subscribers_count": 0
},
{
"id": 1304698450,
"name": "WP2Shell",
"full_name": "NULL200OK\/WP2Shell",
"owner": {
"login": "NULL200OK",
"id": 130701511,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/130701511?v=4",
"html_url": "https:\/\/github.com\/NULL200OK",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/NULL200OK\/WP2Shell",
"description": "WP2Shell - CVE-2026-63030 \/ CVE-2026-60137 This tool exploits a critical SQL injection vulnerability in the WordPress REST API `\/wp-json\/batch\/v1` endpoint, allowing unauthenticated attackers to execute arbitrary SQL queries and achieve Remote Code Execution (RCE) on vulnerable WordPress installations.",
"fork": false,
"created_at": "2026-07-18T07:30:10Z",
"updated_at": "2026-10-06T00:54:30Z",
"pushed_at": "2026-07-18T07:40:40Z",
"stargazers_count": 17,
"watchers_count": 17,
"has_discussions": false,
"forks_count": 5,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cve-2026-60137",
"cve-2026-63030",
"pentesting-tools",
"rce-exploit",
"wordpress-exploit",
"wordpress-security"
],
"visibility": "public",
"forks": 5,
"watchers": 17,
"score": 0,
"subscribers_count": 1
},
{
"id": 1304795028,
"name": "wp2shell",
"full_name": "kulichr\/wp2shell",
"owner": {
"login": "kulichr",
"id": 40352615,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/40352615?v=4",
"html_url": "https:\/\/github.com\/kulichr",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/kulichr\/wp2shell",
"description": "Non-intrusive checker for CVE-2026-63030 \/ CVE-2026-60137 (\"wp2shell\"), a pre-authentication RCE chain in WordPress core.",
"fork": false,
"created_at": "2026-07-18T10:05:38Z",
"updated_at": "2026-07-18T10:08:13Z",
"pushed_at": "2026-07-18T10:07:21Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"wordpress",
"wordpress-vulnerability",
"wordpress-vulnerability-scanner",
"wp2shell"
],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1304803604,
"name": "CVE-2026-63030",
"full_name": "CybersecSpirit\/CVE-2026-63030",
"owner": {
"login": "CybersecSpirit",
"id": 43298612,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/43298612?v=4",
"html_url": "https:\/\/github.com\/CybersecSpirit",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/CybersecSpirit\/CVE-2026-63030",
"description": null,
"fork": false,
"created_at": "2026-07-18T10:19:10Z",
"updated_at": "2026-07-18T10:22:15Z",
"pushed_at": "2026-07-18T10:21:59Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 1,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 1,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1304878017,
"name": "CVE-2026-63030",
"full_name": "4minx\/CVE-2026-63030",
"owner": {
"login": "4minx",
"id": 37972730,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/37972730?v=4",
"html_url": "https:\/\/github.com\/4minx",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/4minx\/CVE-2026-63030",
"description": "CVE-2026-63030 (wp2shell) POC.",
"fork": false,
"created_at": "2026-07-18T12:11:11Z",
"updated_at": "2026-10-20T02:42:59Z",
"pushed_at": "2026-07-18T13:40:45Z",
"stargazers_count": 11,
"watchers_count": 11,
"has_discussions": false,
"forks_count": 2,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 2,
"watchers": 11,
"score": 0,
"subscribers_count": 1
},
{
"id": 1304954609,
"name": "CVE-2026-63030",
"full_name": "mverschu\/CVE-2026-63030",
"owner": {
"login": "mverschu",
"id": 69352107,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/69352107?v=4",
"html_url": "https:\/\/github.com\/mverschu",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/mverschu\/CVE-2026-63030",
"description": "PoC Exploit of WordPress Core Unauthenticated RCE known as WP2Shell",
"fork": false,
"created_at": "2026-07-18T14:06:48Z",
"updated_at": "2026-09-26T21:39:51Z",
"pushed_at": "2026-07-18T19:40:45Z",
"stargazers_count": 5,
"watchers_count": 5,
"has_discussions": false,
"forks_count": 3,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 3,
"watchers": 5,
"score": 0,
"subscribers_count": 0
},
{
"id": 1304969385,
"name": "wp2shell",
"full_name": "0xsha\/wp2shell",
"owner": {
"login": "0xsha",
"id": 54356171,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/54356171?v=4",
"html_url": "https:\/\/github.com\/0xsha",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/0xsha\/wp2shell",
"description": "CVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated RCE in WordPress core",
"fork": false,
"created_at": "2026-07-18T14:27:41Z",
"updated_at": "2026-11-06T20:25:06Z",
"pushed_at": "2026-07-18T19:05:43Z",
"stargazers_count": 123,
"watchers_count": 123,
"has_discussions": false,
"forks_count": 37,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 37,
"watchers": 123,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305042796,
"name": "CVE-2026-63030-wp2r00t",
"full_name": "J4ck3LSyN-Gen2\/CVE-2026-63030-wp2r00t",
"owner": {
"login": "J4ck3LSyN-Gen2",
"id": 204588854,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/204588854?v=4",
"html_url": "https:\/\/github.com\/J4ck3LSyN-Gen2",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/J4ck3LSyN-Gen2\/CVE-2026-63030-wp2r00t",
"description": "A fully red-team(offensive security) weaponized variant of wp2shell, built for authorized penetration testing & educational purposes.",
"fork": false,
"created_at": "2026-07-18T16:07:41Z",
"updated_at": "2026-11-05T11:30:58Z",
"pushed_at": "2026-07-18T20:35:24Z",
"stargazers_count": 10,
"watchers_count": 10,
"has_discussions": false,
"forks_count": 6,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 6,
"watchers": 10,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305049790,
"name": "CVE-2026-63030",
"full_name": "gbrsh\/CVE-2026-63030",
"owner": {
"login": "gbrsh",
"id": 36970331,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/36970331?v=4",
"html_url": "https:\/\/github.com\/gbrsh",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/gbrsh\/CVE-2026-63030",
"description": "A critical unauthenticated \"remote code execution\" vulnerability affecting WordPress Core",
"fork": false,
"created_at": "2026-07-18T16:17:30Z",
"updated_at": "2026-07-20T06:44:01Z",
"pushed_at": "2026-07-18T16:22:06Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305055237,
"name": "CVE-2026-63030",
