{"vulnerability": "CVE-2026-60137", "sightings": [{"uuid": "ab4a0317-cdfb-4c8f-95d9-afcf0fd4b891", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqulbqes2k2a", "content": "CVE-2026-60137 - wordpress\nAn outdated version of WordPress allows hackers to inject malicious SQL code, potentially stealing sensitive data or taking control of the website. This is particularly concerning if you\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#wordpress #CVE #infosec", "creation_timestamp": "2026-07-17T20:22:05.954349Z"}, {"uuid": "93d7c8a8-ff61-491d-8abb-f8a79bbbcf39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mquqd5kxgq2i", "content": "CVE-2026-60137 - WordPress\nCVE ID : CVE-2026-60137\n \n Published : July 17, 2026, 8:17 p.m. | 17\u00a0minutes ago\n \n Description : WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which coul...", "creation_timestamp": "2026-07-17T21:52:22.244868Z"}, {"uuid": "f5b1c907-b1bd-45b3-a07d-8d646a19a18a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mqursxmdqy2o", "content": "The watchTowr team is rapidly reacting to the Remote Code Execution vulnerability chain (CVE-2026-63030 and CVE-2026-60137) in WordPress Core across our client-base, a just-disclosed flaw in the REST API batch dispat\u2026\n\n\u2014 from @watchtowrcyber (https://x.com/watchtowrcyber/status/2078238662827917416)", "creation_timestamp": "2026-07-17T22:19:07.251702Z"}, {"uuid": "c1eba3cf-60ed-4eff-8cdb-602fb94817c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/GithubRedTeam/93917", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wordpress-cve-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Senanfurkan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 00:44:24\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth RCE in WordPress Core via REST API batch route confusion + WP_Query SQLi (CVE-2026-63030 / CVE-2026-60137). Detection PoC.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-18T02:00:04.194638Z"}, {"uuid": "d54c7775-9f25-41d2-b6bc-415c72e74bf6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/pingoru.bsky.social/post/3mqv5lssche27", "content": "\ud83d\udd34 Nexcess is reporting a Major Outage since 01:44 UTC\n\n\"WP2Shell Wordpress Core Critical Remote Code Execution Vulnerabilities, CVE-2026-60137 and\u2026\"\n\nAffects: Wordpress Core Updates\n\nLive timeline \u2192 https://pingoru.io/providers/nexcess/incidents/6534738\n\n#Nexcess #NexcessDown", "creation_timestamp": "2026-07-18T01:49:51.933679Z"}, {"uuid": "33803ae3-a89c-4295-8e1c-c939fafca002", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/pingoru.bsky.social/post/3mqv5sy6vwi2n", "content": "\ud83d\udd34 Liquid Web is reporting a Major Outage since 01:48 UTC\n\n\"WP2Shell Wordpress Core Critical Remote Code Execution Vulnerabilities, CVE-2026-60137 and CVE-2026-63030\"\n\nLive timeline \u2192 https://pingoru.io/providers/liquid-web/incidents/6534739\n\n#LiquidWeb #LiquidWebDown", "creation_timestamp": "2026-07-18T01:53:52.155389Z"}, {"uuid": "a0c619bd-b994-46c0-96f9-ee949161d3a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93933", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 47Cid\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 03:53:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nEducational PoC + lab for CVE-2026-63030 + CVE-2026-60137: pre-auth SQLi in WordPress core via REST batch-route confusion\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-18T06:00:04.982155Z"}, {"uuid": "901ee37b-d5cb-4f9c-b046-21e92f2934a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/lalgorisme.bsky.social/post/3mqvlxtsavk2d", "content": "\ud83d\udea8 wp2shell: RCE cr\u00edtic al nucli de WordPress, no en cap plugin. Una petici\u00f3 an\u00f2nima pot desembocar en execuci\u00f3 de codi al servidor. \nAfecta: 6.9.0\u20136.9.4 i 7.0.0\u20137.0.1. \nEs soluciona amb les versions: 7.0.2/6.9.5/6.8.6. \nCVE-2026-63030 i CVE-2026-60137.\nclaude.ai/public/artif...", "creation_timestamp": "2026-07-18T06:07:26.275197Z"}, {"uuid": "4372541d-aca3-4209-9e01-b792fe1cefe5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://infosec.exchange/ap/users/116810780845358081/statuses/116939389643192070", "content": "\ud83d\udea8 CRITICAL: WordPress Core \"wp2shell\" RCE\nA single anonymous HTTP request can lead to Remote Code Execution on vulnerable WordPress Core installations.\n\u26a0\ufe0f No plugins.\u26a0\ufe0f No themes.\u26a0\ufe0f No authentication required.\nTracked as:\ud83d\udd34 CVE-2026-63030 (REST API Batch Route Confusion \u2192 RCE)\ud83d\udd34 CVE-2026-60137 (Facilitated SQL Injection)\nAffected versions\u2022 WordPress 6.9.0\u20136.9.4\u2022 WordPress 7.0.0\u20137.0.1\n\u2705 Update immediately to WordPress 6.9.5 or 7.0.2. Due to the severity, WordPress has enabled forced automatic security updates for affected installations.\n\ud83d\udd17 Full technical analysis:https://thecybersecguru.com/news/wordpress-core-rce-wp2shell/\n#WordPress #WordPressSecurity #wp2shell #CVE202663030 #CVE202660137 #RCE #RemoteCodeExecution #SQLInjection #RESTAPI #CyberSecurity #InfoSec #WebSecurity #WebsiteSecurity #PatchNow #ThreatIntelligence #BlueTeam #SOC #Linux #PHP #ZeroDay #SecurityResearch #SysAdmin #DevSecOps", "creation_timestamp": "2026-07-18T06:11:07.796792Z"}, {"uuid": "e6b48bd9-c876-4627-9315-c1fd6ecaae7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/365tipu.cz/post/3mqvmoh65uq2w", "content": "Pokud jste je\u0161t\u011b nektualizovali WordPress tak zbyst\u0159ee, jsou tam dv\u011b z\u00e1va\u017en\u00e9 chyby p\u0159\u00edmo v j\u00e1d\u0159e. CVE-2026-60137: SQL injection a CVE-2026-63030: Unauthenticated remote code execution.", "creation_timestamp": "2026-07-18T06:19:46.717219Z"}, {"uuid": "e20af41e-4141-49fe-b328-a593b904cf35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/javiercasares.com/post/3mqvn6wa3bs23", "content": "#WordPress #Seguridad\nSi usas WordPress 6.9, 6.9 o 7.0, actualiza a las \u00faltimas versiones disponibles. Hay unos parches de seguridad que corrigen 2 elementos cr\u00edticos (RCE / SQLi).\n- CVE-2026-60137: corrigen: 6.8.6 - 6.9.5 - 7.0.2\n- CVE-2026-63030: corrigen: 6.9.5 - 7.0.2", "creation_timestamp": "2026-07-18T06:28:59.354212Z"}, {"uuid": "1cdc74f2-12ca-41d4-bc8a-398569b35b36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/securestep9.bsky.social/post/3mqvs5q5aac2z", "content": "#Wordpress: Critical Remote Code Execution (#RCE) chain of vulnerabilities CVE-2026-63030 and #SQLi SQL Injection CVE-2026-60137 dubbed #wp2shell in WordPress Core threaten 500+ million of websites. \nPatch now!:\n\ud83d\udc47\nthehackernews.com/2026/07/new-...", "creation_timestamp": "2026-07-18T07:57:46.344998Z"}, {"uuid": "8ba913e8-0720-4397-a254-54cb6664d1ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/thehackernews/9544", "content": "\u26a1 UPDATE: #wp2shell now has two CVEs, and a working proof-of-concept is public.\n\n> CVE-2026-63030 breaks REST batch routing\n> CVE-2026-60137 injects SQL\n\nChained, they give an anonymous attacker code execution on affected WordPress sites.\n\nHow the exploit path works: https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "creation_timestamp": "2026-07-18T08:00:04.021980Z"}, {"uuid": "91b90be2-1487-4da9-a1bd-119d8982305f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mqvtts4tm22m", "content": "\ud83e\udd16 CVE-2026-63030 / CVE-2026-60137: SQL injection in WP REST API batch endpoint allows unauthenticated RCE on all 6.9/7.0 sites. PoC published.\nhttps://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "creation_timestamp": "2026-07-18T08:28:01.624087Z"}, {"uuid": "f8695508-e1f4-4b71-8e33-aa98b4ab0372", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://infosec.exchange/users/tomcat/statuses/116940092329234240", "content": "\u26a1 UPDATE: #wp2shell now has two CVEs, and a working proof-of-concept is public.\n> CVE-2026-63030 breaks REST batch routing> CVE-2026-60137 injects SQL\nChained, they give an anonymous attacker code execution on affected WordPress sites.\nHow the exploit path works: https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "creation_timestamp": "2026-07-18T08:43:23.355743Z"}, {"uuid": "6b13234a-bd06-485c-90a1-a4c6e5e8f99e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93958", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a NULL200OK\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 07:52:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWP2Shell - CVE-2026-63030 / CVE-2026-60137 This tool exploits a critical SQL injection vulnerability in the WordPress REST API `/wp-json/batch/v1` endpoint, allowing unauthenticated attackers to execute arbitrary SQL queries and achieve Remote Code Execution (RCE) on vulnerable WordPress installations.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-18T09:00:04.366182Z"}, {"uuid": "12bcc2ef-749a-4bdd-b00a-271689b7f2b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93950", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ekomsSavior\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 06:55:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 (RCE) + CVE-2026-60137 (SQLi)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-18T09:00:04.452260Z"}, {"uuid": "42777219-dc50-4728-a7d3-fe43ffd2dba4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://infosec.exchange/users/obivan/statuses/116940574604966863", "content": "wp2shell (CVE-2026-63030 + CVE-2026-60137): Independent Root Cause Analysis https://github.com/tcyph3r/wp2shell-cve-2026-63030-root-cause", "creation_timestamp": "2026-07-18T10:46:01.244626Z"}, {"uuid": "931724e0-84c1-47ee-a4eb-209d6a3bed32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mqw3knqcm7b2", "content": "wp2shell (CVE-2026-63030 + CVE-2026-60137): Independent Root Cause Analysis https://github.com/tcyph3r/wp2shell-cve-2026-63030-root-cause", "creation_timestamp": "2026-07-18T10:46:10.175485Z"}, {"uuid": "59e7bd5e-ec95-428c-bedf-90ce4898a0d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93979", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kulichr\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 10:08:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-intrusive checker for CVE-2026-63030 / CVE-2026-60137 (\"wp2shell\"), a pre-authentication RCE chain in WordPress core.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-18T12:00:03.634188Z"}, {"uuid": "4683a5b8-c0b9-4558-bfb0-301e91605d9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3mqweh3yqa42q", "content": "#\ud83d\udd16\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\nWordPress\u306e\u6df1\u523b\u5ea6\u300c\u7dca\u6025\u300d\u8106\u5f31\u6027 wp2shell \u306e\u6982\u8981\u3068\u5bfe\u5fdc\u6307\u91dd - GMO Flatt Security Blog\n\n2026\u5e747\u670817\u65e5\u3001\u8a8d\u8a3c\u4e0d\u8981\u3067\u30ea\u30e2\u30fc\u30c8\u304b\u3089\u306e\u4efb\u610f\u30b3\u30fc\u30c9\u5b9f\u884c\uff08RCE\uff09\u306b\u3064\u306a\u304c\u308b\u8106\u5f31\u6027\u300cCVE-2026-63030\u300d\u300cCVE-2026-60137\u300d\u3092\u4fee\u6b63\u3057\u305fWordPress 6.8.6\u30016.9.5\u3001\u304a\u3088\u3073 7.0.2 \u304c\u516c\u958b\u3055\u308c\u307e\u3057\u305f\uff08\u53c2\u8003\uff1aWordPress 7.0.2 Release\uff09\u3002 \u5f0a\u793e GMO Flatt Security \u30ea\u30b5\u30fc\u30c1\u30c1\u30fc\u30e0\u306e\u691c\u8a3c\u3067\u306f\u3001\u8106\u5f31\u306a\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u306f\u6a19\u6e96\u69cb\u6210\u3067\u3082\u3001\u7ba1...", "creation_timestamp": "2026-07-18T13:25:10.233202Z"}, {"uuid": "5c003ea9-c9ec-4767-bf1b-c8c3071863b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/ifin-intel.org/post/3mqweklzf2c2d", "content": "This now has two related CVEs: CVE-2026-63030 and CVE-2026-60137.", "creation_timestamp": "2026-07-18T13:27:07.339339Z"}, {"uuid": "7a288037-eb02-40b1-aa0e-9b9ef01e8119", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/pentest-tools.com/post/3mqwffjjxf22o", "content": "#WordPress admins - we got you covered! \ud83e\udee1 \u2192 We've just shipped detection for #wp2shell through our Network Scanner. \u26a1\ufe0f The fastest way to use it is to:\n\n\u25c9 run a single-CVE scan for CVE-2026-63030 (also covers CVE-2026-60137 - the SQLi flaw that chains & leads to RCE)\n\u25c9 Based on your scan results...", "creation_timestamp": "2026-07-18T13:42:16.124343Z"}, {"uuid": "efa92fde-e8ee-41eb-a3cf-e8b528bfd4fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/pentest-tools.com/post/3mqwffnk6vk2o", "content": "#WordPress admins - we got you covered! \ud83e\udee1 \u2192 We've just shipped detection for #wp2shell through our Network Scanner. \u26a1\ufe0f The fastest way to use it is to:\n\n\u25c9 run a single-CVE scan for CVE-2026-63030 (also covers CVE-2026-60137 - the SQLi flaw that chains & leads to RCE)\n\u25c9 Based on your scan results...", "creation_timestamp": "2026-07-18T13:42:16.609570Z"}, {"uuid": "9f3231c3-a373-4e7d-8152-ca3ce95921a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mqwgkaiooz2c", "content": "\ud83d\udea8 VULN: WordPress core 'wp2shell' \u2014 CVE-2026-63030 (REST API batch-route confusion) chained with CVE-2026-60137 (SQLi) gives unauthenticated RCE on a bare install. Fixed in 6.9.5/7.0.2 (forced auto-update); 6.8.x SQLi fixed in 6.8.6. Public PoC live. Src: The Hacker News", "creation_timestamp": "2026-07-18T14:02:42.231810Z"}, {"uuid": "1b124a01-3e96-42f8-ab18-3467b8acf8d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mqwkbej5mv22", "content": "WordPress\u306b\u65b0\u305f\u306a\u9ad8\u6df1\u523b\u5ea6\u8106\u5f31\u60272\u4ef6\u3001\u76f4\u3061\u306b\u30d1\u30c3\u30c1\u9069\u7528\u3092!\n\n7.0.2\u7248\u306eWordPress\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30ea\u30fc\u30b9\u3067\u306f\u3001\u6df1\u523b\u5ea6\u30af\u30ea\u30c6\u30a3\u30ab\u30eb1\u4ef6\u3068\u9ad8\u6df1\u523b\u5ea61\u4ef6\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u554f\u984c\u304c\u4fee\u6b63\u3055\u308c\u307e\u3057\u305f\u3002 WordPress\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30fc\u30e0\u306b\u5831\u544a\u3055\u308c\u305f\u8106\u5f31\u6027\u306f\u4ee5\u4e0b\u306e\u901a\u308a\u3067\u3059\u3002 CVE-2026-60137 \u2013 TF1T\u3001dtro\u3001haongo\u306e\u30c1\u30fc\u30e0\u306b\u3088\u3063\u3066\u5831\u544a\u3055\u308c\u305f...", "creation_timestamp": "2026-07-18T15:09:19.459912Z"}, {"uuid": "3705f691-7607-464b-98b2-b157df170785", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mqwkcegsyy2c", "content": "It's Friday, so of course we can't have nice things! \n\nInitial technical analysis of #wp2shell CVE-2026-63030 and CVE-2026-60137 from the \n@VulnCheckAI\n research team \u2014 so far, it could be worse (but it's still\u2026\n\n\ud83d\udd01 RT @catc0n | reposted by @HackingLZ\nhttps://x.com/catc0n/status/2078306495817453717", "creation_timestamp": "2026-07-18T15:09:53.900661Z"}, {"uuid": "b31e7667-596d-4aaf-a201-a83b43fe89d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwovkrqbv2j", "content": "CVE-2026-60137: Two Critical WordPress Vulnerabilities Demand Immediate Action #WordPress #CVE2026 #CyberSecurity", "creation_timestamp": "2026-07-18T16:32:12.481351Z"}, {"uuid": "f97f0345-0093-4207-aa16-79fd04cce3ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mqwmgleo3s2y", "content": "\ud83d\udea8 wp2shell affects multiple vulnerabilities (CVE-2026-63030, CVE-2026-60137)\n\nRunning WordPress? Check your versions and patch to 6.8.6/6.9.5/7.0.2. If you can't patch immediately, apply the mitigations in the meantime.