https://vulnerability.circl.lu/sightings/feed 2026-08-11T23:29:45.261504+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/a81be97a-27dd-4517-956d-14da883786bc/export 2026-08-11T23:29:45.291478+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "a81be97a-27dd-4517-956d-14da883786bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63030", "type": "published-proof-of-concept", "source": "https://t.me/ZeroEthical_Channel/2137", "content": "CVE-2026-63030 - WordPress Core Pre-Auth RCE Mass Exploit", "creation_timestamp": "2026-08-11T00:00:08.778640Z"} 2026-08-11T00:00:08.778640+00:00 https://vulnerability.circl.lu/sighting/f209ab9e-ffef-4d6d-86e0-33c1cf962bd8/export 2026-08-11T23:29:45.294182+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "f209ab9e-ffef-4d6d-86e0-33c1cf962bd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63030", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97494", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a g0d150ne\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-10 21:08:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWP2Shell is a powerful and modular exploit framework that combines two critical WordPress vulnerabilities (CVE-2026-63030 and CVE-2026-60137) to achieve complete compromise of a target site without any credentials. \n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-11T00:00:06.604884Z"} 2026-08-11T00:00:06.604884+00:00 https://vulnerability.circl.lu/sighting/485456d7-4b74-472d-9f51-c586a5b7924a/export 2026-08-11T23:29:45.294345+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "485456d7-4b74-472d-9f51-c586a5b7924a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63030", "type": "seen", "source": "https://t.me/GithubRedTeam/97494", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a g0d150ne\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-10 21:08:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWP2Shell is a powerful and modular exploit framework that combines two critical WordPress vulnerabilities (CVE-2026-63030 and CVE-2026-60137) to achieve complete compromise of a target site without any credentials. \n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-10T23:00:03.272251Z"} 2026-08-10T23:00:03.272251+00:00 https://vulnerability.circl.lu/sighting/e8f9c738-bd72-4635-ae2f-96a68fb9efb2/export 2026-08-11T23:29:45.294464+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "e8f9c738-bd72-4635-ae2f-96a68fb9efb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63030", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_batch_desync_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"Adam Kues\", \"TF1T\", \"dtro\", \"haongo\", \"Crypto-Cat\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module chains two WordPress core vulnerabilities, together known as\\n WP2Shell, to gain unauthenticated remote code execution against default\\n installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1.\\n The vulnerabilities are fixed in WordPress 6.9.5 and 7.0.2.\\n\\n CVE-2026-60137 is an SQL injection in WP_Query's author__not_in parameter, and\\n CVE-2026-63030 is a REST API batch endpoint route-confusion bug that lets an\\n unauthenticated request reach that injection.\\n\\n The module uses the injection to read the database table prefix and the\\n administrator user ID, poisons WordPress' object cache to publish a crafted\\n customizer changeset, and re-enters the REST API with administrator privileges\\n to create a new administrator account. It then logs in as that account, uploads\\n a plugin containing a Metasploit payload, and executes it for a session. Once a\\n session is obtained the uploaded plugin is removed, and the created administrator\\n account is removed as well unless KeepAdmin is set.\", \"disclosure_date\": \"2026-07-17\", \"fullname\": \"exploit/multi/http/wp_batch_desync_rce\", \"is_install_path\": true, \"mod_time\": \"2026-08-06 12:35:36 +0000\", \"name\": \"WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/wp_batch_desync_rce.rb\", \"platform\": \"Linux,PHP,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/wp_batch_desync_rce\", \"references\": [\"CVE-2026-63030\", \"CVE-2026-60137\", \"URL-https://wordpress.org/news/2026/07/wordpress-7-0-2-release/\", \"URL-https://slcyber.io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6/\", \"URL-https://github.com/Crypto-Cat/wp2shell\", \"URL-https://wp2shell.com/\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"PHP In-Memory\", \"Unix/Linux Command Shell\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-08-10T10:02:08.994848Z"} 2026-08-10T10:02:08.994848+00:00 https://vulnerability.circl.lu/sighting/c577b3e6-0520-49b6-949a-f40d84af9bb0/export 2026-08-11T23:29:45.294612+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "c577b3e6-0520-49b6-949a-f40d84af9bb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63030", "type": "published-proof-of-concept", "source": "https://t.me/ZeroEthical_Channel/2137", "content": "CVE-2026-63030 - WordPress Core Pre-Auth RCE Mass Exploit", "creation_timestamp": "2026-08-10T05:00:04.827398Z"} 2026-08-10T05:00:04.827398+00:00 https://vulnerability.circl.lu/sighting/314fa02e-a3b1-492f-9dac-c00dad3871f9/export 2026-08-11T23:29:45.294729+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "314fa02e-a3b1-492f-9dac-c00dad3871f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63030", "type": "seen", "source": "Telegram/JSM4bX24RCI5XRf3zVUpH_KkSALcdaLmObr3UaL_pJ9bebrl", "content": "", "creation_timestamp": "2026-08-10T00:00:12.588845Z"} 2026-08-10T00:00:12.588845+00:00 https://vulnerability.circl.lu/sighting/4c6c9806-e543-401e-b381-575d773a6a44/export 2026-08-11T23:29:45.294836+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "4c6c9806-e543-401e-b381-575d773a6a44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63030", "type": "published-proof-of-concept", "source": "Telegram/_vir8PHcFXMNY3qmJBX6iWTyJzWWGg928tieDwqp2_1Bjyo", "content": "", "creation_timestamp": "2026-08-10T00:00:09.439364Z"} 2026-08-10T00:00:09.439364+00:00 https://vulnerability.circl.lu/sighting/90a4c149-d127-425a-82f5-f1185ec4cb38/export 2026-08-11T23:29:45.294935+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "90a4c149-d127-425a-82f5-f1185ec4cb38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63030", "type": "seen", "source": "Telegram/JSM4bX24RCI5XRf3zVUpH_KkSALcdaLmObr3UaL_pJ9bebrl", "content": "", "creation_timestamp": "2026-08-09T09:01:25.145927Z"} 2026-08-09T09:01:25.145927+00:00 https://vulnerability.circl.lu/sighting/31e7626b-fab1-47c2-a7f5-14f7b56df847/export 2026-08-11T23:29:45.295036+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "31e7626b-fab1-47c2-a7f5-14f7b56df847", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63030", "type": "seen", "source": "Telegram/_vir8PHcFXMNY3qmJBX6iWTyJzWWGg928tieDwqp2_1Bjyo", "content": "", "creation_timestamp": "2026-08-09T05:11:07.834202Z"} 2026-08-09T05:11:07.834202+00:00 https://vulnerability.circl.lu/sighting/558f3431-5003-4129-8f93-4476649ebffb/export 2026-08-11T23:29:45.295140+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "558f3431-5003-4129-8f93-4476649ebffb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63030", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97204", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-Exploit-Waf-Bypass\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a M4xSec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 1 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 17:41:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress Pre-Auth RCE Exploit + Scanner + WAF Bypass | CVE-2026-63030 + CVE-2026-60137 | Go + Python + Metasploit modules + Docker lab\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-09T00:44:32.795823Z"} 2026-08-09T00:44:32.795823+00:00