This tool is provided **strictly for educational purposes and authorized security testing only**.
- You will **only** use it against systems you own or have **explicit written permission** to test.
- You will **not** use it for any illegal, unauthorized, or malicious activity.
- The author (**LANGZ**) is **not responsible** for any damage, data loss, legal consequences, or misuse caused by this tool.
- Any misuse of this tool is **entirely the responsibility of the user**.
> **If you use this tool against a system without authorization, you are committing a crime.**
> **The author does not condone, support, or take any responsibility for such actions.**
CVE-2026-63030 is a **REST API batch-route confusion** flaw (CWE-436) in WordPress core, introduced in version 6.9. When chained with CVE-2026-60137 (a blind SQL injection in `WP_Query`'s `author__not_in` parameter), it allows an **unauthenticated attacker** to achieve **full remote code execution** on a default WordPress installation.
| **Affected Versions** | WordPress 6.9.0 – 6.9.4, WordPress 7.0.0 – 7.0.1 |
| **SQLi-Only Affected** | WordPress 6.8.0 – 6.8.5 (CVE-2026-60137 only) |
| **Impact** | Complete site compromise — database read/write, arbitrary PHP file upload, OS command execution |
| **Exploitation Status** | Actively exploited in the wild; 62,802+ unique attacking IPs observed |
- Read the entire WordPress database (including password hashes)
- Upload and execute arbitrary PHP files (webshells)
- Execute OS-level commands on the server
- Zero plugins required — affects stock WordPress installations
- Single HTTP request can trigger the full chain
- Public PoC exploits and Nuclei templates are circulating
- CISA added it to the **Known Exploited Vulnerabilities (KEV)** catalog on July 21, 2026, with a remediation deadline of July 24, 2026
Update WordPress to a **patched version**:
| 6.8.0 – 6.8.5 | **6.8.6** (SQLi fix only) |
> **Note:** WordPress enabled forced auto-updates, but sites with auto-updates disabled or managed hosting that delays updates remain exposed. **Verify the update was successfully applied.**
### 2. Temporary Workarounds (If Patching Is Delayed)
- **Block the batch endpoint** at the WAF or reverse proxy:
- Block `POST` requests to `/wp-json/batch/v1`
- Block `POST` requests to `?rest_route=/batch/v1`
- **Restrict anonymous REST API access** using a security plugin (e.g., "Disable WP REST API")
- **Deploy a WAF** with WordPress-specific rule sets to detect and block SQL injection attempts
- **Limit database user privileges** — prevent the WordPress DB account from performing file writes or high-impact SQL operations
### 3. Detection & Post-Exploitation Checks
- Unusual `POST` requests to `/wp-json/batch/v1` or `?rest_route=/batch/v1` in access logs
- Suspicious PHP files in `/wp-content/cache/` or other web-accessible directories
- Unexpected plugins or modified core files
> **If you find indicators of compromise, simply removing the files and admin account is not enough.** Perform a full incident response and consider a complete system rebuild.
The exploit chain combines two vulnerabilities:
### Step 1: Route Confusion (CVE-2026-63030)
WordPress's REST API batch processor (`serve_batch_request_v1`) has an **off-by-one indexing bug**. When `wp_parse_url()` fails on a sub-request path (e.g., `"///"`), the resulting `WP_Error` is pushed to `$validation[]` but **not** to `$matches[]`. This desynchronizes the two arrays, causing every subsequent request to be dispatched under the **wrong handler**.
### Step 2: SQL Injection (CVE-2026-60137)
The confused request lands in `WP_Query`'s `author__not_in` parameter. WordPress casts the string to an array but skips `absint()` sanitization, allowing raw SQL injection. The tool uses this to:
- Poison WordPress's object cache with fake `WP_Post` objects
- Trigger a changeset auto-publish that elevates privileges
- Re-enter the REST API with admin context
Once the setup is complete (discovering table prefix and admin ID), the escalation payload fires in a **single HTTP request**:
1. Cache poisoning (fake posts via `UNION`)
2. Privilege escalation (changeset auto-publish)
The tool then uses the generated admin credentials to deploy a **plugin-based webshell** for OS command execution.
- No external dependencies (uses only standard library)
python3 langz.py --confirm-sqli
python3 langz.py --read --preset fingerprint
python3 langz.py --read --preset users
python3 langz.py --shell --cmd id
python3 langz.py --shell -i
Run without arguments to open the interactive :
══════════════════════════════════════════════════════════════
██╗ █████╗ ███╗ ██╗ ██████╗ ███████╗
██║ ██╔══██╗████╗ ██║██╔════╝ ╚══███╔╝
██║ ███████║██╔██╗ ██║██║ ███╗ ███╔╝
██║ ██╔══██║██║╚██╗██║██║ ██║ ███╔╝
███████╗██║ ██║██║ ╚████║╚██████╔╝███████╗
╚══════╝╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═════╝ ╚══════╝
──────────────────────────────────────────────────────────────
──────────────────────────────────────────────────────────────
══════════════════════════════════════════════════════════════
| `--timeout` | Request timeout in seconds (default: 15) |
| `--proxy` | HTTP proxy (e.g., ` |
| `--threads` | Parallel threads for mass scan (default: 50) |
| `--sleep` | SQL timing delay for blind confirmation (default: 3) |
| `--samples` | Timing pairs for confirmation (default: 3) |
| `--confirm-sqli` | Send active SQLi confirmation payload |
| `--preset` | `fingerprint` or `users` |
| `--query` | Custom SQL expression to read |
| `--prefix` | Database table prefix (default: `wp_`) |
| `--max-length` | Max characters per value (default: 128) |
| `--technique` | `auto`, `union`, `blind`, or `error` |
| `--user` | Admin username (for `--shell`) |
| `--password` | Admin password (for `--shell`) |
| `-i`, `--interactive` | Open interactive shell |
- **CVE-2026-63030** — [
- **CVE-2026-60137** — [
- **WordPress Security Release** — [
- **CISA KEV Catalog** — [
- **Nuclei Template** — [
This project is provided for **educational and authorized security testing purposes only**.
The author **LANGZ** assumes **no liability** for any misuse or damage caused by this tool.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