\n\n\u2139\ufe0f secdb.nttzen.cloud/updates/a5a5...\n\n#infosec #wordpress #rce #sqlinjection", "creation_timestamp": "2026-07-18T15:48:05.376012Z"}, {"uuid": "ded0e68b-baad-4ca3-849b-47f629733c6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://www.acn.gov.it/portale/w/wordpress-poc-pubblico-per-lo-sfruttamento-delle-cve-2026-60137-e-cve-2026-63030", "content": "Disponibile Proof of Concept (PoC) per le vulnerabilit\u00e0 identificate dalle CVE-2026-60137 e CVE-2026-63030, gi\u00e0 sanate dal vendor, che interessa il prodotto WordPress Core.", "creation_timestamp": "2026-07-18T16:00:49.441683Z"}, {"uuid": "2798043a-6de6-4fce-ac74-273edca626b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://bsky.app/profile/davidgerard.circumstances.run.ap.brid.gy/post/3mqwo4mfczkf2", "content": "Update your WordPress to 7.0.2/6.9.5, it's important\n\nhttps://discourse.ifin.network/t/cve-2026-63030-and-cve-2026-60137-wp2shell-pre-auth-rce-in-wordpress-eitw/672/2", "creation_timestamp": "2026-07-18T16:18:20.800955Z"}, {"uuid": "47d8ffdb-a210-4f73-b0ae-4dab6cfbd1dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwoxeobuo2j", "content": "CVE-2026-60137: WordPress Vulnerabilities Demand Immediate Patching #WordPress #CVE2026 #Cybersecurity", "creation_timestamp": "2026-07-18T16:33:13.486182Z"}, {"uuid": "45ed2e8f-5d55-46b2-a79c-2009021753a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwoxglrkd25", "content": "CVE-2026-60137: WordPress Vulnerabilities Demand Immediate Action Amid Confusion #WordPress #CVE2026 #CyberSecurity", "creation_timestamp": "2026-07-18T16:33:15.079471Z"}, {"uuid": "9291c5eb-bc30-40c7-855a-dfc544893094", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwoxiaae62j", "content": "CVE-2026-60137: WordPress Vulnerabilities Reveal Serious Patch Gaps #CVE2026 #WordPress #CyberSecurity", "creation_timestamp": "2026-07-18T16:33:16.931905Z"}, {"uuid": "b44c9c6a-20c7-4663-9132-9adaaebd69d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwoxjwxgn2y", "content": "CVE-2026-60137: WordPress Vulnerabilities Demand Patching, But What\u2019s the Evidence? #WordPress #CyberSecurity #Vulnerabilities", "creation_timestamp": "2026-07-18T16:33:19.514922Z"}, {"uuid": "0732a507-e14c-4f2a-9bde-93618c3be651", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqwoxli4kv2u", "content": "CVE-2026-60137: Immediate Patches or a Misguided Response? #CVE202660137 #WordPressSecurity #Cybersecurity", "creation_timestamp": "2026-07-18T16:33:20.475464Z"}, {"uuid": "456e8f4d-3893-449d-a64e-97310f3525db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116942018680723716", "content": "Attention, elevated activities detected targeting WordPress (CVE-2026-60137) https://vuldb.com/vuln/379928/cti", "creation_timestamp": "2026-07-18T16:53:15.975571Z"}, {"uuid": "b6c6c2eb-0b06-4c09-90a5-2f6ac11eeb2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94005", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xsha\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 14:29:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 + CVE-2026-60137 - \u201cwp2shell\u201d: unauthenticated RCE in WordPress core\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-18T17:00:05.115796Z"}, {"uuid": "b9fe8ece-fbbb-409a-a2e9-fb4059055529", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94017", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a h4cd0c\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 16:41:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell \u2014 Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on WP 6.9.0\u20136.9.4 / 7.0.0\u20137.0.1.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-18T18:00:04.537963Z"}, {"uuid": "aa2b781f-b6db-4c42-a15c-9da733a2daf7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mqwttcd5pq2a", "content": "Public exploits for WordPress Core wp2shell flaws now enable pre-auth RCE on 6.9.x and 7.0.x. Tracked as CVE-2026-63030 and CVE-2026-60137. WordPress has pushed security updates. #WordPress #RCE #CVE2026", "creation_timestamp": "2026-07-18T18:00:25.538988Z"}, {"uuid": "8314ddf9-92f7-40fb-b659-674355a1b026", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116942282990851209", "content": "WordPress Core \"wp2shell\" CRITICAL RCE chain (CVE-2026-63030 & CVE-2026-60137) actively exploited. Affects 6.9.0 \u2013 6.9.4 & 7.0.0 \u2013 7.0.1. Public PoCs out. Patch to 6.9.5/7.0.2 ASAP. Block REST API endpoints as temp mitigation. https://radar.offseq.com/threat/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now-99579d9a7c571599 #OffSeq #WordPress #RCE #Vuln", "creation_timestamp": "2026-07-18T18:00:29.454515Z"}, {"uuid": "f4ee5b99-9a51-4595-b192-ec65ef9aff97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mqwvxjrszp24", "content": "\ud83e\udd16 WordPress Core \"wp2shell\" RCE (CVE-2026-63030, CVE-2026-60137): public exploits released for critical unauthenticated RCE. Patch immediately.\n\nhttps://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/", "creation_timestamp": "2026-07-18T18:38:34.436346Z"}, {"uuid": "752737bd-11bf-42d0-8f62-2cbb85a9b552", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/393", "content": "WordPress Core \"wp2shell\" RCE\n\nThe attack consists of two flaws, tracked as CVE-2026-63030 and CVE-2026-60137, that can be chained together to achieve pre-authentication remote code execution against WordPress installs running versions 6.9.x and 7.0.x.", "creation_timestamp": "2026-07-18T19:00:04.561700Z"}, {"uuid": "b31afaa7-044e-48f3-bfff-857f28426e6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityIL/86094", "content": "\ud83c\udf10\u05e9\u05d9\u05de\u05d5 \u05dc\u05d1 \u05dc\u05e9\u05ea\u05d9 \u05e4\u05d2\u05d9\u05e2\u05d5\u05d9\u05d5\u05ea \u05d1\u05e4\u05dc\u05d8\u05e4\u05d5\u05e8\u05de\u05ea Wordpress \u05d4\u05de\u05d0\u05e4\u05e9\u05e8\u05d5\u05ea (\u05d9\u05d7\u05d3) \u05d4\u05e8\u05e6\u05ea \u05e7\u05d5\u05d3 \u05de\u05e8\u05d7\u05d5\u05e7.\n\n\u05d4\u05d7\u05d5\u05dc\u05e9\u05d5\u05ea CVE-2026-60137 \u05d5-CVE-2026-63030 \u05db\u05d5\u05dc\u05dc\u05d5\u05ea \u05db\u05d1\u05e8 POC \u05e2\u05d5\u05d1\u05d3 \u05e9\u05e4\u05d5\u05e8\u05e1\u05dd \u05d1\u05e8\u05e9\u05ea, \u05e7\u05d9\u05d1\u05dc\u05d5 \u05d0\u05ea \u05d4\u05db\u05d9\u05e0\u05d5\u05d9 wp2shell, \u05d5\u05d4\u05df \u05e4\u05d5\u05e6'\u05e4\u05e6'\u05d5 \u05d1\u05d2\u05e8\u05e1\u05d0\u05d5\u05ea 6.9.5 \u05d5-7.0.2.\n\nhttps://t.me/CyberSecurityIL/9229", "creation_timestamp": "2026-07-18T19:00:04.608960Z"}, {"uuid": "55766d6b-261e-4431-a6fb-d717cc3f2e75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94025", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xWhoknows\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 17:33:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAutomated exploit chain for CVE-2026-63030 / CVE-2026-60137 \u2014 unauthenticated blind SQLi via WordPress REST batch route-confusion. Dumps user hashes, cracks credentials, deploys webshell. Supports single target and bulk site lists. For authorized security testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-18T20:00:03.954758Z"}, {"uuid": "56104ddf-3d88-4865-81fd-a323951c23b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/GithubRedTeam/94024", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell_scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a zi3lak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 17:56:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-intrusive detection scanner for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030 + CVE-2026-60137). Detection-only, no exploitation.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-18T20:00:04.036169Z"}, {"uuid": "3742d0a3-6504-40b1-8cfb-698777b83913", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94031", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a yoerivegt\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 19:02:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell (CVE-2026-60137 / CVE-2026-63030)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-18T20:00:04.140703Z"}, {"uuid": "39cb4a5d-a5e1-4b99-b1ac-face87473bf7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/GithubRedTeam/94036", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WordPresShell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a securelayer7\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 19:57:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth RCE PoC for CVE-2026-63030 / CVE-2026-60137 (WordPress core)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-18T21:00:03.761225Z"}, {"uuid": "a07b8918-7dcb-41cd-b9b9-461a2148dce2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mqx5yezwym2e", "content": "\ud83d\udee1\ufe0f RECAP: WordPress 'wp2shell' \u2014 CVE-2026-63030 chained with CVE-2026-60137 gave unauthenticated RCE on a bare install. Emergency patch shipped (6.9.5/7.0.2 forced auto-update). Public PoC live. Src: The Hacker News", "creation_timestamp": "2026-07-18T21:02:12.745094Z"}, {"uuid": "b9b9e303-fc1e-4caf-a2ff-e703ab0f6859", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/116943287112997869", "content": "I didn't confirm it, but there's apparently a public exploit for wp2shell (CVE-2026-60137 and CVE-2026-63030)https://warez.sl0p.foo/wp2shell-fast/", "creation_timestamp": "2026-07-18T22:15:51.668418Z"}, {"uuid": "825bb649-e4da-47d1-af8d-84afe808ac80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3mqxc4625swq2", "content": "I didn't confirm it, but there's apparently a public exploit for wp2shell (CVE-2026-60137 and CVE-2026-63030)\nhttps://warez.sl0p.foo/wp2shell-fast/", "creation_timestamp": "2026-07-18T22:15:56.360830Z"}, {"uuid": "1d8626b8-379c-48d7-856e-d3b1ed4f0fc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94049", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a JohenLastGen-JLG\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 21:39:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell - WordPress RCE & PoC (CVE-2026-63030 + CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-18T23:00:03.226943Z"}, {"uuid": "e46562b8-a155-4f1e-a28d-b1d7f7c3361f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/GithubRedTeam/94051", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-detect\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a own2pwn-fr\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 21:36:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nBlackbox, non-intrusive detector for wp2shell (WordPress core pre-auth RCE, CVE-2026-63030 / CVE-2026-60137). Detection only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-18T23:00:03.445776Z"}, {"uuid": "116a2a0a-bb13-4b96-a65d-56e6d64c0211", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94049", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a JohenLastGen-JLG\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 21:39:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell - WordPress RCE & PoC (CVE-2026-63030 + CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T00:00:08.662852Z"}, {"uuid": "0596045f-a391-44c9-88ae-bc2bce30e479", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/GithubRedTeam/94051", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-detect\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a own2pwn-fr\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 21:36:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nBlackbox, non-intrusive detector for wp2shell (WordPress core pre-auth RCE, CVE-2026-63030 / CVE-2026-60137). Detection only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T00:00:08.985449Z"}, {"uuid": "e561bd83-e6f2-489c-a226-3b680ea573f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94036", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WordPresShell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a securelayer7\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 19:57:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth RCE PoC for CVE-2026-63030 / CVE-2026-60137 (WordPress core)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T00:00:09.245925Z"}, {"uuid": "c757a909-0dea-4042-a48f-871c82dc9269", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94025", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xWhoknows\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 17:33:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAutomated exploit chain for CVE-2026-63030 / CVE-2026-60137 \u2014 unauthenticated blind SQLi via WordPress REST batch route-confusion. Dumps user hashes, cracks credentials, deploys webshell. Supports single target and bulk site lists. For authorized security testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T00:00:09.431792Z"}, {"uuid": "e91ad276-7f66-4e54-80bd-d1c605a0b748", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityIL/86094", "content": "\ud83c\udf10\u05e9\u05d9\u05de\u05d5 \u05dc\u05d1 \u05dc\u05e9\u05ea\u05d9 \u05e4\u05d2\u05d9\u05e2\u05d5\u05d9\u05d5\u05ea \u05d1\u05e4\u05dc\u05d8\u05e4\u05d5\u05e8\u05de\u05ea Wordpress \u05d4\u05de\u05d0\u05e4\u05e9\u05e8\u05d5\u05ea (\u05d9\u05d7\u05d3) \u05d4\u05e8\u05e6\u05ea \u05e7\u05d5\u05d3 \u05de\u05e8\u05d7\u05d5\u05e7.\n\n\u05d4\u05d7\u05d5\u05dc\u05e9\u05d5\u05ea CVE-2026-60137 \u05d5-CVE-2026-63030 \u05db\u05d5\u05dc\u05dc\u05d5\u05ea \u05db\u05d1\u05e8 POC \u05e2\u05d5\u05d1\u05d3 \u05e9\u05e4\u05d5\u05e8\u05e1\u05dd \u05d1\u05e8\u05e9\u05ea, \u05e7\u05d9\u05d1\u05dc\u05d5 \u05d0\u05ea \u05d4\u05db\u05d9\u05e0\u05d5\u05d9 wp2shell, \u05d5\u05d4\u05df \u05e4\u05d5\u05e6'\u05e4\u05e6'\u05d5 \u05d1\u05d2\u05e8\u05e1\u05d0\u05d5\u05ea 6.9.5 \u05d5-7.0.2.