"full_name": "0xBlackash\/CVE-2026-63030",
"owner": {
"login": "0xBlackash",
"id": 259905299,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/259905299?v=4",
"html_url": "https:\/\/github.com\/0xBlackash",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/0xBlackash\/CVE-2026-63030",
"description": "CVE-2026-63030",
"fork": false,
"created_at": "2026-07-18T16:24:48Z",
"updated_at": "2026-07-19T21:21:25Z",
"pushed_at": "2026-07-18T17:33:03Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305085253,
"name": "CVE-2026-63030-POC",
"full_name": "mrx-arafat\/CVE-2026-63030-POC",
"owner": {
"login": "mrx-arafat",
"id": 71003115,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/71003115?v=4",
"html_url": "https:\/\/github.com\/mrx-arafat",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/mrx-arafat\/CVE-2026-63030-POC",
"description": null,
"fork": false,
"created_at": "2026-07-18T17:07:39Z",
"updated_at": "2026-07-18T17:21:31Z",
"pushed_at": "2026-07-18T17:21:27Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305094751,
"name": "wp2shell",
"full_name": "0xWhoknows\/wp2shell",
"owner": {
"login": "0xWhoknows",
"id": 57815920,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/57815920?v=4",
"html_url": "https:\/\/github.com\/0xWhoknows",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/0xWhoknows\/wp2shell",
"description": "Automated exploit chain for CVE-2026-63030 \/ CVE-2026-60137 — unauthenticated blind SQLi via WordPress REST batch route-confusion. Dumps user hashes, cracks credentials, deploys webshell. Supports single target and bulk site lists. For authorized security testing only.",
"fork": false,
"created_at": "2026-07-18T17:21:31Z",
"updated_at": "2026-07-18T19:00:18Z",
"pushed_at": "2026-07-18T17:31:44Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 2,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cve-2026-60137",
"cve-2026-63030",
"wp2shell",
"wp2shell-poc",
"wpexploit"
],
"visibility": "public",
"forks": 2,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305118118,
"name": "wp2shell_scanner",
"full_name": "zi3lak\/wp2shell_scanner",
"owner": {
"login": "zi3lak",
"id": 13989182,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/13989182?v=4",
"html_url": "https:\/\/github.com\/zi3lak",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/zi3lak\/wp2shell_scanner",
"description": "Non-intrusive detection scanner for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030 + CVE-2026-60137). Detection-only, no exploitation.",
"fork": false,
"created_at": "2026-07-18T17:56:43Z",
"updated_at": "2026-07-19T06:57:13Z",
"pushed_at": "2026-07-19T06:57:09Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305189269,
"name": "WordPresShell",
"full_name": "securelayer7\/WordPresShell",
"owner": {
"login": "securelayer7",
"id": 14994455,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/14994455?v=4",
"html_url": "https:\/\/github.com\/securelayer7",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/securelayer7\/WordPresShell",
"description": "Pre-auth RCE PoC for CVE-2026-63030 \/ CVE-2026-60137 (WordPress core)",
"fork": false,
"created_at": "2026-07-18T19:55:11Z",
"updated_at": "2026-10-29T15:37:24Z",
"pushed_at": "2026-07-18T19:55:14Z",
"stargazers_count": 20,
"watchers_count": 20,
"has_discussions": false,
"forks_count": 3,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cve-2026-60137",
"cve-2026-63030",
"poc",
"rce",
"wordpress"
],
"visibility": "public",
"forks": 3,
"watchers": 20,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305198417,
"name": "wp2shell-scan",
"full_name": "fullhunt\/wp2shell-scan",
"owner": {
"login": "fullhunt",
"id": 34830403,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/34830403?v=4",
"html_url": "https:\/\/github.com\/fullhunt",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/fullhunt\/wp2shell-scan",
"description": "A scanner and proof-of-concept toolkit for CVE-2026-63030 (wp2shell) - pre-authenticated remote code execution in WordPress core",
"fork": false,
"created_at": "2026-07-18T20:12:07Z",
"updated_at": "2026-09-03T22:54:19Z",
"pushed_at": "2026-07-18T21:41:54Z",
"stargazers_count": 6,
"watchers_count": 6,
"has_discussions": false,
"forks_count": 2,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cve-2026-63030",
"wp2shell",
"wp2shell-exploit",
"wp2shell-poc"
],
"visibility": "public",
"forks": 2,
"watchers": 6,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305216510,
"name": "CVE-2026-63030_PoC",
"full_name": "ChiefYoru\/CVE-2026-63030_PoC",
"owner": {
"login": "ChiefYoru",
"id": 225136448,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/225136448?v=4",
"html_url": "https:\/\/github.com\/ChiefYoru",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/ChiefYoru\/CVE-2026-63030_PoC",
"description": "CVE-2026-63030 - WordPress Core Pre-Auth RCE Mass Exploit",
"fork": false,
"created_at": "2026-07-18T20:46:28Z",
"updated_at": "2026-07-18T20:59:27Z",
"pushed_at": "2026-07-18T20:59:23Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305226335,
"name": "wp2shell-detect",
"full_name": "own2pwn-fr\/wp2shell-detect",
"owner": {
"login": "own2pwn-fr",
"id": 287223983,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/287223983?v=4",
"html_url": "https:\/\/github.com\/own2pwn-fr",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/own2pwn-fr\/wp2shell-detect",
"description": "Blackbox, non-intrusive detector for wp2shell (WordPress core pre-auth RCE, CVE-2026-63030 \/ CVE-2026-60137). Detection only.",
"fork": false,
"created_at": "2026-07-18T21:06:14Z",
"updated_at": "2026-11-01T03:35:44Z",
"pushed_at": "2026-07-19T17:16:17Z",
"stargazers_count": 5,
"watchers_count": 5,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cve-2026-60137",
"cve-2026-63030",
"security-scanner",
"vulnerability-detection",
"wordpress"
],
"visibility": "public",
"forks": 0,
"watchers": 5,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305467567,
"name": "Wp2Shell",
"full_name": "c0gnit00\/Wp2Shell",
"owner": {
"login": "c0gnit00",
"id": 172115438,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/172115438?v=4",
"html_url": "https:\/\/github.com\/c0gnit00",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/c0gnit00\/Wp2Shell",
