arvindear/wp2shell-PoC

CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept

SecurityPython#cve-2026-60137#cve-2026-63030#wp2shell#wp2shell-exploit#wp2shell-poc

5.8 Early signal Magnitude out of 10. Star growth looks organic. Data as of September 18, 2026.

About the project

Proof-of-concept for the wp2shell vulnerability chain in WordPress Core (CVE-2026-63030 and CVE-2026-60137) that gives an unauthenticated attacker RCE. A tool for testing and exploitation in controlled environments and bug bounty.

Useful for

Check a target WordPress site for the vulnerability in check mode
Dump logins and password hashes from the database via SQL injection
Gain RCE on a vulnerable server without credentials

README summarized by DeepSeek V4.1 Flash. Details may be inaccurate.

Why it’s trending

77 stars so far today, about 88 expected by the end of the day.
The repository is 0 days old and already has 76 stars.
Top new repositories this week: #166.
About 225 forks a day — people are taking the code.

Stars per day

Bars are daily stars, the line is the usual pace. Red marks spike days.

Numbers

Total stars: 76
Stars in a day: 88
Forks: 28
Issues and pull requests: 0
Watchers: 6
Language: Python
Created: September 18, 2026
Last push: September 18, 2026

Star trust

Growth looks organic: forks and discussion are in line with active projects, and stars arrive unevenly, the way people give them.

These are heuristics, not a verdict: we judge by the repository’s behavior, not by a list of stargazers.

Spotted in

September 18, 2026Top new repositories this week: #166

README badge

Paste it into your README — the badge shows the current magnitude and links to this page.

[![Seismograph](https://gitnova.dev/badge/arvindear/wp2shell-PoC.svg?lang=en)](https://gitnova.dev/en/r/arvindear/wp2shell-PoC)

Similar projects

9.7
cloudflare/security-audit-skill
A coding-agent skill that turns the agent into a security auditor, running a multi-phase code audit with independently verified, machine-readable findings.

BreakoutSecurityJavaScript+2,412 stars in a day
6.6
yynxxxxx/gpt_sub_analysis
A guide to analyzing the ChatGPT iOS subscription flow: it describes intercepting the buyProduct request via Reqable and SSL Kill Switch 3 and rewriting the offerName and salableAdamId fields to obtain the Pro 20x…

Early signalSecurity+132 stars in a day
5.8
ctdal/cve-2026-41940-PoC
PoC exploit for CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0) that grants unauthenticated root-level WHM access by injecting CRLF sequences into server-side session files.

Early signalSecurityPython+46 stars in a day
5.3
BennyThink/NFCX
Cross-platform GUI desktop app for NFC card work: reader discovery, MIFARE Classic reads, dumps, key management, and key recovery. For cards you own or are authorized to test.

Early signalSecurityGo+28 stars in a day
4.9
NationalSecurityAgency/ghidra
A software reverse engineering framework from the NSA: disassembly, decompilation, graphing and scripting for analyzing compiled code on Windows, macOS and Linux.

BreakoutSecurityJava+243 stars in a day
4.6
shinthink/blitzstrike
A TypeScript/Bun MCP server packaging a pentest methodology into three tiers: attack-surface reconnaissance, source-to-sink tracing, and live validation of findings before reporting.

Early signalSecurityTypeScript+15 stars in a day