\n\nhttps://t.me/CyberSecurityIL/9229", "creation_timestamp": "2026-07-19T00:00:09.893754Z"}, {"uuid": "1aeb1e3a-48f1-4eb8-aaeb-415f2889c8c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93958", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a WP2Shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a NULL200OK\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 07:52:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWP2Shell - CVE-2026-63030 / CVE-2026-60137 This tool exploits a critical SQL injection vulnerability in the WordPress REST API `/wp-json/batch/v1` endpoint, allowing unauthenticated attackers to execute arbitrary SQL queries and achieve Remote Code Execution (RCE) on vulnerable WordPress installations.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T00:00:28.582141Z"}, {"uuid": "75956633-4c25-43aa-8bde-a03e8aee4b2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93950", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ekomsSavior\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 06:55:20\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 (RCE) + CVE-2026-60137 (SQLi)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T00:00:28.652646Z"}, {"uuid": "7b2d6cb7-31d4-45cb-9fd9-af5b41553af4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/GithubRedTeam/94024", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell_scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a zi3lak\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 17:56:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-intrusive detection scanner for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030 + CVE-2026-60137). Detection-only, no exploitation.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T00:00:09.525678Z"}, {"uuid": "0bb8f560-af86-4a7e-93c4-3b451d7d3146", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94031", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a yoerivegt\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 19:02:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell (CVE-2026-60137 / CVE-2026-63030)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T00:00:09.671313Z"}, {"uuid": "8e153f01-1224-4e37-8c94-2a53407fa6a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/393", "content": "WordPress Core \"wp2shell\" RCE\n\nThe attack consists of two flaws, tracked as CVE-2026-63030 and CVE-2026-60137, that can be chained together to achieve pre-authentication remote code execution against WordPress installs running versions 6.9.x and 7.0.x.", "creation_timestamp": "2026-07-19T00:00:09.848609Z"}, {"uuid": "1ed47b7e-def2-4f40-9326-48b2411f8cd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94005", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xsha\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 14:29:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 + CVE-2026-60137 - \u201cwp2shell\u201d: unauthenticated RCE in WordPress core\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T00:00:11.892588Z"}, {"uuid": "4e19ce8e-627e-472c-b90c-8c235dc9f5f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94017", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a h4cd0c\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 16:41:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell \u2014 Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on WP 6.9.0\u20136.9.4 / 7.0.0\u20137.0.1.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T00:00:11.004435Z"}, {"uuid": "4dd89ccf-6324-4141-a28e-2e92dbc220bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93979", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kulichr\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 10:08:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-intrusive checker for CVE-2026-63030 / CVE-2026-60137 (\"wp2shell\"), a pre-authentication RCE chain in WordPress core.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T00:00:28.355724Z"}, {"uuid": "2cd449d3-acb9-419c-b035-74299bb3e9e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9544", "content": "\u26a1 UPDATE: #wp2shell now has two CVEs, and a working proof-of-concept is public.\n\n> CVE-2026-63030 breaks REST batch routing\n> CVE-2026-60137 injects SQL\n\nChained, they give an anonymous attacker code execution on affected WordPress sites.\n\nHow the exploit path works: https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "creation_timestamp": "2026-07-19T00:00:28.506488Z"}, {"uuid": "963c1c28-26c3-4039-b175-c73c19c266a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93933", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 47Cid\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 03:53:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nEducational PoC + lab for CVE-2026-63030 + CVE-2026-60137: pre-auth SQLi in WordPress core via REST batch-route confusion\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T00:00:28.772564Z"}, {"uuid": "34ac20b5-951e-4e3e-80f7-f6a5226bb546", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93917", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wordpress-cve-2026-63030\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Senanfurkan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-18 00:44:24\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth RCE in WordPress Core via REST API batch route confusion + WP_Query SQLi (CVE-2026-63030 / CVE-2026-60137). Detection PoC.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T00:00:40.148113Z"}, {"uuid": "3a80f681-887a-4e44-8271-6e778e523df6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://www.acn.gov.it/portale/w/wordpress-poc-pubblico-per-lo-sfruttamento-delle-cve-2026-60137-e-cve-2026-63030", "content": "Disponibile Proof of Concept (PoC) per le vulnerabilit\u00e0 identificate dalle CVE-2026-60137 e CVE-2026-63030, gi\u00e0 sanate dal vendor, che interessa il prodotto WordPress Core.", "creation_timestamp": "2026-07-19T01:00:42.439457Z"}, {"uuid": "a01e0a82-865c-4abe-9b01-e769a7a4a445", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mqxycl25wi2d", "content": "Top 3 CVE for last 7 days:\nCVE-2026-58532: 47 interactions\nCVE-2026-15409: 21 interactions\nCVE-2026-63030: 17 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-63030: 16 interactions\nCVE-2026-60137: 9 interactions\nCVE-2026-62857: 4 interactions\n", "creation_timestamp": "2026-07-19T04:53:12.138914Z"}, {"uuid": "15056f9d-2a60-49b7-b917-81251d488ae1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/cyberbannews_ir/22721", "content": "\ud83d\udd34 \u0647\u0634\u062f\u0627\u0631 \u0627\u0645\u0646\u06cc\u062a\u06cc\u061b \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062e\u0637\u0631\u0646\u0627\u06a9 \u062f\u0631 \u0648\u0631\u062f\u067e\u0631\u0633 \u0628\u0627 \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631\n\n\ud83d\udd3b \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u0647\u0627\u06cc CVE-2026-60137 \u0648 CVE-2026-63030 \u062f\u0631 \u0648\u0631\u062f\u067e\u0631\u0633 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f \u06a9\u0647 \u062f\u0631 \u0635\u0648\u0631\u062a \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0647\u0645\u0632\u0645\u0627\u0646\u060c \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 (RCE) \u0631\u0627 \u0628\u0631\u0627\u06cc \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\ud83d\udd3b \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0646\u0645\u0648\u0646\u0647 \u06a9\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 (PoC) \u0628\u0627 \u0646\u0627\u0645 wp2shell \u0646\u06cc\u0632 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0639\u0645\u0648\u0645\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0648 \u062e\u0637\u0631 \u062d\u0645\u0644\u0627\u062a \u0631\u0627 \u0627\u0641\u0632\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a.\n\n\ud83d\udd39 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 6.9.5 \u0648 7.0.2 \u0648\u0631\u062f\u067e\u0631\u0633 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f \u0648 \u0628\u0647 \u0645\u062f\u06cc\u0631\u0627\u0646 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a\u200c\u0647\u0627 \u062a\u0648\u0635\u06cc\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a \u0647\u0631\u0686\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u062c\u062f\u06cc\u062f \u0631\u0627 \u0646\u0635\u0628 \u06a9\u0646\u0646\u062f.\n\n#\u062a\u0647\u062f\u06cc\u062f_\u0633\u0627\u06cc\u0628\u0631\u06cc #\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc #\u0648\u0631\u062f\u067e\u0631\u0633\n\n\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\n\ud83d\udd39\ud83d\udd39 @cyberbannews_ir", "creation_timestamp": "2026-07-19T06:00:03.295934Z"}, {"uuid": "c2a3f2ac-63e6-4a3b-9582-204437125d51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/jkanematsu.bsky.social/post/3mqy7qa5ni22j", "content": "\u3010\u7d9a\u5831\u3011WordPress\u306e\u8106\u5f31\u6027\uff08wp2shell\uff0fCVE-2026-63030\uff09\u304c\u516c\u8868\u3055\u308c\u3066\u3044\u307e\u3059\u3002\n\u203b\u6628\u65e5\u306e\u6295\u7a3f\u3067\u66f8\u3044\u305f\u3001\u9023\u643a\u3057\u3066\u60aa\u7528\u3055\u308c\u308bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\uff08CVE-2026-60137\uff09\u3092\u542b\u307f\u307e\u3059\u3002\n\n\u3010\u4fee\u6b63\u7248\u3078\u901f\u3084\u304b\u306b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3057\u3066\u304f\u3060\u3055\u3044\u3011\n\u30fb6.9.x \u3000\u2192\u3000WordPress 6.9.5 \n\u30fb7.0.x \u3000\u2192\u3000WordPress 7.0.2 \n\u30fb6.8.x \u3000\u2192\u3000WordPress 6.8.6 \n\nX\u30b5\u30fc\u30d0\u30fc\u7cfb\u306e\u30b9\u30bf\u30fc\u30ec\u30f3\u30bf\u30eb\u30b5\u30fc\u30d0\u30fc\u3055\u3093\u306e\u304a\u77e5\u3089\u305b\u306b\u3082\u8f09\u3063\u3066\u3044\u305f\u306e\u3067\u3001\u30ea\u30f3\u30af\u8cbc\u3063\u3066\u304a\u304d\u307e\u3059\u3002\nwww.star.ne.jp/news/detail....", "creation_timestamp": "2026-07-19T07:04:27.581371Z"}, {"uuid": "a4e9ba02-5878-47f2-af8d-b20e30f8585f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyage2uhu23", "content": "CVE-2026-60137: Unchecked WordPress Vulnerabilities Allow Unauthenticated Takeover #CVE2026 #WordPressSecurity #Cybersecurity", "creation_timestamp": "2026-07-19T07:18:29.651696Z"}, {"uuid": "836ed81b-908c-4d07-9ff7-628abc2a99fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyai2vplb2w", "content": "Critical CVE-2026-63030 and CVE-2026-60137 Exploits Threaten WordPress Sites #WordPress #CyberSecurity #CVE2026", "creation_timestamp": "2026-07-19T07:19:26.941101Z"}, {"uuid": "a74d91e0-d45d-4497-b0b6-170bc3bd21e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyai6mcmt2j", "content": "CVE-2026-63030; CVE-2026-60137: WordPress Exploits Offer Open Door to Attackers #WordPress #Cybersecurity #Exploits", "creation_timestamp": "2026-07-19T07:19:30.496899Z"}, {"uuid": "162637e1-fbe0-4ab1-949d-819de402310a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqyaiai4m72p", "content": "CVE-2026-63030 and CVE-2026-60137: Is WordPress\u2019s Update Enough? #WordPress #CyberSecurity #Vulnerability", "creation_timestamp": "2026-07-19T07:19:32.501733Z"}, {"uuid": "9e8c8c24-9f27-4775-ab30-fd93ab4cc693", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/GithubRedTeam/94097", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ikow\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 06:23:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell \u2014 WordPress Core Pre-Auth RCE (CVE-2026-63030 + CVE-2026-60137). Exploit toolkit + remediation.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T08:00:04.985278Z"}, {"uuid": "64fd4ceb-bbfa-487c-a74d-02ff20c5632a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mqyidqoupg2g", "content": "\uff1e WordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f\nhttps://piyolog.hatenadiary.jp/entry/2026/07/19/181822\n", "creation_timestamp": "2026-07-19T09:40:19.864456Z"}, {"uuid": "f308c877-579c-4b6a-9db6-411a65d7a445", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94110", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a bahartanir\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 08:54:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 / CVE-2026-60137 - WordPress pre-auth RCE scanner\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T10:00:03.328924Z"}, {"uuid": "d43ca3b9-0126-42c3-a793-33a5e1053188", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/kalika.de/post/3mqyjpa7z3m2n", "content": "wp2shell: Die kritische Pre-Auth-RCE-L\u00fccke in WordPress Core \u2013 was Site-Betreiber jetzt wissen m\u00fcssen\n\nwp2shell (CVE-2026-63030 & CVE-2026-60137) erlaubt unauthentifizierte Remote Code Execution in WordPres...\n\nhttps://www.kalika.de/posts/technical-analysis-of-wp2shell-the-latest-wordpress-core-pre/", "creation_timestamp": "2026-07-19T10:04:30.894338Z"}, {"uuid": "5c526c86-fd01-4bb8-b1af-5d591b5961c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/HackerNewscyber/3265", "content": "\u2708\ufe0f\u0627\u0646\u062a\u0634\u0627\u0631 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a\u200c\u0647\u0627\u06cc \u0639\u0645\u0648\u0645\u06cc wp2shell\u061b \u0645\u06cc\u0644\u06cc\u0648\u0646\u200c\u0647\u0627 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0648\u0631\u062f\u067e\u0631\u0633\u06cc \u062f\u0631 \u0645\u0639\u0631\u0636 \u062a\u0635\u0631\u0641 \u06a9\u0627\u0645\u0644\n\n\ud83c\udfa5 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a\u200c\u0647\u0627\u06cc \u0639\u0645\u0648\u0645\u06cc \u0645\u0648\u0633\u0648\u0645 \u0628\u0647 wp2shell \u0628\u0631\u0627\u06cc \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0648\u0631\u062f\u067e\u0631\u0633 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u0647\u0627\u06cc CVE-2026-63030 \u0648 CVE-2026-60137 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f. \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0627 \u0632\u0646\u062c\u06cc\u0631\u0647\u200c\u0633\u0627\u0632\u06cc \u0627\u06cc\u0646 \u062f\u0648 \u0646\u0642\u0635\u060c \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a\u060c \u06a9\u062f \u062f\u0644\u062e\u0648\u0627\u0647 \u062e\u0648\u062f \u0631\u0627 \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 \u0627\u062c\u0631\u0627 \u06a9\u0631\u062f\u0647 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0627\u0645\u0644 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0631\u0627 \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 \u0628\u06af\u06cc\u0631\u0646\u062f.