"description": "Exploit POC for Wp2Shell, CVE-2026-63030 + CVE-2026-63137",
"fork": false,
"created_at": "2026-07-19T06:12:24Z",
"updated_at": "2026-10-22T08:36:52Z",
"pushed_at": "2026-07-19T06:12:49Z",
"stargazers_count": 2,
"watchers_count": 2,
"has_discussions": false,
"forks_count": 2,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 2,
"watchers": 2,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305473750,
"name": "wp2shell",
"full_name": "ikow\/wp2shell",
"owner": {
"login": "ikow",
"id": 5469411,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/5469411?v=4",
"html_url": "https:\/\/github.com\/ikow",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/ikow\/wp2shell",
"description": "wp2shell — WordPress Core Pre-Auth RCE (CVE-2026-63030 + CVE-2026-60137). Exploit toolkit + remediation.",
"fork": false,
"created_at": "2026-07-19T06:23:48Z",
"updated_at": "2026-10-28T18:27:53Z",
"pushed_at": "2026-07-19T06:23:51Z",
"stargazers_count": 16,
"watchers_count": 16,
"has_discussions": false,
"forks_count": 4,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 4,
"watchers": 16,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305511195,
"name": "CVE-2026-63030-poc",
"full_name": "TomorrowX6\/CVE-2026-63030-poc",
"owner": {
"login": "TomorrowX6",
"id": 61819285,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/61819285?v=4",
"html_url": "https:\/\/github.com\/TomorrowX6",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/TomorrowX6\/CVE-2026-63030-poc",
"description": null,
"fork": false,
"created_at": "2026-07-19T07:29:49Z",
"updated_at": "2026-09-09T14:45:36Z",
"pushed_at": "2026-09-09T14:36:47Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 1,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 1,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305558264,
"name": "wp2shell-scanner",
"full_name": "bahartanir\/wp2shell-scanner",
"owner": {
"login": "bahartanir",
"id": 193408204,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/193408204?v=4",
"html_url": "https:\/\/github.com\/bahartanir",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/bahartanir\/wp2shell-scanner",
"description": "CVE-2026-63030 \/ CVE-2026-60137 - WordPress pre-auth RCE scanner",
"fork": false,
"created_at": "2026-07-19T08:52:12Z",
"updated_at": "2026-07-26T21:07:07Z",
"pushed_at": "2026-07-19T15:48:16Z",
"stargazers_count": 8,
"watchers_count": 8,
"has_discussions": false,
"forks_count": 1,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 1,
"watchers": 8,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305708384,
"name": "wp2shell-compromise-scanner-plugin",
"full_name": "eyesecurity\/wp2shell-compromise-scanner-plugin",
"owner": {
"login": "eyesecurity",
"id": 183391194,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/183391194?v=4",
"html_url": "https:\/\/github.com\/eyesecurity",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/eyesecurity\/wp2shell-compromise-scanner-plugin",
"description": "Read-only WordPress plugin that scans for artifacts of the wp2shell exploit chain (CVE-2026-63030 \/ CVE-2026-60137)",
"fork": false,
"created_at": "2026-07-19T12:55:02Z",
"updated_at": "2026-07-20T00:32:05Z",
"pushed_at": "2026-07-20T00:32:01Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 1,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 1,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305758481,
"name": "CVE-2026-63030",
"full_name": "0xh7ml\/CVE-2026-63030",
"owner": {
"login": "0xh7ml",
"id": 42938253,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/42938253?v=4",
"html_url": "https:\/\/github.com\/0xh7ml",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/0xh7ml\/CVE-2026-63030",
"description": null,
"fork": false,
"created_at": "2026-07-19T14:07:29Z",
"updated_at": "2026-07-19T14:07:44Z",
"pushed_at": "2026-07-19T14:07:41Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305834511,
"name": "CVE-2026-63030-POC",
"full_name": "4B3R4M4-607D\/CVE-2026-63030-POC",
"owner": {
"login": "4B3R4M4-607D",
"id": 232144934,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/232144934?v=4",
"html_url": "https:\/\/github.com\/4B3R4M4-607D",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/4B3R4M4-607D\/CVE-2026-63030-POC",
"description": "CVE-2026-63030 \/ wp2shell",
"fork": false,
"created_at": "2026-07-19T15:52:33Z",
"updated_at": "2026-10-21T16:31:22Z",
"pushed_at": "2026-10-21T16:31:18Z",
"stargazers_count": 2,
"watchers_count": 2,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 2,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305841391,
"name": "wp2shell-scan",
"full_name": "InstaWP\/wp2shell-scan",
"owner": {
"login": "InstaWP",
"id": 102959367,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/102959367?v=4",
"html_url": "https:\/\/github.com\/InstaWP",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/InstaWP\/wp2shell-scan",
"description": "Detect & clean up wp2shell (CVE-2026-63030) WordPress compromise — bulk-runnable, read-only by default",
"fork": false,
"created_at": "2026-07-19T16:02:08Z",
"updated_at": "2026-09-30T05:08:51Z",
"pushed_at": "2026-07-21T08:22:34Z",
"stargazers_count": 6,
"watchers_count": 6,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 6,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305904399,
"name": "wp2shell-scanner",
"full_name": "hidden-investigations\/wp2shell-scanner",
"owner": {
"login": "hidden-investigations",
"id": 207369456,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/207369456?v=4",
"html_url": "https:\/\/github.com\/hidden-investigations",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/hidden-investigations\/wp2shell-scanner",
"description": "WordPress wp2shell vulnerability-chain scanner for CVE-2026-63030 and CVE-2026-60137, with active detection, optional PoC, JSON export.",
"fork": false,
"created_at": "2026-07-19T17:32:21Z",
"updated_at": "2026-07-31T16:41:40Z",
"pushed_at": "2026-07-20T00:37:53Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 1,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cve-2026-60137",
"cve-2026-63030",
"penetration-testing",
"security-scanner",
"vulnerability-scanner",
"wordpress-security-scanner",
"wp2shell"
],
"visibility": "public",
