Templated detector for wp2shell CVE-2026-63030

[alessandro-Doyensec]

Templated detector for wp2shell CVE-2026-63030.

Testbed at:

• Wp2shell CVE 2026 63030 security-testbeds#239

---

Notes:

• The detector doesn't exploit the full RCE chain to avoid state-changing requests (the PoCs published so far all exploit the SQL injection to create an admin account during the exploit chain).
• The presence and exploitability of both CVE-2026-63030 and CVE-2026-60137 are proven by exploiting the SQL injection: the detector makes the SQL server calculate a simple multiplication and expects the final product to be in the response body

[savio-doyensec]

LGTM.