\n\n\ud83c\udfa5 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 6.9.x \u0648 7.0.x \u0648\u0631\u062f\u067e\u0631\u0633 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f. \u062a\u06cc\u0645 \u062a\u0648\u0633\u0639\u0647 \u0648\u0631\u062f\u067e\u0631\u0633 \u0627\u0632 \u0645\u062f\u06cc\u0631\u0627\u0646 \u0633\u0627\u06cc\u062a\u200c\u0647\u0627 \u062e\u0648\u0627\u0633\u062a\u0647 \u0627\u0633\u062a \u0647\u0631\u0686\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0628\u0647 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 7.0.2 \u06cc\u0627 6.9.5 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0646\u0646\u062f. \u0628\u0647 \u062f\u0644\u06cc\u0644 \u0634\u062f\u062a \u0627\u06cc\u0646 \u0646\u0642\u0635\u200c\u0647\u0627\u060c \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u062e\u0648\u062f\u06a9\u0627\u0631 \u0646\u06cc\u0632 \u0628\u0631\u0627\u06cc \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0641\u0639\u0627\u0644 \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\ud83c\udfa5\u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0634\u0631\u06a9\u062a Searchlight Cyber \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u0628\u06cc\u0634 \u0627\u0632 \u06f5\u06f0\u06f0 \u0645\u06cc\u0644\u06cc\u0648\u0646 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0627\u0632 \u0648\u0631\u062f\u067e\u0631\u0633 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0639\u062f\u0645 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc\u060c \u062f\u0631 \u0645\u0639\u0631\u0636 \u062d\u0645\u0644\u0627\u062a \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f. \u062f\u0631 \u0635\u0648\u0631\u062a \u0639\u062f\u0645 \u0627\u0645\u06a9\u0627\u0646 \u0646\u0635\u0628 \u0648\u0635\u0644\u0647 \u0627\u0645\u0646\u06cc\u062a\u06cc\u060c \u0628\u0647\u200c\u0637\u0648\u0631 \u0645\u0648\u0642\u062a \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0646\u0627\u0634\u0646\u0627\u0633 \u0628\u0647 \u0645\u0633\u06cc\u0631 REST API Batch \u0631\u0627 \u0645\u0633\u062f\u0648\u062f \u06a9\u0631\u062f\u060c \u0627\u0645\u0627 \u0627\u06cc\u0646 \u0627\u0642\u062f\u0627\u0645 \u062a\u0646\u0647\u0627 \u06cc\u06a9 \u0631\u0627\u0647\u06a9\u0627\u0631 \u0645\u0648\u0642\u062a \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u062f.\n\n\u2708\ufe0f @HackerNewsCyber", "creation_timestamp": "2026-07-19T13:00:04.370716Z"}, {"uuid": "cf7fd831-ebcb-4fd7-9e8b-f3c429f56283", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/tech-trending.bsky.social/post/3mqyzrf6oeu2m", "content": "WordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f - piyolog\nhttps://piyolog.hatenadiary.jp/entry/2026/07/19/181822", "creation_timestamp": "2026-07-19T14:52:04.179564Z"}, {"uuid": "dede6c8d-f82b-4621-ab66-5ef2f55556d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3mqyzwwvtmo2q", "content": "#\ud83d\udd16\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\nWordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f - piyolog\n\n2026\u5e747\u670817\u65e5\u3001WordPress\u3092\u958b\u767a\u3059\u308bWordPress.org\u306f\u3001WordPress Core\u306b\u8a8d\u8a3c\u4e0d\u8981\u306e\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c(RCE)\u306b\u81f3\u308b\u6df1\u523b\u306a\u8106\u5f31\u6027\u304c\u78ba\u8a8d\u3055\u308c\u305f\u3068\u3057\u3066\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30ea\u30fc\u30b9\u7248WordPress 7.0.2\u3092\u516c\u958b\u3057\u3001\u5bfe\u8c61\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u5229\u7528\u3059\u308b\u30b5\u30a4\u30c8\u306b\u81ea\u52d5\u66f4\u65b0\u30b7\u30b9\u30c6\u30e0\u7d4c\u7531\u3067\u306e\u5f37\u5236\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u9069\u7528\u3059\u308b\u5bfe\u5fdc\u3092\u53d6\u308a\u307e\u3057\u305f\u3002\u3053\u308c\u30892\u4ef6\u306e...", "creation_timestamp": "2026-07-19T14:55:09.551139Z"}, {"uuid": "1914e37d-618e-4c80-b6b9-17d2904ce39d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94147", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-compromise-scanner-plugin\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a eyesecurity\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 13:24:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRead-only WordPress plugin that scans for artifacts of the wp2shell exploit chain (CVE-2026-63030 / CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T15:00:04.236861Z"}, {"uuid": "6a7a8554-19e7-4590-8096-f24aef86bd44", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8d6ec1a6-0a0b-4316-8704-6d652396db19", "content": "", "creation_timestamp": "2026-07-19T16:00:32.598106Z"}, {"uuid": "cde30b7b-1a45-4299-a157-856f242857d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/GithubRedTeam/94159", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a N45HT\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 14:57:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n[CVE-2026-63030/CVE-2026-60137] Pre Authentication RCE in WordPress Core\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T16:00:12.877869Z"}, {"uuid": "76bbb58e-5907-43e3-870c-0bd708418781", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94174", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-60137-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dewcode91\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 16:58:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T18:00:03.970858Z"}, {"uuid": "6cf5cce2-a9c7-4ff5-8433-c0c3597de8b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/GithubRedTeam/94192", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Vulnerability Scanner\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a PressVector\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a vulnquest58\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 19:20:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPressVector - Advanced WordPress Vulnerability Scanner CVE-2026-63030 (REST batch route confusion) / CVE-2026-60137 (SQLi) Developer: Vulnquest\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T21:00:04.962979Z"}, {"uuid": "aa8f1557-74d3-4e10-aba1-11c9e9e56cf7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94189", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp-cve-2026-63030-check\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Lukols-Dev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 19:05:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-intrusive exposure checker for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030 / CVE-2026-60137).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T21:00:05.044374Z"}, {"uuid": "9c02c3bd-b961-4afe-9a47-86a39707a298", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94187", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a hidden-investigations\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 18:12:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress wp2shell vulnerability-chain scanner for CVE-2026-63030 and CVE-2026-60137, with active detection, optional PoC, JSON export.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-19T21:00:05.126915Z"}, {"uuid": "569b9d60-2fdc-4df7-95f8-a08bd2e0200d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mqzqkt5exc2a", "content": "Two new high severity WordPress vulnerabilities, patch immediately!\n\nThe 7.0.2 WordPress security release addresses one critical and one high severity security issue. The vulnerabilities reported to the WordPress security team include: CVE-2026-60137 \u2013 A facilitated SQL injection \u2026\n#hackernews #news", "creation_timestamp": "2026-07-19T21:39:58.818170Z"}, {"uuid": "18cc2b79-e41c-4454-9db5-cf3906fe3725", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/igalog.bsky.social/post/3mqzsjnu52d2y", "content": "WordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f - piyolog\nhttps://piyolog.hatenadiary.jp/entry/2026/07/19/181822\n\n\u4f11\u65e5\u306e\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u4f5c\u696d", "creation_timestamp": "2026-07-19T22:15:07.862261Z"}, {"uuid": "bbd373f4-2a11-474b-a8ef-0873a2eacb33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/tamosan.bsky.social/post/3mqzxv6bdcl2m", "content": "\u591c\u884c\u6027\u30a4\u30f3\u30b3\u3055\u3093\u306e\u307e\u3068\u3081\u3002\u5373\u5bfe\u5fdc\u3067\u3059\u306a\u3053\u308c\u306f\uff1aWordPress Core\u306e\u8106\u5f31\u6027 CVE-2026-63030 / CVE-2026-60137 (\u901a\u79f0\u300cwp2shell\u300d)\u306b\u3064\u3044\u3066\u307e\u3068\u3081\u3066\u307f\u305f - piyolog piyolog.hatenadiary.jp/entry/2026/0...", "creation_timestamp": "2026-07-19T23:51:02.735816Z"}, {"uuid": "f1d06ccd-d3d5-42a1-9aa8-f93de8975cc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94189", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp-cve-2026-63030-check\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Lukols-Dev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 19:05:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-intrusive exposure checker for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030 / CVE-2026-60137).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-20T00:00:20.116533Z"}, {"uuid": "b83393c4-25a9-4f6f-900c-4f01d42b2ac0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/GithubRedTeam/94192", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Vulnerability Scanner\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a PressVector\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a vulnquest58\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 19:20:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPressVector - Advanced WordPress Vulnerability Scanner CVE-2026-63030 (REST batch route confusion) / CVE-2026-60137 (SQLi) Developer: Vulnquest\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-20T00:00:09.766736Z"}, {"uuid": "94ab402d-f06e-4644-a925-29ce19643698", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94187", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a hidden-investigations\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 18:12:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress wp2shell vulnerability-chain scanner for CVE-2026-63030 and CVE-2026-60137, with active detection, optional PoC, JSON export.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-20T00:00:20.208123Z"}, {"uuid": "ff90cd50-f07f-4846-87c5-3fec26a0837a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94174", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-60137-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dewcode91\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 16:58:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-20T00:00:22.295352Z"}, {"uuid": "3d91cec3-815e-4efa-aba7-6b8305866aa5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94110", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-scanner\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a bahartanir\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 08:54:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-63030 / CVE-2026-60137 - WordPress pre-auth RCE scanner\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-20T00:00:26.443897Z"}, {"uuid": "fe3f9ace-d8ed-42b5-a4f8-ef956c7f3235", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94097", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ikow\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 06:23:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nwp2shell \u2014 WordPress Core Pre-Auth RCE (CVE-2026-63030 + CVE-2026-60137). Exploit toolkit + remediation.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-20T00:00:26.484772Z"}, {"uuid": "1eb831a7-c3e8-4326-902b-6cf7ea4abe9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/GithubRedTeam/94159", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a N45HT\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 14:57:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n[CVE-2026-63030/CVE-2026-60137] Pre Authentication RCE in WordPress Core\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-20T00:00:25.868158Z"}, {"uuid": "cd3ac87f-4eb6-4296-b1c3-0dca24ea0589", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94147", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-compromise-scanner-plugin\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a eyesecurity\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 13:24:55\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRead-only WordPress plugin that scans for artifacts of the wp2shell exploit chain (CVE-2026-63030 / CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-20T00:00:25.951016Z"}, {"uuid": "d8a29b22-3fce-43ca-84a5-0b0ec91c484b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "exploited", "source": "https://t.me/HackerNewscyber/3265", "content": "\u2708\ufe0f\u0627\u0646\u062a\u0634\u0627\u0631 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a\u200c\u0647\u0627\u06cc \u0639\u0645\u0648\u0645\u06cc wp2shell\u061b \u0645\u06cc\u0644\u06cc\u0648\u0646\u200c\u0647\u0627 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0648\u0631\u062f\u067e\u0631\u0633\u06cc \u062f\u0631 \u0645\u0639\u0631\u0636 \u062a\u0635\u0631\u0641 \u06a9\u0627\u0645\u0644\n\n\ud83c\udfa5 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a\u200c\u0647\u0627\u06cc \u0639\u0645\u0648\u0645\u06cc \u0645\u0648\u0633\u0648\u0645 \u0628\u0647 wp2shell \u0628\u0631\u0627\u06cc \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0648\u0631\u062f\u067e\u0631\u0633 \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u0647\u0627\u06cc CVE-2026-63030 \u0648 CVE-2026-60137 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f. \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0627 \u0632\u0646\u062c\u06cc\u0631\u0647\u200c\u0633\u0627\u0632\u06cc \u0627\u06cc\u0646 \u062f\u0648 \u0646\u0642\u0635\u060c \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a\u060c \u06a9\u062f \u062f\u0644\u062e\u0648\u0627\u0647 \u062e\u0648\u062f \u0631\u0627 \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 \u0627\u062c\u0631\u0627 \u06a9\u0631\u062f\u0647 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u06a9\u0627\u0645\u0644 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0631\u0627 \u062f\u0631 \u0627\u062e\u062a\u06cc\u0627\u0631 \u0628\u06af\u06cc\u0631\u0646\u062f.