"forks": 1,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305933425,
"name": "wp2shell-lab",
"full_name": "ananay\/wp2shell-lab",
"owner": {
"login": "ananay",
"id": 5569219,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/5569219?v=4",
"html_url": "https:\/\/github.com\/ananay",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/ananay\/wp2shell-lab",
"description": "Validation target: minimal WordPress core slice reproducing the wp2shell (CVE-2026-63030 + CVE-2026-60137) REST-to-SQLi chain",
"fork": false,
"created_at": "2026-07-19T18:16:57Z",
"updated_at": "2026-07-19T20:52:01Z",
"pushed_at": "2026-07-26T00:53:53Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305959469,
"name": "wp-cve-2026-63030-check",
"full_name": "Lukols-Dev\/wp-cve-2026-63030-check",
"owner": {
"login": "Lukols-Dev",
"id": 57043892,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/57043892?v=4",
"html_url": "https:\/\/github.com\/Lukols-Dev",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Lukols-Dev\/wp-cve-2026-63030-check",
"description": "Non-intrusive exposure checker for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030 \/ CVE-2026-60137).",
"fork": false,
"created_at": "2026-07-19T19:00:06Z",
"updated_at": "2026-07-19T19:05:15Z",
"pushed_at": "2026-07-19T19:05:11Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305967389,
"name": "wordpress-skelersecurity-core-security-CVE-2026-63030",
"full_name": "skelersecurity\/wordpress-skelersecurity-core-security-CVE-2026-63030",
"owner": {
"login": "skelersecurity",
"id": 242180241,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/242180241?v=4",
"html_url": "https:\/\/github.com\/skelersecurity",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/skelersecurity\/wordpress-skelersecurity-core-security-CVE-2026-63030",
"description": "The wp2shell vulnerability chain represents one of the most significant WordPress Core security issues in recent years. Because exploitation begins with an unauthenticated request and can ultimately result in Remote Code Execution, organizations should treat remediation as an emergency.",
"fork": false,
"created_at": "2026-07-19T19:15:24Z",
"updated_at": "2026-07-19T19:21:29Z",
"pushed_at": "2026-07-19T19:24:17Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1305970037,
"name": "PressVector",
"full_name": "vulnquest58\/PressVector",
"owner": {
"login": "vulnquest58",
"id": 202430906,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/202430906?v=4",
"html_url": "https:\/\/github.com\/vulnquest58",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/vulnquest58\/PressVector",
"description": "PressVector - Advanced WordPress Vulnerability Scanner CVE-2026-63030 (REST batch route confusion) \/ CVE-2026-60137 (SQLi) Developer: Vulnquest",
"fork": false,
"created_at": "2026-07-19T19:20:48Z",
"updated_at": "2026-07-23T02:37:58Z",
"pushed_at": "2026-07-22T17:59:51Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 1,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 1,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1306020541,
"name": "wordpress-batch-rce-lab",
"full_name": "ZenithGenius\/wordpress-batch-rce-lab",
"owner": {
"login": "ZenithGenius",
"id": 94218707,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/94218707?v=4",
"html_url": "https:\/\/github.com\/ZenithGenius",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/ZenithGenius\/wordpress-batch-rce-lab",
"description": "CVE-2026-63030: WordPress REST batch-endpoint array desync. Mechanism, detection, mitigation, and a safe reproduction lab.",
"fork": false,
"created_at": "2026-07-19T21:15:10Z",
"updated_at": "2026-08-04T10:41:16Z",
"pushed_at": "2026-07-19T23:56:21Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1306034720,
"name": "wp2shell",
"full_name": "Crypto-Cat\/wp2shell",
"owner": {
"login": "Crypto-Cat",
"id": 12751872,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/12751872?v=4",
"html_url": "https:\/\/github.com\/Crypto-Cat",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Crypto-Cat\/wp2shell",
"description": "PoC for CVE-2026-63030 + CVE-2026-60137, AKA WP2Shell",
"fork": false,
"created_at": "2026-07-19T21:51:28Z",
"updated_at": "2026-07-29T23:46:05Z",
"pushed_at": "2026-07-20T08:25:39Z",
"stargazers_count": 3,
"watchers_count": 3,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 3,
"score": 0,
"subscribers_count": 0
},
{
"id": 1306113724,
"name": "CVE-2026-63030",
"full_name": "administrator-01001\/CVE-2026-63030",
"owner": {
"login": "administrator-01001",
"id": 304351790,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/304351790?v=4",
"html_url": "https:\/\/github.com\/administrator-01001",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/administrator-01001\/CVE-2026-63030",
"description": "Proof-of-concept exploit for CVE-2026-63030, a pre-authentication vulnerability in WordPress (versions 6.9.0 through 7.0.1).",
"fork": false,
"created_at": "2026-07-20T01:20:53Z",
"updated_at": "2026-07-20T01:38:20Z",
"pushed_at": "2026-07-20T01:25:25Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1306230621,
"name": "EXPLOIT-CVE-2026-63030",
"full_name": "joaovicdev\/EXPLOIT-CVE-2026-63030",
"owner": {
"login": "joaovicdev",
"id": 38336057,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/38336057?v=4",
"html_url": "https:\/\/github.com\/joaovicdev",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/joaovicdev\/EXPLOIT-CVE-2026-63030",
"description": null,
"fork": false,
"created_at": "2026-07-20T04:58:59Z",
"updated_at": "2026-07-20T10:51:02Z",
"pushed_at": "2026-07-20T05:01:17Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 1,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 1,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1306273877,
"name": "wp2shell-checker",
"full_name": "0xjessie21\/wp2shell-checker",
"owner": {
"login": "0xjessie21",
"id": 2928054,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/2928054?v=4",
"html_url": "https:\/\/github.com\/0xjessie21",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/0xjessie21\/wp2shell-checker",
"description": "WordPress Core Unauthenticated RCE (CVE-2026-63030, CVE-2026-60137)",
"fork": false,
"created_at": "2026-07-20T06:06:19Z",
