Add WordPress wp2shell exposure scanner (CVE-2026-63030 + CVE-2026-60137)

[M4xSec]

Summary

Companion scanner module for the wp2shell exploit (PR #21760). Non-destructive detection of:

• CVE-2026-63030 — REST API Batch Route Confusion
• CVE-2026-60137 — Blind SQL Injection via author__not_in

Affects WordPress 6.8.0–6.8.5, 6.9.0–6.9.4, 7.0.0–7.0.1. Fixed in 6.8.6, 6.9.5, 7.0.2.

Features

• Version fingerprinting with fallback (generator meta tag → RSS feed → REST API)
• Follows 301/302 redirects for WAF/reverse proxy setups
• Batch route accessibility check
• Optional time-based blind SQLi confirmation (CONFIRM_SQLI)
• Batch file scan mode (TARGET_FILE) — one domain per line, auto DNS resolution + VHOST
• Cloudflare WAF bypass (colon primer + JSON unicode escaping)

Files

• modules/auxiliary/scanner/http/wp_wordpress_batch_sqli.rb — scanner module
• documentation/modules/auxiliary/scanner/http/wp_wordpress_batch_sqli.md — documentation

Verification

Tested against WordPress 6.9.0 Docker lab (with and without ModSecurity WAF):

msf6 > use auxiliary/scanner/http/wp_wordpress_batch_sqli
msf6 auxiliary(scanner/http/wp_wordpress_batch_sqli) > set RHOSTS 127.0.0.1
msf6 auxiliary(scanner/http/wp_wordpress_batch_sqli) > set RPORT 8888
msf6 auxiliary(scanner/http/wp_wordpress_batch_sqli) > set SSL false
msf6 auxiliary(scanner/http/wp_wordpress_batch_sqli) > set VHOST localhost
msf6 auxiliary(scanner/http/wp_wordpress_batch_sqli) > set CONFIRM_SQLI true
msf6 auxiliary(scanner/http/wp_wordpress_batch_sqli) > run

[*]   localhost — SQLi probe: fast=0.045s slow=3.038s delta=2.993s
[+] localhost — WP 6.9.0 — VULNERABLE (RCE, CVE-2026-63030) — SQLi CONFIRMED
[*] Auxiliary module execution completed

WAF bypass (ModSecurity CRS on port 9999):

msf6 auxiliary(scanner/http/wp_wordpress_batch_sqli) > set RPORT 9999
msf6 auxiliary(scanner/http/wp_wordpress_batch_sqli) > set WAF_BYPASS true
msf6 auxiliary(scanner/http/wp_wordpress_batch_sqli) > run

[*]   localhost — SQLi probe: fast=0.052s slow=3.047s delta=2.995s
[+] localhost — WP 6.9.0 — VULNERABLE (RCE, CVE-2026-63030) — SQLi CONFIRMED

Test Environment

Same Docker lab as the exploit module: https://github.com/M4xSec/wp2shell-lab