\n\n\ud83c\udfa5 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 6.9.x \u0648 7.0.x \u0648\u0631\u062f\u067e\u0631\u0633 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f. \u062a\u06cc\u0645 \u062a\u0648\u0633\u0639\u0647 \u0648\u0631\u062f\u067e\u0631\u0633 \u0627\u0632 \u0645\u062f\u06cc\u0631\u0627\u0646 \u0633\u0627\u06cc\u062a\u200c\u0647\u0627 \u062e\u0648\u0627\u0633\u062a\u0647 \u0627\u0633\u062a \u0647\u0631\u0686\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0628\u0647 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 7.0.2 \u06cc\u0627 6.9.5 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0646\u0646\u062f. \u0628\u0647 \u062f\u0644\u06cc\u0644 \u0634\u062f\u062a \u0627\u06cc\u0646 \u0646\u0642\u0635\u200c\u0647\u0627\u060c \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u062e\u0648\u062f\u06a9\u0627\u0631 \u0646\u06cc\u0632 \u0628\u0631\u0627\u06cc \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u0641\u0639\u0627\u0644 \u0634\u062f\u0647 \u0627\u0633\u062a.\n\n\ud83c\udfa5\u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0634\u0631\u06a9\u062a Searchlight Cyber \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u0628\u06cc\u0634 \u0627\u0632 \u06f5\u06f0\u06f0 \u0645\u06cc\u0644\u06cc\u0648\u0646 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a \u0627\u0632 \u0648\u0631\u062f\u067e\u0631\u0633 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0639\u062f\u0645 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc\u060c \u062f\u0631 \u0645\u0639\u0631\u0636 \u062d\u0645\u0644\u0627\u062a \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f. \u062f\u0631 \u0635\u0648\u0631\u062a \u0639\u062f\u0645 \u0627\u0645\u06a9\u0627\u0646 \u0646\u0635\u0628 \u0648\u0635\u0644\u0647 \u0627\u0645\u0646\u06cc\u062a\u06cc\u060c \u0628\u0647\u200c\u0637\u0648\u0631 \u0645\u0648\u0642\u062a \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0646\u0627\u0634\u0646\u0627\u0633 \u0628\u0647 \u0645\u0633\u06cc\u0631 REST API Batch \u0631\u0627 \u0645\u0633\u062f\u0648\u062f \u06a9\u0631\u062f\u060c \u0627\u0645\u0627 \u0627\u06cc\u0646 \u0627\u0642\u062f\u0627\u0645 \u062a\u0646\u0647\u0627 \u06cc\u06a9 \u0631\u0627\u0647\u06a9\u0627\u0631 \u0645\u0648\u0642\u062a \u0645\u062d\u0633\u0648\u0628 \u0645\u06cc\u200c\u0634\u0648\u062f.\n\n\u2708\ufe0f @HackerNewsCyber", "creation_timestamp": "2026-07-20T00:00:26.029897Z"}, {"uuid": "5bfc4cf7-3ff7-4704-bd87-3a02cc80de23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/cyberbannews_ir/22721", "content": "\ud83d\udd34 \u0647\u0634\u062f\u0627\u0631 \u0627\u0645\u0646\u06cc\u062a\u06cc\u061b \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062e\u0637\u0631\u0646\u0627\u06a9 \u062f\u0631 \u0648\u0631\u062f\u067e\u0631\u0633 \u0628\u0627 \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631\n\n\ud83d\udd3b \u062f\u0648 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647\u200c\u0647\u0627\u06cc CVE-2026-60137 \u0648 CVE-2026-63030 \u062f\u0631 \u0648\u0631\u062f\u067e\u0631\u0633 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f \u06a9\u0647 \u062f\u0631 \u0635\u0648\u0631\u062a \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0647\u0645\u0632\u0645\u0627\u0646\u060c \u0627\u0645\u06a9\u0627\u0646 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 (RCE) \u0631\u0627 \u0628\u0631\u0627\u06cc \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.\n\n\ud83d\udd3b \u0628\u0631\u0627\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0646\u0645\u0648\u0646\u0647 \u06a9\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 (PoC) \u0628\u0627 \u0646\u0627\u0645 wp2shell \u0646\u06cc\u0632 \u0628\u0647\u200c\u0635\u0648\u0631\u062a \u0639\u0645\u0648\u0645\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0648 \u062e\u0637\u0631 \u062d\u0645\u0644\u0627\u062a \u0631\u0627 \u0627\u0641\u0632\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0627\u0633\u062a.\n\n\ud83d\udd39 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc 6.9.5 \u0648 7.0.2 \u0648\u0631\u062f\u067e\u0631\u0633 \u0631\u0627 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f \u0648 \u0628\u0647 \u0645\u062f\u06cc\u0631\u0627\u0646 \u0648\u0628\u200c\u0633\u0627\u06cc\u062a\u200c\u0647\u0627 \u062a\u0648\u0635\u06cc\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a \u0647\u0631\u0686\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u062c\u062f\u06cc\u062f \u0631\u0627 \u0646\u0635\u0628 \u06a9\u0646\u0646\u062f.\n\n#\u062a\u0647\u062f\u06cc\u062f_\u0633\u0627\u06cc\u0628\u0631\u06cc #\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc #\u0648\u0631\u062f\u067e\u0631\u0633\n\n\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\ud83d\udd38\n\ud83d\udd39\ud83d\udd39 @cyberbannews_ir", "creation_timestamp": "2026-07-20T00:00:26.561561Z"}, {"uuid": "54204fe3-7c22-475e-8313-8bdfbfb0ac17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mqzzr45yny2b", "content": "wp2shell: a defender\u2019s guide (CVE-2026-63030 + CVE-2026-60137) with a list of forensic artifacts, a compromise scanner WordPress plugin and a free Chrome/Edge/Firefox browser extension to in-browser check if a website has been patched.", "creation_timestamp": "2026-07-20T00:24:33.081710Z"}, {"uuid": "3c6892b4-e597-4500-99da-7a9f25edd512", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mr2fgj43k42m", "content": "\ud83d\udcf0 Eksploitasi Publik wp2shell Dirilis, Admin WordPress Diminta Patch Segera\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/07/20/wp2shell-wordpress-rce-public-exploit-patch/\n\n#beritaTeknologi #cve-2026-60137 #cve-2026-63030 #cybersecurity #exploitChain #keamananSiber #publicPoc #r", "creation_timestamp": "2026-07-20T03:53:22.047931Z"}, {"uuid": "c2f35297-8212-42c8-b5fc-3d1566fa1850", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116950422284172751", "content": "wp2shell (CVE-2026-63030, CVE-2026-60137) allows unauth RCE in WordPress core (HIGH severity). Active exploitation reported. Patch to 6.9.5, 7.0.2, or 6.8.6. Block REST API batch endpoint if needed. Details: https://radar.offseq.com/threat/wp2shell-critical-wordpress-core-vulnerability-enabling-unauthenticated-rce-detection-and-mitigation-fccca7b8b6429718 #OffSeq #WordPress #RCE #Vulnerability", "creation_timestamp": "2026-07-20T04:30:25.398434Z"}, {"uuid": "73f5ba9e-17b4-4564-9905-1b913dfc9b4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/wordpress-multiple-vulnerabilities_20260720", "content": "", "creation_timestamp": "2026-07-20T04:45:06.327548Z"}, {"uuid": "799c36c3-255c-490a-ab5a-fb3f30162cc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mr2ilwyupj2i", "content": "The latest update for #CyCognito includes \"Emerging Threat: (CVE-2026-63030, CVE-2026-60137) #WordPress Core Unauthenticated RCE via wp2shell\".\n\n#cybersecurity #AttackSurfaceManagement #EASM https://opsmtrs.com/44Srq0X", "creation_timestamp": "2026-07-20T04:50:06.143520Z"}, {"uuid": "e7079361-5eb5-4acc-bf2d-738ebef5b528", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mr2jeblifv2p", "content": "Daily IT Security Digest \u2014 2026-07-20\n# Daily IT Security Digest \u2014 2026-07-20\n\n1. **WordPress RCE (wp2shell) \u2014 Active Exploitation of Critical Flaws**\n   CVE-2026-63030 and CVE-2026-60137 represent unauthenticated remote code execution vulnerabilities in WordPress core. Active exploitation has been", "creation_timestamp": "2026-07-20T05:03:42.400676Z"}, {"uuid": "513a382d-708c-401b-9331-00d3593634df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mr2jovvx3226", "content": "Top 3 CVE for last 7 days:\nCVE-2026-58532: 47 interactions\nCVE-2026-63030: 30 interactions\nCVE-2026-60137: 23 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-63030: 13 interactions\nCVE-2026-60137: 11 interactions\nCVE-2026-16096: 3 interactions\n", "creation_timestamp": "2026-07-20T05:09:39.500789Z"}, {"uuid": "21cdc79b-d438-411c-bd3d-a52c2cb65ecb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/sirchamallow.bsky.social/post/3mr2l6w7glk2t", "content": "\ud83d\udd34 #WP2Shell combine deux failles critiques du c\u0153ur WordPress (CVE-2026-63030 et CVE-2026-60137) pour ex\u00e9cuter du code \u00e0 distance sans compte ni plugin, affectant les versions 6.9.0 \u00e0 6.9.4 et 7.0.0 \u00e0 7.0.1.\n\nkorben.info/wp2shell-exp...", "creation_timestamp": "2026-07-20T05:36:33.352131Z"}, {"uuid": "ec2519dd-db47-4ff0-9d4b-c1f284944c48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/vulndex.at/post/3mr2nr6vyac2q", "content": "WP2Shell: Die Kombination zweier CVEs (CVE-2026-63030 und CVE-2026-60137) erm\u00f6glichen eine Remote Code Execution.  Betroffen sind Versionen 6.9.0 < 6.9.5 und 7.0.0 < 7.0.2. Updates sind verf\u00fcgbar. Updates auf Version 6.9.5 oder 7.0.2 verf\u00fcgbar.\n\nAktuelle Trending CVE unter vulndex.at/intel/trendi...", "creation_timestamp": "2026-07-20T06:22:34.874867Z"}, {"uuid": "7d5a5724-459a-44ec-ad62-cc7ca646be3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/vulndex.at/post/3mr2nvjhwxc2q", "content": "WP2Shell: Die Kombination zweier CVEs (CVE-2026-63030 und CVE-2026-60137) erm\u00f6glichen eine Remote Code Execution. Betroffen sind Versionen 6.9.0 < 6.9.5 und 7.0.0 < 7.0.2. Updates sind verf\u00fcgbar.\n\nAktuelle Trending CVE unter vulndex.at/intel/trendi...\n\n#WordPress #CVE #RCE", "creation_timestamp": "2026-07-20T06:24:58.882808Z"}, {"uuid": "522a1d2a-200f-4b2d-9ba8-5d1216ae2745", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/kerzinger.at/post/3mr2ouhi2ms2j", "content": "WP2Shell: Am Freitagabend wurden zwei Schwachstellen (CVE-2026-60137 [CVSS: 9,1] und CVE-2026-63030 [CVSS: 9,8]) ver\u00f6ffentlicht. \u00dcber diese k\u00f6nnen bei verwundbaren WordPress-Installationen Remote Code Executions ausgef\u00fchrt werden. WordPress-Updates stehen bereits zur Verf\u00fcgung.", "creation_timestamp": "2026-07-20T06:42:15.886373Z"}, {"uuid": "794826ba-178f-4df1-bc14-08e1648684d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr2pj3m7zs2m", "content": "CVE-2026-60137 and CVE-2026-63030: WP2Shell Vulnerabilities Are Live Threats #CVE2026 #WordPress #CyberSecurity", "creation_timestamp": "2026-07-20T06:53:46.713433Z"}, {"uuid": "df4f8488-afe1-4a0d-9278-e7d157996d0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr2pj6gscq2g", "content": "CVE-2026-60137 and CVE-2026-63030: WordPress Vulnerabilities Demand Immediate Attention #WordPress #CVE2026 #Cybersecurity", "creation_timestamp": "2026-07-20T06:53:49.443099Z"}, {"uuid": "356f1136-1ee7-44ff-bc75-1b674e34d680", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr2pjlnz6g2y", "content": "CVE-2026-60137 and CVE-2026-63030: Patch Efficacy vs. User Responsibility #CVE2026 #WordPressSecurity #CyberSecurity", "creation_timestamp": "2026-07-20T06:54:03.738853Z"}, {"uuid": "0f2cec2d-cd5e-4253-ab92-12236d897617", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/GithubRedTeam/94260", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-checker\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xjessie21\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 06:44:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress Core Unauthenticated RCE (CVE-2026-63030, CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-20T08:00:04.480854Z"}, {"uuid": "a210c56c-ebc5-4a02-834d-30e4a869d005", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mr2umgiun227", "content": "\ud83d\udd17 CVE : CVE-2026-60137, CVE-2026-63030", "creation_timestamp": "2026-07-20T08:25:06.964149Z"}, {"uuid": "a4ce1273-e67b-4a88-a3fa-6084a0ce1c9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mr3xki4pck26", "content": "Monday\u2019s fuck up - This Time - Wordpress - WordPress Core \"wp2shell\u201d RCE. The attack consists of two flaws, tracked as CVE-2026-63030 and CVE-2026-60137, that can be chained together to achieve pre-authentication remote code execution against WordPress github.com/Icex0/wp2she... #exploit #wp #cve", "creation_timestamp": "2026-07-20T08:50:41.773592Z"}, {"uuid": "0ea4232e-f7c7-4d5c-9caa-f71048b578c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/cert-fr.bsky.social/post/3mr2w56ltyi2p", "content": "\u26a0\ufe0fAlerte CERT-FR\u26a0\ufe0f\n\nLes vuln\u00e9rabilit\u00e9s CVE-2026-60137 et CVE-2026-63030 affectent WordPress et permettent une ex\u00e9cution de code arbitraire \u00e0 distance non authentifi\u00e9e.\nUne preuve de concept est disponible.\n\nwww.cert.ssi.gouv.fr/alerte/CERTF...", "creation_timestamp": "2026-07-20T08:52:22.917730Z"}, {"uuid": "33a2de48-517f-44c3-9e83-fabf04355454", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://social.numerique.gouv.fr/users/cert_fr/statuses/116951452309188132", "content": "\u26a0\ufe0fAlerte CERT-FR\u26a0\ufe0f\nLes vuln\u00e9rabilit\u00e9s CVE-2026-60137 et CVE-2026-63030 affectent WordPress et permettent une ex\u00e9cution de code arbitraire \u00e0 distance non authentifi\u00e9e.Une preuve de concept est disponible.\nhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-007/", "creation_timestamp": "2026-07-20T08:52:24.519817Z"}, {"uuid": "89389834-57a1-4e50-9be8-2e4f170f66a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://infosec.exchange/users/decio/statuses/116951475979751457", "content": "\u26a0\ufe0f Si vous administrez un site WordPress ou si vous connaissez quelqu\u2019un qui en g\u00e8re un faites passer l\u2019information.\nUne vuln\u00e9rabilit\u00e9 critique baptis\u00e9e WP2Shell touche directement le c\u0153ur de WordPress. \nCette fois, il ne s\u2019agit pas d\u2019un plugin abandonn\u00e9 ou d\u2019un th\u00e8me douteux : une installation standard peut \u00eatre attaqu\u00e9e \u00e0 distance, sans compte utilisateur, sans mot de passe et sans authentification pr\u00e9alable. \nWP2Shell combine deux failles, CVE-2026-60137 et CVE-2026-63030, permettant \u00e0 un attaquant d\u2019ex\u00e9cuter du code sur le serveur et donc, potentiellement, de prendre le contr\u00f4le du site. \n-> Des tentatives d\u2019exploitation et des compromissions ont d\u00e9j\u00e0 \u00e9t\u00e9 observ\u00e9es dans la nature.\nSont notamment concern\u00e9es les versions :\n\u27a1\ufe0f WordPress 6.9.0 \u00e0 6.9.4\u27a1\ufe0f WordPress 7.0.0 \u00e0 7.0.1\nLes correctifs sont disponibles dans les versions 6.9.5 et 7.0.2. WordPress a activ\u00e9 des mises \u00e0 jour automatiques forc\u00e9es en raison de la gravit\u00e9 de la faille, mais il ne faut pas supposer qu\u2019elles ont forc\u00e9ment fonctionn\u00e9 : elles peuvent avoir \u00e9t\u00e9 d\u00e9sactiv\u00e9es, bloqu\u00e9es par l\u2019h\u00e9bergeur ou emp\u00each\u00e9es par une configuration particuli\u00e8re.\n\u00c0 faire rapidement:\n\u2705 v\u00e9rifier la version r\u00e9ellement install\u00e9e ;\u2705 mettre WordPress \u00e0 jour vers 6.9.5 ou 7.0.2 au minimum ;\u2705 confirmer que la mise \u00e0 jour s\u2019est correctement termin\u00e9e ;\u2705 v\u00e9rifier les comptes administrateurs, les fichiers r\u00e9cemment modifi\u00e9s et les journaux du serveur ;\u2705 rechercher d\u2019\u00e9ventuels fichiers PHP, plugins ou utilisateurs inconnus ;\u2705 s\u2019assurer que des sauvegardes propres et r\u00e9centes sont disponibles.