"updated_at": "2026-07-21T03:45:15Z",
"pushed_at": "2026-07-20T07:39:11Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"checker",
"cve-2026-60137",
"cve-2026-63030",
"rce",
"rce-scanner",
"remote-code-execution",
"wordpress"
],
"visibility": "public",
"forks": 0,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1306324643,
"name": "wp2shell",
"full_name": "Iqbalx7\/wp2shell",
"owner": {
"login": "Iqbalx7",
"id": 265374623,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/265374623?v=4",
"html_url": "https:\/\/github.com\/Iqbalx7",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Iqbalx7\/wp2shell",
"description": "unauthenticated RCE in WordPress core (CVE-2026-63030 + CVE-2026-60137)",
"fork": false,
"created_at": "2026-07-20T07:11:52Z",
"updated_at": "2026-07-22T14:23:41Z",
"pushed_at": "2026-07-20T08:43:00Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1306512655,
"name": "CVE-2026-63030-Wp2Shell",
"full_name": "GhostInExile\/CVE-2026-63030-Wp2Shell",
"owner": {
"login": "GhostInExile",
"id": 232484775,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/232484775?v=4",
"html_url": "https:\/\/github.com\/GhostInExile",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/GhostInExile\/CVE-2026-63030-Wp2Shell",
"description": "WordPress REST API SQLi to RCE PoC (CVE-2026-63030 & CVE-2026-60137)",
"fork": false,
"created_at": "2026-07-20T10:59:36Z",
"updated_at": "2026-07-21T08:17:38Z",
"pushed_at": "2026-07-21T08:16:22Z",
"stargazers_count": 4,
"watchers_count": 4,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cve-2026-63030",
"poc",
"proof-of-concept",
"sql-injection",
"wordpress-rce",
"wp2shell",
"wp2shell-exploit",
"wp2shell-poc"
],
"visibility": "public",
"forks": 0,
"watchers": 4,
"score": 0,
"subscribers_count": 0
},
{
"id": 1306784696,
"name": "wp2shell-Wordpress-TOWN",
"full_name": "lucifer0xf\/wp2shell-Wordpress-TOWN",
"owner": {
"login": "lucifer0xf",
"id": 137585551,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/137585551?v=4",
"html_url": "https:\/\/github.com\/lucifer0xf",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/lucifer0xf\/wp2shell-Wordpress-TOWN",
"description": "Unauthenticated Remote Code Execution (RCE) in WordPress Core allows attackers to execute arbitrary code without logging in by chaining CVE-2026-63030 and CVE-2026-60137, potentially leading to full site compromise.",
"fork": false,
"created_at": "2026-07-20T16:07:03Z",
"updated_at": "2026-07-23T09:35:44Z",
"pushed_at": "2026-07-20T16:17:15Z",
"stargazers_count": 2,
"watchers_count": 2,
"has_discussions": false,
"forks_count": 1,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 1,
"watchers": 2,
"score": 0,
"subscribers_count": 0
},
{
"id": 1306897626,
"name": "CVE-2026-63030",
"full_name": "Ch4120N\/CVE-2026-63030",
"owner": {
"login": "Ch4120N",
"id": 159701862,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/159701862?v=4",
"html_url": "https:\/\/github.com\/Ch4120N",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Ch4120N\/CVE-2026-63030",
"description": "CVE-2026-63030 - WordPress REST Batch Route-Confusion SQL Injection Proof of Concept",
"fork": false,
"created_at": "2026-07-20T18:20:41Z",
"updated_at": "2026-08-08T07:32:17Z",
"pushed_at": "2026-07-20T18:40:44Z",
"stargazers_count": 2,
"watchers_count": 2,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cve",
"cve-2026-63030",
"exploit",
"poc",
"proof-of-concept",
"python"
],
"visibility": "public",
"forks": 0,
"watchers": 2,
"score": 0,
"subscribers_count": 0
},
{
"id": 1307980098,
"name": "WP2Shell-CVE-2026-63030-POC",
"full_name": "Bhanunamikaze\/WP2Shell-CVE-2026-63030-POC",
"owner": {
"login": "Bhanunamikaze",
"id": 17119658,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/17119658?v=4",
"html_url": "https:\/\/github.com\/Bhanunamikaze",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Bhanunamikaze\/WP2Shell-CVE-2026-63030-POC",
"description": "PoC detector & safe validator for the WP2Shell WordPress vulnerability chain: CVE-2026-63030 (REST batch-route confusion) + CVE-2026-60137 (author__not_in SQL injection). For authorized security testing only.",
"fork": false,
"created_at": "2026-07-21T17:51:33Z",
"updated_at": "2026-10-26T20:46:19Z",
"pushed_at": "2026-10-26T20:46:16Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cve",
"cve-2026-60137",
"cve-2026-63030",
"infosec",
"penetration-testing",
"poc",
"proof-of-concept",
"python",
"rest-api-security",
"security-research",
"security-tools",
"sql-injection",
"vulnerability-scanner",
"wordpress",
"wordpress-security",
"wp2shell"
],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1308707699,
"name": "wp2shell",
"full_name": "mcipekci\/wp2shell",
"owner": {
"login": "mcipekci",
"id": 48002757,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/48002757?v=4",
"html_url": "https:\/\/github.com\/mcipekci",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/mcipekci\/wp2shell",
"description": "Pre-auth RCE PoC for WordPress core — chains CVE-2026-63030 (REST \/batch\/v1 route-confusion desync) with CVE-2026-60137 (author__not_in SQLi) into an unauthenticated shell. Authorized testing only.",
"fork": false,
"created_at": "2026-07-22T10:53:51Z",
"updated_at": "2026-11-07T05:33:29Z",
"pushed_at": "2026-07-22T11:01:23Z",
"stargazers_count": 18,
"watchers_count": 18,
"has_discussions": false,
"forks_count": 11,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 11,
"watchers": 18,
"score": 0,
"subscribers_count": 0
},
{
"id": 1308797318,
"name": "wp2shell-vulnerability-scanner",
"full_name": "Adrees-Basheer\/wp2shell-vulnerability-scanner",
"owner": {
"login": "Adrees-Basheer",
"id": 23651361,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/23651361?v=4",
"html_url": "https:\/\/github.com\/Adrees-Basheer",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Adrees-Basheer\/wp2shell-vulnerability-scanner",
"description": "Scan WordPress installations for wp2shell vulnerabilities (CVE-2026-63030 + CVE-2026-60137). Identifies full RCE and SQL injection risks across multiple sites with severity classification and CSV reporting.",
"fork": false,
"created_at": "2026-07-22T12:25:04Z",
"updated_at": "2026-07-22T12:34:49Z",
"pushed_at": "2026-07-22T12:32:05Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1308851730,
