https://moza369.github.io/tags/sqli/Recent content in Sqli on MOZAHugoen-usSat, 18 Jul 2026 00:00:00 +0000https://moza369.github.io/writeups/rce-wordpress-unauthenticated/Sat, 18 Jul 2026 00:00:00 +0000https://moza369.github.io/writeups/rce-wordpress-unauthenticated/<h2 id="summary">Summary</h2> <table> <thead> <tr> <th>Detail</th> <th>Value</th> </tr> </thead> <tbody> <tr> <td><strong>Target</strong></td> <td>Mars (Royal Canin)</td> </tr> <tr> <td><strong>Weakness</strong></td> <td>Authentication Bypass → SQL Injection (CVE-2026-63030 / CVE-2026-60137)</td> </tr> <tr> <td><strong>Severity</strong></td> <td>Critical</td> </tr> <tr> <td><strong>Status</strong></td> <td>Resolved</td> </tr> <tr> <td><strong>Platform</strong></td> <td>HackerOne</td> </tr> </tbody> </table> <h2 id="the-story">The Story</h2> <p>I had Mars in my scope for a while. Subdomains were already enumerated, endpoints mapped — the usual recon groundwork that sits in your notes waiting for the right moment.</p> <p>That moment came when <strong>wp2shell dropped</strong>.</p> <p>A 0day targeting WordPress core — specifically a batch-route confusion flaw in <code>WP_REST_Server::serve_batch_request_v1()</code> combined with a SQL injection in the <code>WP_Query</code> class via the <code>author__not_in</code> parameter. An unauthenticated attacker could bypass authentication through the REST API batch endpoint and inject SQL queries directly into the database.</p>