# icex0/wp2shell-poc architecture

> Architecture diagram of the GitHub repository icex0/wp2shell-poc, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/icex0/wp2shell-poc
- Repository: https://github.com/icex0/wp2shell-poc

## Overview

wp2shell is a command-line proof of concept for detecting and exercising WordPress REST batch route-confusion SQL injection. The principal workflow starts with a target URL: `check` gathers passive WordPress/version signals and probes the batch endpoint; `read` selects a UNION, error-based, or blind SQLi extractor; and unauthenticated `shell` can bridge from UNION fake posts through oEmbed cache IDs and a poisoned batch to a generated administrator, then authenticate and upload a temporary plugin webshell. The graph reflects documented flows and sampled calls; exploit internals are only partly sampled.

Main entry points: [`wp2shell/cli.py`](https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/cli.py) (Command interface), [`wp2shell/client.py`](https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/client.py) (Batch transport), [`wp2shell/exploit.py`](https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/exploit.py) (Admin bridge), [`wp2shell/shell.py`](https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/shell.py) (Admin session)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_cli["CLI workflows"]
  node_cli["Command interface<br/>[cli.py]"]
  node_readresult["Extracted data"]
end

subgraph group_probe["Detection and SQLi"]
  node_version["WP fingerprints<br/>[version.py]"]
  node_batch["Batch transport<br/>[client.py]"]
  node_blind["Blind SQLi<br/>[sqli.py]"]
  node_error["Error SQLi<br/>[sqli.py]"]
  node_union["UNION SQLi<br/>[sqli.py]"]
end

subgraph group_bridge["Admin bridge"]
  node_creator["Admin bridge<br/>[exploit.py]"]
  node_fakeposts["Fake post render<br/>[exploit.py]"]
  node_cacheids["oEmbed cache IDs<br/>[exploit.py]"]
  node_poisoned["Poisoned batch<br/>[exploit.py]"]
  node_generated["Generated administrator<br/>[exploit.py]"]
end

subgraph group_execution["Authenticated execution"]
  node_session["Admin session<br/>[shell.py]"]
  node_plugin["Plugin webshell<br/>[shell.py]"]
  node_commands["Command output<br/>[shell.py]"]
end

node_operator(("Operator"))
node_wordpress["WordPress target"]

node_operator -->|"runs"| node_cli
node_cli -->|"checks markers"| node_version
node_cli -->|"probes batch"| node_batch
node_version -->|"fetches public data"| node_batch
node_batch -->|"sends HTTP"| node_wordpress
node_wordpress -->|"returns responses"| node_batch
node_cli -->|"confirms timing"| node_blind
node_cli -->|"tries extraction"| node_union
node_cli -->|"selects extractor"| node_error
node_blind -->|"sends probes"| node_batch
node_error -->|"sends payloads"| node_batch
node_union -->|"sends payloads"| node_batch
node_cli -->|"prints extraction"| node_readresult
node_cli -->|"starts bridge"| node_creator
node_creator -->|"extracts database values"| node_union
node_creator -->|"renders UNION posts"| node_fakeposts
node_fakeposts -->|"triggers oEmbed"| node_wordpress
node_creator -->|"recovers IDs via SQLi"| node_cacheids
node_creator -->|"builds request"| node_poisoned
node_poisoned -->|"submits batch"| node_wordpress
node_wordpress -->|"creates account"| node_generated
node_cli -->|"logs in"| node_session
node_generated -->|"supplies credentials"| node_session
node_session -->|"authenticates"| node_wordpress
node_session -->|"uploads plugin"| node_plugin
node_plugin -->|"executes commands"| node_wordpress
node_plugin -->|"returns output"| node_commands

click node_cli "https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/cli.py"
click node_version "https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/version.py"
click node_batch "https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/client.py"
click node_blind "https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/sqli.py"
click node_error "https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/sqli.py"
click node_union "https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/sqli.py"
click node_creator "https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/exploit.py"
click node_fakeposts "https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/exploit.py"
click node_cacheids "https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/exploit.py"
click node_poisoned "https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/exploit.py"
click node_generated "https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/exploit.py"
click node_session "https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/shell.py"
click node_plugin "https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/shell.py"
click node_commands "https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/shell.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_readresult toneBlue
class node_version,node_batch,node_blind,node_error,node_union toneAmber
class node_creator,node_fakeposts,node_cacheids,node_poisoned,node_generated toneMint
class node_session,node_plugin,node_commands toneRose
class node_operator,node_wordpress toneIndigo
```

## Components

### CLI workflows

- [Command interface](https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/cli.py): `wp2shell/cli.py`
- **Extracted data**

### Detection and SQLi

- [WP fingerprints](https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/version.py): `wp2shell/version.py`
- [Batch transport](https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/client.py): `wp2shell/client.py`
- [Blind SQLi](https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/sqli.py): `wp2shell/sqli.py`
- [Error SQLi](https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/sqli.py): `wp2shell/sqli.py`
- [UNION SQLi](https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/sqli.py): `wp2shell/sqli.py`

### Admin bridge

- [Admin bridge](https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/exploit.py): `wp2shell/exploit.py`
- [Fake post render](https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/exploit.py): `wp2shell/exploit.py`
- [oEmbed cache IDs](https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/exploit.py): `wp2shell/exploit.py`
- [Poisoned batch](https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/exploit.py): `wp2shell/exploit.py`
- [Generated administrator](https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/exploit.py): `wp2shell/exploit.py`

### Authenticated execution

- [Admin session](https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/shell.py): `wp2shell/shell.py`
- [Plugin webshell](https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/shell.py): `wp2shell/shell.py`
- [Command output](https://github.com/icex0/wp2shell-poc/blob/main/wp2shell/shell.py): `wp2shell/shell.py`

### Other components

- **Operator**
- **WordPress target**

## Connections

- Operator → Command interface: runs
- Command interface → WP fingerprints: checks markers
- Command interface → Batch transport: probes batch
- WP fingerprints → Batch transport: fetches public data
- Batch transport → WordPress target: sends HTTP
- WordPress target → Batch transport: returns responses
- Command interface → Blind SQLi: confirms timing
- Command interface → UNION SQLi: tries extraction
- Command interface → Error SQLi: selects extractor
- Blind SQLi → Batch transport: sends probes
- Error SQLi → Batch transport: sends payloads
- UNION SQLi → Batch transport: sends payloads
- Command interface → Extracted data: prints extraction
- Command interface → Admin bridge: starts bridge
- Admin bridge → UNION SQLi: extracts database values
- Admin bridge → Fake post render: renders UNION posts
- Fake post render → WordPress target: triggers oEmbed
- Admin bridge → oEmbed cache IDs: recovers IDs via SQLi
- Admin bridge → Poisoned batch: builds request
- Poisoned batch → WordPress target: submits batch
- WordPress target → Generated administrator: creates account
- Command interface → Admin session: logs in
- Generated administrator → Admin session: supplies credentials
- Admin session → WordPress target: authenticates
- Admin session → Plugin webshell: uploads plugin
- Plugin webshell → WordPress target: executes commands
- Plugin webshell → Command output: returns output