"name": "wp2shell-poc-fulljs",
"full_name": "raphy76\/wp2shell-poc-fulljs",
"owner": {
"login": "raphy76",
"id": 67171377,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/67171377?v=4",
"html_url": "https:\/\/github.com\/raphy76",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/raphy76\/wp2shell-poc-fulljs",
"description": "full javascript reproduction of CVE-2026-63030 (author_exclude, author__not_in and misalignment between validations and matches)",
"fork": false,
"created_at": "2026-07-22T13:22:59Z",
"updated_at": "2026-07-23T20:30:05Z",
"pushed_at": "2026-07-23T20:29:53Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1309023986,
"name": "CVE-2026-63030-CVE-2026-60137-wp2shell-poc",
"full_name": "gagaltotal\/CVE-2026-63030-CVE-2026-60137-wp2shell-poc",
"owner": {
"login": "gagaltotal",
"id": 23299078,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/23299078?v=4",
"html_url": "https:\/\/github.com\/gagaltotal",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/gagaltotal\/CVE-2026-63030-CVE-2026-60137-wp2shell-poc",
"description": "CVE-2026-63030 & CVE-2026-60137 Wp2shell Poc",
"fork": false,
"created_at": "2026-07-22T16:21:56Z",
"updated_at": "2026-11-05T21:06:20Z",
"pushed_at": "2026-07-22T16:30:44Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cve-2026-60137",
"cve-2026-63030",
"poc",
"python",
"python-script",
"python3",
"rce",
"rce-exploit",
"wordpress",
"wordpress-api",
"wp2shell",
"wp2shell-poc"
],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1309488847,
"name": "cve-2026-63030_60137-wordpress_rce_reproduction",
"full_name": "razureink\/cve-2026-63030_60137-wordpress_rce_reproduction",
"owner": {
"login": "razureink",
"id": 200357710,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/200357710?v=4",
"html_url": "https:\/\/github.com\/razureink",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/razureink\/cve-2026-63030_60137-wordpress_rce_reproduction",
"description": "CVE Reproduction: cve-2026-63030_60137-wordpress_rce_reproduction",
"fork": false,
"created_at": "2026-07-23T03:46:34Z",
"updated_at": "2026-07-23T03:46:44Z",
"pushed_at": "2026-07-23T03:46:40Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1310883781,
"name": "CVE-2026-63030-CVE-2026-60137",
"full_name": "Giangdurian\/CVE-2026-63030-CVE-2026-60137",
"owner": {
"login": "Giangdurian",
"id": 93591423,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/93591423?v=4",
"html_url": "https:\/\/github.com\/Giangdurian",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Giangdurian\/CVE-2026-63030-CVE-2026-60137",
"description": null,
"fork": false,
"created_at": "2026-07-24T09:49:20Z",
"updated_at": "2026-07-24T09:51:01Z",
"pushed_at": "2026-07-24T09:50:08Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1310932768,
"name": "CVE-2026-63030",
"full_name": "shinthink\/CVE-2026-63030",
"owner": {
"login": "shinthink",
"id": 292174078,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/292174078?v=4",
"html_url": "https:\/\/github.com\/shinthink",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/shinthink\/CVE-2026-63030",
"description": "WordPress Core Pre-Auth RCE via REST Batch Route Confusion + SQLi (CVE-2026-63030 + CVE-2026-60137)",
"fork": false,
"created_at": "2026-07-24T10:48:23Z",
"updated_at": "2026-07-24T10:50:32Z",
"pushed_at": "2026-07-24T10:50:18Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"batch-api",
"cve",
"cve-2026-60137",
"cve-2026-63030",
"exploit",
"pre-auth",
"python",
"rce",
"security",
"sql-injection",
"vulnerability",
"wordpress",
"wp2shell"
],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1311965220,
"name": "WordPress-CVE-2026-63030-Analysis",
"full_name": "imXur\/WordPress-CVE-2026-63030-Analysis",
"owner": {
"login": "imXur",
"id": 216771172,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/216771172?v=4",
"html_url": "https:\/\/github.com\/imXur",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/imXur\/WordPress-CVE-2026-63030-Analysis",
"description": "Technical analysis, root cause breakdown, and non-destructive detection methodology for CVE-2026-63030.",
"fork": false,
"created_at": "2026-07-25T12:29:46Z",
"updated_at": "2026-07-31T20:51:45Z",
"pushed_at": "2026-07-25T12:37:35Z",
"stargazers_count": 3,
"watchers_count": 3,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 3,
"score": 0,
"subscribers_count": 0
},
{
"id": 1313424279,
"name": "wp2shell",
"full_name": "yuag\/wp2shell",
"owner": {
"login": "yuag",
"id": 34123873,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/34123873?v=4",
"html_url": "https:\/\/github.com\/yuag",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/yuag\/wp2shell",
"description": "CVE-2026-63030 + CVE-2026-60137+poc",
"fork": false,
"created_at": "2026-07-27T04:45:33Z",
"updated_at": "2026-07-27T04:52:03Z",
"pushed_at": "2026-07-27T04:51:08Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1314276815,
"name": "wp2shell-Hestia-Scanner",
"full_name": "BytesPulse-OE\/wp2shell-Hestia-Scanner",
"owner": {
"login": "BytesPulse-OE",
"id": 153992499,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/153992499?v=4",
"html_url": "https:\/\/github.com\/BytesPulse-OE",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/BytesPulse-OE\/wp2shell-Hestia-Scanner",
"description": "Read-only WordPress security scanner for HestiaCP servers. Detects wp2shell compromise indicators (CVE-2026-63030 \/ CVE-2026-60137) across all hosted sites — per-user email reports, core file diff against clean WordPress, PHP\/JS\/htaccess\/image analysis, and optional AI evaluation via Claude API.",
"fork": false,
"created_at": "2026-07-27T21:03:54Z",
"updated_at": "2026-08-03T21:47:03Z",
"pushed_at": "2026-08-03T21:46:56Z",
"stargazers_count": 2,
"watchers_count": 2,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 2,
"score": 0,
"subscribers_count": 1
},
{
"id": 1317724852,
"name": "CVE-2026-63030-WP2Shell",
"full_name": "Industri4l-H3ll-Xpl0it3rs\/CVE-2026-63030-WP2Shell",
"owner": {
"login": "Industri4l-H3ll-Xpl0it3rs",
"id": 262636091,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/262636091?v=4",
