Vulhub Docker 复现环境

CVE: CVE-2026-63030, CVE-2026-60137

Add WordPress CVE-2026-63030 pre-auth RCE (wp2shell) environment (#791)

• Add WordPress CVE-2026-63030 pre-auth RCE (wp2shell) environment

Chains the REST API batch route confusion (CVE-2026-63030) with the

WP_Query author__not_in SQL injection (CVE-2026-60137) into an

unauthenticated RCE against WordPress 6.9.0-6.9.4 / 7.0.0-7.0.1.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

• Auto-install WordPress on first boot for the wp2shell lab

Wrap the upstream entrypoint so the environment installs WordPress

(admin/admin + default post) automatically once the database is ready,

removing the manual setup wizard. A dynamic-siteurl MU plugin serves

siteurl/home from the request host so the lab works on any IP or port.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

• Improve wp2shell vulnerability documentation
• Add reproduction screenshots and finalize the wp2shell PoC

Refocus poc.py on the unauthenticated administrator-creation primitive

(argparse CLI, --check mode, no login/plugin/command execution), disable

WordPress auto-updates so the lab stays on the vulnerable 6.9.4, and

document the result with screenshots of the PoC output and the

attacker-created administrator in the WordPress Users page.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

• Log in with the created account to verify wp2shell exploitation

Verify by logging in with the administrator credentials the PoC created,

so a successful login itself proves exploitation, instead of using the

default account.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

• Note admin-to-RCE escalation in wp2shell docs

Add a closing note that administrator access can be escalated to a

webshell and arbitrary command execution via plugin or theme upload.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

• Refine wp2shell reproduction docs to match Vulhub style

Rewrite the Vulnerability Reproduction section as an action-oriented

walkthrough that shows the real poc.py console output and drops the

mechanism re-explanation already covered in the introduction. Fix the

inaccurate --check example output so it matches what the script prints,

align the environments.toml name with the README title, and refresh the

reproduction screenshots.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

🚨 威胁评估

📌 来源: Vulhub | 🆔 CVE-2026-63030, CVE-2026-60137 | 📅 2026-07-18