Hacking WordPress with wp2shell Through a Critical SQLi to RCE

This lab is based on CVE-2026-63030. Exploit a real WordPress core vulnerability chain (which earned a 9.8 critical severity rating) against Trailhead Outfitters, a small marketing blog. Starting from zero access and no login, you will fingerprint the running version, confirm a pre authentication SQL injection by hand, and use that injection to read a secret straight out of the database (flag 1). From there you will run the full public exploit chain that escalates the injection into a forged administrator account and a working webshell, then read a second secret off the server's filesystem (flag 2). Finally you will remediate the vulnerability by applying the update and prove the attack no longer works. Because this is a genuine bug in WordPress core rather than a contrived scenario, every stage stays visible along the way, so you can watch the confused request, the injected query, the forged database rows, and the attacker's admin account.