"html_url": "https:\/\/github.com\/Industri4l-H3ll-Xpl0it3rs",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Industri4l-H3ll-Xpl0it3rs\/CVE-2026-63030-WP2Shell",
"description": "CVE-2026-63030 Exploit | by gr1tx",
"fork": false,
"created_at": "2026-07-30T22:23:03Z",
"updated_at": "2026-07-30T22:38:34Z",
"pushed_at": "2026-07-30T22:32:33Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"exploit"
],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1320380482,
"name": "wp2shell-rce",
"full_name": "johnlodan\/wp2shell-rce",
"owner": {
"login": "johnlodan",
"id": 71878201,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/71878201?v=4",
"html_url": "https:\/\/github.com\/johnlodan",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/johnlodan\/wp2shell-rce",
"description": "WordPress CVE-2026-63030 and CVE-2026-60137 security tool for detecting exposure to the WP2Shell pre-authentication RCE chain.",
"fork": false,
"created_at": "2026-08-02T16:33:02Z",
"updated_at": "2026-08-06T02:04:00Z",
"pushed_at": "2026-08-04T09:36:29Z",
"stargazers_count": 3,
"watchers_count": 3,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 3,
"score": 0,
"subscribers_count": 0
},
{
"id": 1321769225,
"name": "CVE-2026-63030",
"full_name": "Procjevt\/CVE-2026-63030",
"owner": {
"login": "Procjevt",
"id": 89573243,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/89573243?v=4",
"html_url": "https:\/\/github.com\/Procjevt",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Procjevt\/CVE-2026-63030",
"description": null,
"fork": false,
"created_at": "2026-08-03T12:41:33Z",
"updated_at": "2026-08-03T12:47:00Z",
"pushed_at": "2026-08-03T12:46:40Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1322865032,
"name": "CVE-2026-63030",
"full_name": "x-znn\/CVE-2026-63030",
"owner": {
"login": "x-znn",
"id": 77075732,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/77075732?v=4",
"html_url": "https:\/\/github.com\/x-znn",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/x-znn\/CVE-2026-63030",
"description": null,
"fork": false,
"created_at": "2026-08-04T11:23:02Z",
"updated_at": "2026-08-04T11:25:11Z",
"pushed_at": "2026-08-04T11:23:31Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1324491169,
"name": "CVE-2026-63030",
"full_name": "AnggaTechI\/CVE-2026-63030",
"owner": {
"login": "AnggaTechI",
"id": 276389265,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/276389265?v=4",
"html_url": "https:\/\/github.com\/AnggaTechI",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/AnggaTechI\/CVE-2026-63030",
"description": "WordPress Core Pre-Auth RCE — Batch Route Confusion + SQL Injection",
"fork": false,
"created_at": "2026-08-05T21:21:12Z",
"updated_at": "2026-08-27T09:50:11Z",
"pushed_at": "2026-08-08T06:30:12Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 1,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 1,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1326072964,
"name": "CVE-2026-63030-CVE-2026-60137",
"full_name": "z3rodayhacks\/CVE-2026-63030-CVE-2026-60137",
"owner": {
"login": "z3rodayhacks",
"id": 85669626,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/85669626?v=4",
"html_url": "https:\/\/github.com\/z3rodayhacks",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/z3rodayhacks\/CVE-2026-63030-CVE-2026-60137",
"description": null,
"fork": false,
"created_at": "2026-08-07T01:33:04Z",
"updated_at": "2026-08-07T01:43:36Z",
"pushed_at": "2026-08-07T01:43:31Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1328590726,
"name": "WP2Shell",
"full_name": "g0d150ne\/WP2Shell",
"owner": {
"login": "g0d150ne",
"id": 214824334,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/214824334?v=4",
"html_url": "https:\/\/github.com\/g0d150ne",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/g0d150ne\/WP2Shell",
"description": "WP2Shell is a powerful and modular exploit framework that combines two critical WordPress vulnerabilities (CVE-2026-63030 and CVE-2026-60137) to achieve complete compromise of a target site without any credentials. ",
"fork": false,
"created_at": "2026-08-09T08:26:51Z",
"updated_at": "2026-10-23T10:44:12Z",
"pushed_at": "2026-08-10T20:54:00Z",
"stargazers_count": 2,
"watchers_count": 2,
"has_discussions": false,
"forks_count": 1,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 1,
"watchers": 2,
"score": 0,
"subscribers_count": 0
},
{
"id": 1336097815,
"name": "wp2shell2026",
"full_name": "0xIIDe231\/wp2shell2026",
"owner": {
"login": "0xIIDe231",
"id": 43062701,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/43062701?v=4",
"html_url": "https:\/\/github.com\/0xIIDe231",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/0xIIDe231\/wp2shell2026",
"description": "wp2shell - WordPress CVE-2026-63030 Exploit & Scanner well forked",
"fork": false,
"created_at": "2026-08-16T15:48:26Z",
"updated_at": "2026-08-16T15:48:26Z",
"pushed_at": "2026-07-18T06:44:40Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 1,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 1,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1340673113,
"name": "cve-2026-63030-lab",
"full_name": "mhassani97\/cve-2026-63030-lab",
"owner": {
"login": "mhassani97",
"id": 32847663,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/32847663?v=4",
"html_url": "https:\/\/github.com\/mhassani97",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/mhassani97\/cve-2026-63030-lab",
"description": "wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain",
"fork": false,
"created_at": "2026-08-20T12:26:03Z",
"updated_at": "2026-08-20T12:27:20Z",
"pushed_at": "2026-08-20T12:26:35Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 1,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 1,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1341391660,
"name": "wp2shell-poc",
"full_name": "DeadExpl0it\/wp2shell-poc",
"owner": {
"login": "DeadExpl0it",
"id": 87920111,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/87920111?v=4",
"html_url": "https:\/\/github.com\/DeadExpl0it",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/DeadExpl0it\/wp2shell-poc",
"description": "wp2shell — WordPress Core Pre-Auth RCE Chain poc for CVE-2026-63030 and CVE-2026-60137",
"fork": false,
"created_at": "2026-08-21T04:19:33Z",
"updated_at": "2026-09-23T18:14:00Z",
