what is wp2shell-lab fr?

wp2shell-lab is a security research project built around two real vulnerabilities in WordPress core, tracked as CVE-2026-60137 and CVE-2026-63030. The first is a SQL injection bug that lets an unauthenticated attacker read the entire site database, including admin password hashes, without needing any plugin or misconfiguration. The second is a route confusion bug in WordPress's REST batch API that, when chained with the first, can lead to full remote code execution on a completely default, unpatched install. The affected versions are WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, and the issues are already fixed in 6.8.6, 6.9.5, and 7.0.2. The README is explicit that the purpose of this repository is defensive: to help site owners verify whether their own WordPress installation is patched, and to help researchers understand how the underlying bug works, not to provide a tool for attacking other people's sites. It credits the researchers who originally found and reported each part of the vulnerability chain. The project provides three things. A non-destructive detector checks whether a target WordPress site is running a vulnerable version without altering any data. A Docker Compose lab spins up a deliberately vulnerable WordPress and MySQL environment locally, along with a matching patched version, so the difference in behavior can be compared side by side. And a proof-of-concept script demonstrates the full chain against the local lab environment only, showing step by step how the database read bug can be escalated into administrator account creation and code execution. To use it, you need Docker with Docker Compose v2, Python 3.8 or newer using only its standard library, plus make and curl. Simple make commands bring the vulnerable environment up, run the safe detector check, gather read-only proof of the SQL injection, run the full exploit chain against the local lab, and rebuild against the patched WordPress version to confirm the check reports no vulnerability. The README does not state a license for the project.