\nEn attendant la mise \u00e0 jour, l\u2019acc\u00e8s anonyme aux routes REST suivantes peut \u00e9galement \u00eatre bloqu\u00e9 au niveau du WAF ou du serveur web :\n/wp-json/batch/v1?rest_route=/batch/v1\nPoint important : installer le correctif emp\u00eache une nouvelle exploitation, mais ne supprime pas une \u00e9ventuelle compromission d\u00e9j\u00e0 pr\u00e9sente. Si le site est rest\u00e9 expos\u00e9, une v\u00e9rification minimale est donc n\u00e9cessaire, m\u00eame apr\u00e8s la mise \u00e0 jour.\nUn site WordPress \u00ab qui fonctionne encore \u00bb n\u2019est pas n\u00e9cessairement un site sain : les attaquants cherchent souvent \u00e0 rester discrets pour installer une porte d\u00e9rob\u00e9e, d\u00e9tourner le trafic, diffuser du spam ou pr\u00e9parer d\u2019autres attaques...\n\ud83d\udd0d wp2shell.com , pour v\u00e9rifier si votre site est vuln\u00e9rable.\nDans les news:\"WP2Shell - La faille qui permet de pirater WordPress sans aucun plugin\"\ud83d\udc47 https://korben.info/wp2shell-exploits-prise-controle-wordpress.html\n\ud83d\udcac \u2b07\ufe0f https://infosec.pub/post/49724018\n#CyberVeille #WordPress", "creation_timestamp": "2026-07-20T08:58:23.112291Z"}, {"uuid": "8ededc2c-cd48-441e-97a3-6e7afe08f4d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/GithubRedTeam/94276", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Crypto-Cat\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 08:26:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-63030 + CVE-2026-60137, AKA WP2Shell\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-20T10:00:04.811066Z"}, {"uuid": "e96aedba-fb33-4cc2-98f7-b1769ad81f6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://social.bund.de/users/bsi/statuses/116951719172634340", "content": "\u26a0\ufe0f \ud83d\udce2 #Sicherheitswarnung: WordPress \u2013 Schwachstellen erlauben \"Remote Code Execution\"\nAm 17. Juli 2026 wurde seitens #Wordpress eine Aktualisierung bekannt gegeben, die zwei #Schwachstellen in der Wordpress-Software behebt.\n\u2757\ufe0f Die beiden Schwachstellen CVE-2026-60137 und CVE-2026-63030 erm\u00f6glichen einem nicht authentifizierten, entfernten Angreifer Code zur Ausf\u00fchrung zu bringen.\nMehr dazu hier: \ud83d\udc49\ufe0f https://www.bsi.bund.de/dok/1203360", "creation_timestamp": "2026-07-20T10:01:47.126718Z"}, {"uuid": "79fd2750-f662-4004-83bc-8c9772f34c7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mr32rnd77l2i", "content": "Critical WordPress core flaws, CVE-2026-60137 and CVE-2026-63030, can be chained for unauthenticated access, SQL injection, and possible RCE. CERT-AGID reports suspicious API activity and new admin accounts. #WordPress #CERTAGID #Italy", "creation_timestamp": "2026-07-20T10:15:25.146017Z"}, {"uuid": "ee45ecd6-06ea-4306-9397-30cb5251ea3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/information_security_channel/55596", "content": "WP2Shell WordPress Vulnerabilities Exploited in the Wild\nhttps://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/\n\nExploitation of the new WordPress vulnerabilities tracked as CVE-2026-60137 and CVE-2026-63030 started soon after disclosure.\nThe post WP2Shell WordPress Vulnerabilities Exploited in the Wild (https://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-07-20T11:00:04.039702Z"}, {"uuid": "810dfa6f-a200-480d-9f6c-6490f958d07a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mr35bzmuag2m", "content": "WP2Shell flaws CVE-2026-60137 and CVE-2026-63030 are being exploited in the wild. Chaining them can enable unauthenticated remote code execution on stock WordPress installs. #WordPress #Cloudflare #CVE-2026-60137", "creation_timestamp": "2026-07-20T11:00:21.704541Z"}, {"uuid": "3c012c5e-5999-4c4d-b414-3d1830ecf1e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mr36htygq62u", "content": "Just another Tuesday in the wonderful world of content management, where WP2Shell vulnerabilities CVE-2026-60137 and CVE-2026-63030 are already being actively exploited. This lovely headache affects WordPress site owners who dared to dream of a stable web presence without constan...\n\nRead full story", "creation_timestamp": "2026-07-20T11:21:31.354793Z"}, {"uuid": "e9c11c1c-a18c-4c4d-b6b3-8c10d31a3657", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94292", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a sxwp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a SentinelXofficial\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 10:49:08\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress wp2shell pre-auth RCE exploit kit (CVE-2026-63030 + CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-20T12:00:04.346211Z"}, {"uuid": "5ae61004-5090-4988-99ee-6d2e738ccb4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://www.cert.at/de/warnungen/2026/7/kritische-sicherheitslucken-in-wordpress-updates-verfugbar", "content": "", "creation_timestamp": "2026-07-20T12:15:05.772525Z"}, {"uuid": "27ac6863-aac9-4323-9909-8b479acb586f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/technology-news.bsky.social/post/3mr3go2tdz42r", "content": "In-the-wild exploitation seen for the new WP2Shell WordPress vulnerabilities, officially tracked as CVE-2026-60137 and CVE-2026-63030.", "creation_timestamp": "2026-07-20T13:48:09.557017Z"}, {"uuid": "63cc3db9-6979-40d1-8903-7573605c01ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "Telegram/aeP7rxdaeHgi9l7o5IqMQwPBOzJ-JvO8EcqSGGDOp43yc4w", "content": "", "creation_timestamp": "2026-07-20T18:00:04.936470Z"}, {"uuid": "94a9d9e0-1bac-492e-9943-fcc99837a337", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/GithubRedTeam/94301", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dinosn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 31  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 8\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 09:43:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-20T13:00:03.947074Z"}, {"uuid": "74503465-8d46-41e8-9ccc-a3e686ae85b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/true_secator/8423", "content": "\u0412 \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u043f\u043e\u043b\u044c\u0435 \u0440\u0430\u0441\u0448\u0430\u0440\u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 wp2shell, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u044f\u0434\u0440\u043e WordPress. \u0412 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 WordPress 6.9.5 \u0438 7.0.2 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a wp2shell.\n\n\u0410\u0442\u0430\u043a\u0430 wp2shell \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 - CVE-2026-63030 \u0438 CVE-2026-60137, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.x \u0438 7.0.x.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0410\u0434\u0430\u043c\u043e\u043c \u041a\u0443\u044d\u0441\u043e\u043c \u0438\u0437 Searchlight Cyber, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u0443 \u044d\u0442\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u043d\u0435\u0442 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u0439, \u0438 \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 WordPress \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432.\n\n\u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0430\u043c Searchlight Cyber, \u0431\u043e\u043b\u0435\u0435 500 \u043c\u043b\u043d. \u0441\u0430\u0439\u0442\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 WordPress, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u0439, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0441\u0435\u0439\u0447\u0430\u0441, \u043a\u043e\u0433\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b.\n\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 WordPress \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u0441 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438, \u0438 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c WordPress \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.0.2 \u0438\u043b\u0438 6.9.5.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0432 \u043e\u0434\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430 \u0432 \u0434\u0432\u0443\u0445 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0445 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, CVE-2026-63030, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0443\u044e \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0443\u044e\u0441\u044f \u0432 WordPress 6.9. \u041e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u0430 \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\n\n\u0412\u0442\u043e\u0440\u0430\u044f CVE-2026-60137 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432 author__not_in\u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 WP_Query. WordPress \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0435\u0451 \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0443\u044e WordPress 6.8 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u043c WordPress, \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.0-6.9.4 \u0438 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 7.0.0-7.0.1.\n\nSQL-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.8.0\u20136.8.5, \u043d\u043e \u0435\u0451 \u043d\u0435\u043b\u044c\u0437\u044f \u0441\u0432\u044f\u0437\u0430\u0442\u044c \u0441 RCE, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u0448\u0438\u0431\u043a\u0430, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043b\u0438\u0448\u044c \u0432 WordPress 6.9.\n\nSearchlight Cyber \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0435 \u0440\u0430\u0437\u0433\u043b\u0430\u0448\u0430\u0435\u0442 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438, \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u0441\u043e\u0437\u0434\u0430\u043b\u0430 wp2shell.com, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043b\u0438 \u0438\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c, \u043d\u0435 \u0438\u043c\u0435\u044e\u0449\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443, Searchlight Cyber \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043b\u0430\u0433\u0438\u043d, \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a REST API \u0438\u043b\u0438 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c /wp-json/batch/v1 \u0438 ?rest_route=/batch/v1 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 WAF.\n\nCloudflare \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043e\u0431\u0435\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e WAF \u043d\u0430 \u0432\u0441\u0435\u0445 \u0442\u0430\u0440\u0438\u0444\u043d\u044b\u0445 \u043f\u043b\u0430\u043d\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0435\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Cloudflare, \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0442 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 (CVE-2026-60137), \u0442\u0430\u043a \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API (CVE-2026-63030). \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u0430\u0449\u0438\u0442\u0430 WAF \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u0440\u0438\u0441\u043a\u0438 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043d\u043e \u043d\u0435 \u0437\u0430\u043c\u0435\u043d\u044f\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043f\u0430\u0442\u0447\u0435\u0439.", "creation_timestamp": "2026-07-20T14:00:05.432820Z"}, {"uuid": "f6285ae7-8707-4543-ad7e-f6719bff1788", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mr3hhweoa524", "content": "\ud83d\udee1\ufe0f VULN: WordPress 'wp2shell' pre-auth RCE (CVE-2026-63030 + CVE-2026-60137, chained) now has public exploits targeting 6.9.x/7.0.x. Attackers can run code unauthenticated. If you run WordPress, apply the emergency core patch immediately. Src: BleepingComputer", "creation_timestamp": "2026-07-20T14:02:36.993489Z"}, {"uuid": "c7d5d78a-459e-4953-aa82-5725b1d5311f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "Telegram/ERt8GGFekkTS_ieiBVGmLfcxPIuM72rFTxS1aPb6SalOFNw", "content": "", "creation_timestamp": "2026-07-20T18:00:04.809912Z"}, {"uuid": "9fc83e6f-7c56-4af8-a421-73fd18124272", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/anssi-fr.bsky.social/post/3mr3jbd3dns2r", "content": "\u26a0\ufe0f Vuln\u00e9rabilit\u00e9 WordPress.\n\n\ud83d\udce2 Le CERT-FR a publi\u00e9 une alerte de s\u00e9curit\u00e9 concernant les vuln\u00e9rabilit\u00e9s CVE-2026-60137 et CVE-2026-63030 affectant WordPress.\n\nPlus d'informations sur :\n\u27a1\ufe0f www.cert.ssi.gouv.fr/alerte/CERTF...", "creation_timestamp": "2026-07-20T14:34:49.648604Z"}, {"uuid": "b306cbf0-6326-4944-b10f-60f3d8f3e099", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3l6so5yk2k", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "creation_timestamp": "2026-07-20T15:09:06.003768Z"}, {"uuid": "8ac482a7-93bd-41e0-b37b-5399dec09612", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/116952985194975490", "content": "New.\nPicus: CVE-2026-63030 and CVE-2026-60137 (wp2shell): WordPress RCE Explained https://www.picussecurity.com/resource/blog/cve-2026-63030-and-cve-2026-60137-wp2shell-wordpress-rce-explained #infosec #vulnerability #WordPress", "creation_timestamp": "2026-07-20T15:22:12.139126Z"}, {"uuid": "8941dfc8-640e-497d-9977-6aec6a1e3bd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3ooy4ql22c", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "creation_timestamp": "2026-07-20T16:11:49.799827Z"}, {"uuid": "c4b8c297-a126-4882-8c9d-51833e8d834e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/116953344790464812", "content": "WordPress is used on plenty of websites these days. And unlike vulnerabilities in WordPress plugins, which seem to happen every hour of every day, a vulnerability in WordPress core is kind of a big deal.  This exploit must be doing something very clever, right?\nNo.\nThe endpoint reachable via /?rest_route=/batch/v1 simply takes an author_exclude argument and splats it into a SQL statement.  No need for fancy ' OR 1=1 -- stuff.  Just provide SQL to execute, and WordPress executes it.\nCVE-2026-60137 is this SQL injection stuff, which TBH would make WebGoat blush at. (Nobody would do this ITW)\nCVE-2026-63030 is the REST endpoint route confusion which allows an unauthenticated attacker to reach the vulnerable (to SQL injection) endpoint.