"pushed_at": "2026-08-21T04:38:42Z",
"stargazers_count": 3,
"watchers_count": 3,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 3,
"score": 0,
"subscribers_count": 0
},
{
"id": 1351532254,
"name": "WP2Shell-Scanner",
"full_name": "Sec-Dan\/WP2Shell-Scanner",
"owner": {
"login": "Sec-Dan",
"id": 3199612,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/3199612?v=4",
"html_url": "https:\/\/github.com\/Sec-Dan",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Sec-Dan\/WP2Shell-Scanner",
"description": "Read-only CLI to check whether a WordPress site is exposed to WP2Shell (CVE-2026-63030 \/ CVE-2026-60137)",
"fork": false,
"created_at": "2026-08-30T15:56:18Z",
"updated_at": "2026-08-30T18:23:35Z",
"pushed_at": "2026-08-30T15:56:22Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cli",
"cve-2026-60137",
"cve-2026-63030",
"infosec",
"python",
"rce",
"security",
"security-tools",
"vulnerability-scanner",
"wordpress",
"wp2shell"
],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1384397429,
"name": "CVE-2026-63030",
"full_name": "fl0ydsec\/CVE-2026-63030",
"owner": {
"login": "fl0ydsec",
"id": 316734750,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/316734750?v=4",
"html_url": "https:\/\/github.com\/fl0ydsec",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/fl0ydsec\/CVE-2026-63030",
"description": "CVE-2026-63030 + CVE-2026-60137 WordPress Core pre-auth RCE mass exploit",
"fork": false,
"created_at": "2026-09-24T01:04:05Z",
"updated_at": "2026-10-12T23:47:44Z",
"pushed_at": "2026-10-12T23:48:18Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cve",
"cve-2026-60137",
"cve-2026-63030",
"cybersecurity",
"exploit",
"poc",
"rce",
"scanner",
"wordpress"
],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1389647004,
"name": "CVE-2026-63030",
"full_name": "langz337\/CVE-2026-63030",
"owner": {
"login": "langz337",
"id": 211595830,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/211595830?v=4",
"html_url": "https:\/\/github.com\/langz337",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/langz337\/CVE-2026-63030",
"description": null,
"fork": false,
"created_at": "2026-09-26T18:27:46Z",
"updated_at": "2026-09-26T23:17:02Z",
"pushed_at": "2026-09-26T18:32:57Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1403536848,
"name": "wp2shell-PoC",
"full_name": "hitechcloud-vietnam\/wp2shell-PoC",
"owner": {
"login": "hitechcloud-vietnam",
"id": 187465773,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/187465773?v=4",
"html_url": "https:\/\/github.com\/hitechcloud-vietnam",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/hitechcloud-vietnam\/wp2shell-PoC",
"description": "CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept",
"fork": false,
"created_at": "2026-10-03T18:47:36Z",
"updated_at": "2026-11-05T02:55:51Z",
"pushed_at": "2026-10-03T18:48:54Z",
"stargazers_count": 1,
"watchers_count": 1,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [
"cve-2026-60137",
"cve-2026-63030"
],
"visibility": "public",
"forks": 0,
"watchers": 1,
"score": 0,
"subscribers_count": 0
},
{
"id": 1415772213,
"name": "CVE-2026-63030-CVE-2026-60137-WP2SHELL",
"full_name": "0xCyp1337\/CVE-2026-63030-CVE-2026-60137-WP2SHELL",
"owner": {
"login": "0xCyp1337",
"id": 323652322,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/323652322?v=4",
"html_url": "https:\/\/github.com\/0xCyp1337",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/0xCyp1337\/CVE-2026-63030-CVE-2026-60137-WP2SHELL",
"description": null,
"fork": false,
"created_at": "2026-10-12T15:15:32Z",
"updated_at": "2026-10-12T15:23:53Z",
"pushed_at": "2026-10-12T15:23:48Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1428290225,
"name": "PoC-for-CVE-2026-63030",
"full_name": "Githu836\/PoC-for-CVE-2026-63030",
"owner": {
"login": "Githu836",
"id": 186125630,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/186125630?v=4",
"html_url": "https:\/\/github.com\/Githu836",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Githu836\/PoC-for-CVE-2026-63030",
"description": null,
"fork": false,
"created_at": "2026-10-21T11:32:08Z",
"updated_at": "2026-10-21T11:35:42Z",
"pushed_at": "2026-10-21T11:35:38Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1428489451,
"name": "CVE-2026-63030",
"full_name": "dexit\/CVE-2026-63030",
"owner": {
"login": "dexit",
"id": 6205151,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/6205151?v=4",
"html_url": "https:\/\/github.com\/dexit",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/dexit\/CVE-2026-63030",
"description": null,
"fork": false,
"created_at": "2026-10-21T14:20:27Z",
"updated_at": "2026-10-21T14:20:28Z",
"pushed_at": "2026-10-19T21:42:51Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1428892717,
"name": "Orga-Tersur-Daniel-CVE-2026-63030",
"full_name": "Tersurrr\/Orga-Tersur-Daniel-CVE-2026-63030",
"owner": {
"login": "Tersurrr",
"id": 288455216,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/288455216?v=4",
"html_url": "https:\/\/github.com\/Tersurrr",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/Tersurrr\/Orga-Tersur-Daniel-CVE-2026-63030",
"description": "CVE-2026-63030 — WordPress REST API Batch-Route Confusion",
"fork": false,
"created_at": "2026-10-21T20:24:32Z",
"updated_at": "2026-10-21T20:52:20Z",
"pushed_at": "2026-10-21T20:44:38Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
},
{
"id": 1442883623,
"name": "CVE-2026-63030-wp2shell-repro",
"full_name": "l-i-uqing\/CVE-2026-63030-wp2shell-repro",
"owner": {
"login": "l-i-uqing",
"id": 144933306,
"avatar_url": "https:\/\/avatars.githubusercontent.com\/u\/144933306?v=4",
"html_url": "https:\/\/github.com\/l-i-uqing",
"user_view_type": "public"
},
"html_url": "https:\/\/github.com\/l-i-uqing\/CVE-2026-63030-wp2shell-repro",
"description": "WordPress REST Batch route confusion + SQLi RCE chain reproduction (CVE-2026-63030 & CVE-2026-60137)",
"fork": false,
"created_at": "2026-11-02T11:33:12Z",
"updated_at": "2026-11-02T12:57:06Z",
"pushed_at": "2026-11-02T12:57:02Z",
"stargazers_count": 0,
"watchers_count": 0,
"has_discussions": false,
"forks_count": 0,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 0,
"watchers": 0,
"score": 0,
"subscribers_count": 0
}
]
Reference in new issue View Git Blame Copy Permalink