\nAt the the point that you have anonymous SQL injection, there are a few steps to get RCE as the user that WordPress runs as.  Throw in any of the bazillion Linux LPEs out there and you can have an attack chain that compromises the entire system.\nOn the upside, the default install of WordPress has an auto-update mechanism enabled by default. And the check happens if it's been more than 12 hours since the last update check. And in the case of my vulnerable VM snapshot from the weekend, it will be updated automatically immediately on boot if it has internet connectivity.", "creation_timestamp": "2026-07-20T16:53:39.973191Z"}, {"uuid": "c7826686-2251-4379-9bbc-ef8a5dfc5213", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3rvbiccf2u", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "creation_timestamp": "2026-07-20T17:09:04.255951Z"}, {"uuid": "8102ef19-4815-440f-8c34-64a9971d9bb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mr3sck6gce2g", "content": "wp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Core\n\n", "creation_timestamp": "2026-07-20T17:16:28.531861Z"}, {"uuid": "1dafac56-c85f-46fa-ad8e-de4ca7c49b77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/GithubRedTeam/94345", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-Wordpress-TOWN\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a lucifer0xf\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 16:28:28\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated Remote Code Execution (RCE) in WordPress Core allows attackers to execute arbitrary code without logging in by chaining CVE-2026-63030 and CVE-2026-60137, potentially leading to full site compromise.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-20T18:00:04.308034Z"}, {"uuid": "a3b1cc42-b784-41cf-94fd-594953cabd34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "Telegram/FDMKvNPIu9DVJe1ShZsaOgvp3N-Hw55ecDYO_07oxLxjtOE", "content": "", "creation_timestamp": "2026-07-20T18:00:04.627645Z"}, {"uuid": "d7b70bc8-a0c9-4c50-98c2-2a5232762ea6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "Telegram/9tpNlnwjVZVYwuWejBnBA-eWQSN8G2bIqRE_fuaoLBUZlFA", "content": "", "creation_timestamp": "2026-07-20T18:00:05.087313Z"}, {"uuid": "02ce7083-6e7e-4d56-aa33-1b6a620fb785", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "Telegram/I861C3_8swM8Zs6o-xbOmuIlEkRcvzkBqQS3mepOhzC8vJk", "content": "", "creation_timestamp": "2026-07-20T18:00:05.198875Z"}, {"uuid": "efa79be2-17c3-4b5d-a6b9-ff7497e55297", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "Telegram/NvyRAPdfWiHuFnDgCWisEYzfqycyb2H27n16VkLUJ0UfwkQ", "content": "", "creation_timestamp": "2026-07-20T18:00:05.248021Z"}, {"uuid": "65354cf7-9d23-49eb-9436-bbe6d64e6674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "Telegram/JKu8MzOeWEiDh6Wy6ZRFCp9pX-H-YlUWAgYEZsV0JVERmls", "content": "", "creation_timestamp": "2026-07-20T18:00:05.343563Z"}, {"uuid": "210a43a5-a835-4002-8c3f-c0d81fb4b106", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "Telegram/w6l8BPd9Q3GJFkZvi7YAaS3nfqUL8sbBpYE2TLByxwgM4Fc", "content": "", "creation_timestamp": "2026-07-20T18:00:05.510347Z"}, {"uuid": "821b0d8f-86ca-4243-acdb-f70ac6c1b8dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "Telegram/WNPKjULv0ephKNyiWQmiLebMVhKs5Yq19I9tIqi1CZzDTIM", "content": "", "creation_timestamp": "2026-07-20T18:00:05.613530Z"}, {"uuid": "4d9c63d5-af2b-4041-afb1-73867128d1ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "Telegram/VNcCH5gAWr1JFL68o0sjgfBXXg-hp68b6HfdKkREhSwhrzw", "content": "", "creation_timestamp": "2026-07-20T18:00:05.712775Z"}, {"uuid": "2b074f5b-3fc3-4075-9dc9-89b4673146ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "Telegram/uumWHaZ1gN7bAvwXVT7WzY5HoAqs0x1gXuRvU8DEoe0NnjY", "content": "", "creation_timestamp": "2026-07-20T18:00:05.831697Z"}, {"uuid": "cf8b1d81-533a-458b-a1ec-e67c513a8371", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "Telegram/CZBJvlZ1W3OH6fsaJgVtYfOnMMQCQpGY5IWdZ_FaTQwAkWo", "content": "", "creation_timestamp": "2026-07-20T18:00:05.925844Z"}, {"uuid": "5d528155-9977-4118-918b-93eced991cb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "Telegram/c_Rzplsy8E2pteouDdziBYUOz2Zf4p3Unq7ANnF9Z7n20HM", "content": "", "creation_timestamp": "2026-07-20T18:00:06.157604Z"}, {"uuid": "40e22af3-c453-4a39-a5c8-f2084a54cf42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "Telegram/FAhkP69mP1IwQSaxAcFWZvu6CnSkNPg4O9iKi7h8BG1-uIM", "content": "", "creation_timestamp": "2026-07-20T18:00:06.262295Z"}, {"uuid": "0bd46f6e-73bc-446a-9f7c-b971a146a795", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3vb2zx3m2g", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "creation_timestamp": "2026-07-20T18:09:19.815394Z"}, {"uuid": "55e5ad26-7178-48f5-9fe9-485a0bc1f674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3ykupw2p2e", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "creation_timestamp": "2026-07-20T19:08:29.546394Z"}, {"uuid": "e7f76eb8-84e9-4a77-9de4-1180f60c667d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr3zks4pdj2e", "content": "\ud83d\udc1b Exploitation in the Wild of wp2shell\n\nhttps://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137\n\n#CVE #CyberSecurity", "creation_timestamp": "2026-07-20T19:26:20.717530Z"}, {"uuid": "f036331d-9253-40ad-915e-e5f3bc52bb3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mr43hh35n52j", "content": "\ud83d\udce2 Exploitation active de deux vuln\u00e9rabilit\u00e9s WordPress (CVE-2026-60137 et CVE-2026-63030)\n\ud83d\udcdd \ud83d\udcf0 **Source** : SecurityWeek \u2014 publi\u00e9 le 20 juillet \u2026\nhttps://cyberveille.ch/posts/2026-07-20-exploitation-active-de-deux-vulnerabilites-wordpress-cve-2026-60137-et-cve-2026-63030/ #CVE_2026_60137 #Cyberveille", "creation_timestamp": "2026-07-20T20:00:15.754821Z"}, {"uuid": "2085d565-0e92-4775-8ecb-4232bf271a31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr43w5haf32x", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "creation_timestamp": "2026-07-20T20:08:32.585132Z"}, {"uuid": "11ffb60e-e289-4a08-8045-b04444222962", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/wordpress-security-advisory-av26-723", "content": "", "creation_timestamp": "2026-07-20T20:15:03.710946Z"}, {"uuid": "59080d8a-ac56-4bb0-9f41-e69627e3417c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr44vvd6xf2k", "content": "\ud83d\udc1b Exploitation in the Wild of wp2shell\n\nhttps://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137\n\n#CVE #CyberSecurity", "creation_timestamp": "2026-07-20T20:26:14.059735Z"}, {"uuid": "75e16b77-6268-4efc-984a-3f5c7765d9d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr47bdkscs2l", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "creation_timestamp": "2026-07-20T21:08:25.751165Z"}, {"uuid": "615db1e2-051e-439d-bf67-f8b2e2dc19cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4a5y7hqv2j", "content": "\ud83d\udc1b Exploitation in the Wild of wp2shell\n\nhttps://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137\n\n#CVE #CyberSecurity", "creation_timestamp": "2026-07-20T21:24:27.723684Z"}, {"uuid": "8d4dbc85-9e04-4077-b582-4a4c7fec7a0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mr4c5g2tg72o", "content": "\ud83e\udd16 CVE-2026-60137 + CVE-2026-63030 (WP2Shell): two WordPress vulns chained for unauthenticated RCE, actively exploited in the wild. Millions of sites exposed.\nhttps://www.darkreading.com/cyberattacks-data-breaches/wp2shell-millions-wordpress-sites-remote-takeover", "creation_timestamp": "2026-07-20T21:59:55.167607Z"}, {"uuid": "94293786-f933-49df-88f5-a2dcb4330abe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "Telegram/VNcCH5gAWr1JFL68o0sjgfBXXg-hp68b6HfdKkREhSwhrzw", "content": "", "creation_timestamp": "2026-07-21T00:00:32.979126Z"}, {"uuid": "24cabf41-e655-4684-8da7-b77a068fecc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4cnjnubc2k", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "creation_timestamp": "2026-07-20T22:08:55.901348Z"}, {"uuid": "c0574ea0-03ac-4da9-9f29-beccb3ae595f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4dja3xsv2y", "content": "\ud83d\udc1b Exploitation in the Wild of wp2shell\n\nhttps://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137\n\n#CVE #CyberSecurity", "creation_timestamp": "2026-07-20T22:24:25.469137Z"}, {"uuid": "c24851db-2324-4199-a1f0-035ee76ca2f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/happeningnow.news/post/3mr4fmwxlzv2g", "content": "'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover\nBarely three days after disclosure, attackers are widely chaining together CVE-2026-60137 and CVE-2026-63030 to lob exploit attempts against one of the largest attack surfaces on\u2026\n\n\ud83d\udd17 https://hnow.live/a/cf051d72", "creation_timestamp": "2026-07-20T23:02:17.962444Z"}, {"uuid": "cd49cc59-5fdb-463a-baad-37bfc9c461e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4fy4kjga2n", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "creation_timestamp": "2026-07-20T23:08:32.690146Z"}, {"uuid": "5f0c29c3-ff93-44d9-a65c-c2f72568c66d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "Telegram/I861C3_8swM8Zs6o-xbOmuIlEkRcvzkBqQS3mepOhzC8vJk", "content": "", "creation_timestamp": "2026-07-21T00:00:32.111546Z"}, {"uuid": "6840a094-0a6b-41a3-8465-af2a15eb6150", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "Telegram/w6l8BPd9Q3GJFkZvi7YAaS3nfqUL8sbBpYE2TLByxwgM4Fc", "content": "", "creation_timestamp": "2026-07-21T00:00:32.653819Z"}, {"uuid": "1f6c8342-0eef-4dd5-a05d-4b47518e7d7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "Telegram/WNPKjULv0ephKNyiWQmiLebMVhKs5Yq19I9tIqi1CZzDTIM", "content": "", "creation_timestamp": "2026-07-21T00:00:32.821269Z"}, {"uuid": "d4451e10-a5d8-4e7e-8e2c-e6906fbd9b0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94276", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Crypto-Cat\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 08:26:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-63030 + CVE-2026-60137, AKA WP2Shell\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-21T00:00:39.667278Z"}, {"uuid": "0a662cbc-557d-43ec-b828-89d5c0a26193", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94260", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-checker\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xjessie21\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 06:44:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress Core Unauthenticated RCE (CVE-2026-63030, CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-21T00:00:39.867846Z"}, {"uuid": "d80f613e-4890-408c-bfc9-6052d2fa084a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "Telegram/ERt8GGFekkTS_ieiBVGmLfcxPIuM72rFTxS1aPb6SalOFNw", "content": "", "creation_timestamp": "2026-07-21T00:00:30.348141Z"}, {"uuid": "c63b0230-346e-4e48-bcd2-0089f2c01e23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "Telegram/aeP7rxdaeHgi9l7o5IqMQwPBOzJ-JvO8EcqSGGDOp43yc4w", "content": "", "creation_timestamp": "2026-07-21T00:00:31.702714Z"}, {"uuid": "ca72adf9-519c-4728-a2fd-80ca24cb286a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "Telegram/9tpNlnwjVZVYwuWejBnBA-eWQSN8G2bIqRE_fuaoLBUZlFA", "content": "", "creation_timestamp": "2026-07-21T00:00:31.916571Z"}, {"uuid": "9100b66f-c288-49c2-a027-58c6a19b9731", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "Telegram/NvyRAPdfWiHuFnDgCWisEYzfqycyb2H27n16VkLUJ0UfwkQ", "content": "", "creation_timestamp": "2026-07-21T00:00:32.195336Z"}, {"uuid": "6f252b9a-7b70-417e-be57-7ec263adb078", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "Telegram/JKu8MzOeWEiDh6Wy6ZRFCp9pX-H-YlUWAgYEZsV0JVERmls", "content": "", "creation_timestamp": "2026-07-21T00:00:32.363301Z"}, {"uuid": "802697dd-e0ef-4e5c-a767-84f4ba212189", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "Telegram/c_Rzplsy8E2pteouDdziBYUOz2Zf4p3Unq7ANnF9Z7n20HM", "content": "", "creation_timestamp": "2026-07-21T00:00:33.706238Z"}, {"uuid": "8892b1c1-7b03-45cf-9017-1f77eabaf158", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "Telegram/FAhkP69mP1IwQSaxAcFWZvu6CnSkNPg4O9iKi7h8BG1-uIM", "content": "", "creation_timestamp": "2026-07-21T00:00:33.864415Z"}, {"uuid": "884e0ee2-476a-4226-95e5-28a9094a73cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://t.me/GithubRedTeam/94345", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-Wordpress-TOWN\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a lucifer0xf\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 16:28:28\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated Remote Code Execution (RCE) in WordPress Core allows attackers to execute arbitrary code without logging in by chaining CVE-2026-63030 and CVE-2026-60137, potentially leading to full site compromise.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-21T00:00:29.680733Z"}, {"uuid": "385b3568-1db5-40bd-858f-cd2023ea3086", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "Telegram/FDMKvNPIu9DVJe1ShZsaOgvp3N-Hw55ecDYO_07oxLxjtOE", "content": "", "creation_timestamp": "2026-07-21T00:00:30.022663Z"}, {"uuid": "f6a81c58-4b3d-4183-b8ee-1397ad02e3f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "Telegram/uumWHaZ1gN7bAvwXVT7WzY5HoAqs0x1gXuRvU8DEoe0NnjY", "content": "", "creation_timestamp": "2026-07-21T00:00:33.187148Z"}, {"uuid": "5fd4c599-c9cc-4398-b161-0a731038f43c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "Telegram/CZBJvlZ1W3OH6fsaJgVtYfOnMMQCQpGY5IWdZ_FaTQwAkWo", "content": "", "creation_timestamp": "2026-07-21T00:00:33.322673Z"}, {"uuid": "18c6d132-001c-4b83-b244-0e9ae4a58c5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/8423", "content": "\u0412 \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u043f\u043e\u043b\u044c\u0435 \u0440\u0430\u0441\u0448\u0430\u0440\u0438\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 wp2shell, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u044f\u0434\u0440\u043e WordPress. \u0412 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 WordPress 6.9.5 \u0438 7.0.2 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a wp2shell.\n\n\u0410\u0442\u0430\u043a\u0430 wp2shell \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u0434\u0432\u0443\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 - CVE-2026-63030 \u0438 CVE-2026-60137, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.x \u0438 7.0.x.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0410\u0434\u0430\u043c\u043e\u043c \u041a\u0443\u044d\u0441\u043e\u043c \u0438\u0437 Searchlight Cyber, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u0443 \u044d\u0442\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u043d\u0435\u0442 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u0439, \u0438 \u043e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 WordPress \u0431\u0435\u0437 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u0432.\n\n\u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0430\u043c Searchlight Cyber, \u0431\u043e\u043b\u0435\u0435 500 \u043c\u043b\u043d. \u0441\u0430\u0439\u0442\u043e\u0432 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 WordPress, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u043e\u0439, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0441\u0435\u0439\u0447\u0430\u0441, \u043a\u043e\u0433\u0434\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b.\n\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 WordPress \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u0441 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438, \u0438 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c WordPress \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.0.2 \u0438\u043b\u0438 6.9.5.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u043d\u0435 \u0432 \u043e\u0434\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430 \u0432 \u0434\u0432\u0443\u0445 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0445 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u0445, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, CVE-2026-63030, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0443\u044e \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0443\u044e\u0441\u044f \u0432 WordPress 6.9. \u041e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u0430 \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\n\n\u0412\u0442\u043e\u0440\u0430\u044f CVE-2026-60137 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432 author__not_in\u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 WP_Query. WordPress \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u0435\u0451 \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0443\u044e WordPress 6.8 \u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u043c WordPress, \u0432\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.9.0-6.9.4 \u0438 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 7.0.0-7.0.1.\n\nSQL-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 WordPress \u0432\u0435\u0440\u0441\u0438\u0439 6.8.0\u20136.8.5, \u043d\u043e \u0435\u0451 \u043d\u0435\u043b\u044c\u0437\u044f \u0441\u0432\u044f\u0437\u0430\u0442\u044c \u0441 RCE, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043e\u0448\u0438\u0431\u043a\u0430, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0443\u0442\u0430\u043d\u0438\u0446\u0435 \u043f\u0440\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API, \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043b\u0438\u0448\u044c \u0432 WordPress 6.9.\n\nSearchlight Cyber \u0432 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043d\u0435 \u0440\u0430\u0437\u0433\u043b\u0430\u0448\u0430\u0435\u0442 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438, \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u0441\u043e\u0437\u0434\u0430\u043b\u0430 wp2shell.com, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043b\u0438 \u0438\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 WordPress.\n\n\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c, \u043d\u0435 \u0438\u043c\u0435\u044e\u0449\u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443, Searchlight Cyber \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043b\u0430\u0433\u0438\u043d, \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a REST API \u0438\u043b\u0438 \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c /wp-json/batch/v1 \u0438 ?rest_route=/batch/v1 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 WAF.\n\nCloudflare \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043e\u0431\u0435\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e WAF \u043d\u0430 \u0432\u0441\u0435\u0445 \u0442\u0430\u0440\u0438\u0444\u043d\u044b\u0445 \u043f\u043b\u0430\u043d\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0435\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Cloudflare, \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044e\u0442 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 (CVE-2026-60137), \u0442\u0430\u043a \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 REST API (CVE-2026-63030). \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u0430\u0449\u0438\u0442\u0430 WAF \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u0440\u0438\u0441\u043a\u0438 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043d\u043e \u043d\u0435 \u0437\u0430\u043c\u0435\u043d\u044f\u0435\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043f\u0430\u0442\u0447\u0435\u0439.", "creation_timestamp": "2026-07-21T00:00:38.652349Z"}, {"uuid": "dfce4d9f-99f9-41dc-aba5-9e85a79ca346", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94301", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dinosn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 31  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 8\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 09:43:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNon-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-21T00:00:38.892025Z"}, {"uuid": "257dc239-db17-457d-a93a-5b1594c26f6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "exploited", "source": "https://t.me/information_security_channel/55596", "content": "WP2Shell WordPress Vulnerabilities Exploited in the Wild\nhttps://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/\n\nExploitation of the new WordPress vulnerabilities tracked as CVE-2026-60137 and CVE-2026-63030 started soon after disclosure.\nThe post WP2Shell WordPress Vulnerabilities Exploited in the Wild (https://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-07-21T00:00:39.234915Z"}, {"uuid": "b5ef1769-2200-4ad4-9bd8-b57a0a81e5f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94292", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a sxwp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a SentinelXofficial\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-20 10:49:08\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress wp2shell pre-auth RCE exploit kit (CVE-2026-63030 + CVE-2026-60137)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-21T00:00:39.402375Z"}, {"uuid": "3d5e3a68-3e86-45c2-9fcb-7b17473979c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94159", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wp2shell\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a N45HT\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-19 14:57:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n[CVE-2026-63030/CVE-2026-60137] Pre Authentication RCE in WordPress Core\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-21T00:00:40.312234Z"}, {"uuid": "087659cf-af19-4f70-8e7d-c5220b506707", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4jcab6g42c", "content": "\ud83d\udea8 CISA KEV [CVSS 9.8 \u00b7 CRITICAL]\nwp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Co\u2026\n\nhttps://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution\n\n#AISecurity #AI #CISA", "creation_timestamp": "2026-07-21T00:07:53.095175Z"}, {"uuid": "a4f99c79-9129-4d10-bced-0b9c8e6216d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-60137", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mr4kiqgubj2k", "content": "\ud83d\udc1b Exploitation in the Wild of wp2shell\n\nhttps://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137\n\n#CVE #CyberSecurity", "creation_timestamp": "2026-07-21T00:29:26.286973Z"}, {"uuid": "00ab81ed-dfc6-4f37-8d61-3dfec8634972", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://www.darkreading.com/cyberattacks-data-breaches/wp2shell-millions-wordpress-sites-remote-takeover", "content": "Barely three days after disclosure, attackers are widely chaining together CVE-2026-60137 and CVE-2026-63030 to lob exploit attempts against one of the largest attack surfaces on the Internet.", "creation_timestamp": "2026-07-21T01:00:55.166777Z"}, {"uuid": "d80ac399-5bdb-4906-95d0-84762e84cb64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://www.cert.at/de/warnungen/2026/7/kritische-sicherheitslucken-in-wordpress-updates-verfugbar", "content": "20. Juli 2026\n\nBeschreibung\n\nIn WordPress existieren zwei Sicherheitslücken. Eine SQL-Injection-Schwachstelle im Parameter „author__not_in“ von „WP_Query“ betrifft WordPress ab Version 6.8. Ab WordPress 6.9 lässt sich diese laut Advisory in Kombination mit einer Schwachstelle in der REST-API (Batch-Route-Confusion) zur Ausführung von beliebigem Code (Remote Code Execution) ausnutzen. Laut Searchlight Cyber ist diese Angriffskette ohne vorherige Authentifizierung und ohne weitere Voraussetzungen in einer Standardinstallation ohne Plugins nutzbar.\n\nAuf GitHub sind mittlerweile mehrere öffentlich verfügbare Proof-of-Concept-Exploits für CVE-2026-63030 veröffentlicht worden. Damit ist der Aufwand für eine Ausnutzung deutlich reduziert; CERT.at rechnet mit Angriffen auf ungepatchte Systeme.\n\nCVE-Nummer(n): CVE-2026-60137, CVE-2026-63030\n\nCVSS Base Score: N/A (Einstufung im GitHub Security Advisory: CVE-2026-60137 „Moderate“, CVE-2026-63030 „Critical“)\n\nAuswirkungen\n\nIn Kombination mit der Schwachstelle in der REST-API ist ab WordPress 6.9 die Ausführung von beliebigem Code auf dem betroffenen System, und damit eine vollständige Kompromittierung der Webseite und des darunterliegenden Systems möglich.\n\nBetroffene Systeme\n\nCVE-2026-60137 (SQL Injection):\n\n\n\nWordPress 6.8.0 bis 6.8.5\n\nWordPress 6.9.0 bis 6.9.4\n\nWordPress 7.0.0 bis 7.0.1\n\n\nCVE-2026-63030 (REST-API Batch-Route-Confusion, RCE):\n\n\n\nWordPress 6.9.0 bis 6.9.4\n\nWordPress 7.0.0 bis 7.0.1\n\nWordPress 7.1 Beta 1\n\n\nWordPress-Versionen vor 6.8 sind nicht betroffen.\n\nAbhilfe\n\nWordPress hat korrigierte Versionen veröffentlicht:\n\n\n\nWordPress 7.0.2 (behebt beide Schwachstellen)\n\nWordPress 6.9.5 (behebt beide Schwachstellen)\n\nWordPress 6.8.6 (behebt CVE-2026-60137)\n\nWordPress 7.1 Beta 2 (behebt beide Schwachstellen)\n\n\nCERT.at empfiehlt, die Aktualisierung umgehend einzuspielen. Das WordPress.org-Team hat für betroffene Versionen erzwungene Updates über das Auto-Update-System aktiviert.\n\nSofern ein Update nicht unmittelbar möglich ist, nennt Searchlight Cyber folgende temporäre Maßnahmen: Deaktivierung der REST-API für nicht authentifizierte Benutzer:innen, Blockieren des Pfads „/wp-json/batch/v1“ sowie des Query-Parameters „rest_route=/batch/v1“ mittels Web Application Firewall (beide Muster müssen blockiert werden), oder Einsatz eines Plugins, das Batch-Requests an die REST-API nur für authentifizierte Benutzer:innen zulässt. Diese Maßnahmen können den regulären Betrieb der Webseite beeinträchtigen und sind nur als temporäre Notmaßnahme bis zum Update vorgesehen.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nWordPress 7.0.2 Release (Englisch)https://wordpress.org/news/2026/07/wordpress-7-0-2-release/\n\nFacilitated SQL injection vulnerability in the author__not_in parameter of WP_Query (Englisch)https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf\n\nREST API batch-route confusion and SQL injection issue leading to Remote Code Execution (Englisch)https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q\n\nwp2shell: Pre Authentication RCE in WordPress Core (Englisch)https://wp2shell.com/\n\nNew wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code (Englisch)https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "creation_timestamp": "2026-07-21T01:00:54.646161Z"}, {"uuid": "a62cafb9-548e-440b-95f7-424afbe29d77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mr4ozc5zwe2w", "content": "wp2shell, a WordPress Core RCE chain (CVE-2026-63030, CVE-2026-60137), is exploited in the wild. Public PoC code is out. Patch WordPress now.\n\n#wp2shell #WordPress #RCE #CVE202663030 #CVE202660137 #InfoSec #WebSecurity #PatchNow", "creation_timestamp": "2026-07-21T01:50:16.091475Z"}, {"uuid": "d3800860-d3f3-44aa-bdb5-84602671dc62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mr4wiof4u42s", "content": "~Akamai~\nUnauthenticated SQLi via WordPress REST Batch API escalates to full RCE on default installations.\n-\nIOCs: CVE-2026-63030, CVE-2026-60137\n-\n#CVE202663030 #RCE #ThreatIntel #WordPress", "creation_timestamp": "2026-07-21T04:04:08.368323Z"}, {"uuid": "5e6fa3cc-1ffd-44f3-bcf9-da1bed25f0bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mr4z4d3u232r", "content": "Top 3 CVE for last 7 days:\nCVE-2026-63030: 65 interactions\nCVE-2026-60137: 51 interactions\nCVE-2026-58532: 47 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-63030: 35 interactions\nCVE-2026-60137: 28 interactions\nCVE-2026-42533: 10 interactions\n", "creation_timestamp": "2026-07-21T04:50:54.911359Z"}, {"uuid": "80e38933-1654-47eb-b728-2544ba8e3593", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mr56futihw2z", "content": "\ud83e\udd16 CVE-2026-60137 + CVE-2026-63030 (WP2Shell): Two critical WordPress core flaws actively exploited. SQLi + REST API confusion enables unauthenticated RCE on millions of sites. PoC public. Patch now.\nhttps://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html", "creation_timestamp": "2026-07-21T06:25:43.930126Z"}, {"uuid": "22f43846-a1c0-4234-b53b-858573237c6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://thehackernews.com/2026/07/wordpress-wp2shell-exploitation-grows.html", "content": "Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites.\n\nThe two security flaws, tracked as CVE-2026-63030 and CVE-2026-60137, have been codenamed wp2shell.\n\n\"By the early hours of Saturday morning (UTC), successful exploitation was already well", "creation_timestamp": "2026-07-21T10:00:53.875716Z"}, {"uuid": "5c94d8b1-5d1b-4190-b6c8-25826b153722", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mr5ojuv4iq2o", "content": "WordPress\u306b2\u3064\u306e\u8106\u5f31\u6027(CVE-2026-63030, CVE-2026-60137)\u304c\u767a\u898b\u3055\u308c\u3001\u672a\u8a8d\u8a3c\u306eRCE\u3068\u30a6\u30a7\u30d6\u30b5\u30a4\u30c8\u306e\u5b8c\u5168\u306a\u4e57\u3063\u53d6\u308a\u304c\u53ef\u80fd\u3002wp2shell\u3068\u3057\u3066\u77e5\u3089\u308c\u308b\u3002", "creation_timestamp": "2026-07-21T11:14:18.821295Z"}, {"uuid": "3f88feff-e656-4b70-b2b4-140f43e3c3cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://www.cert.si/si-cert-2026-04", "content": "", "creation_timestamp": "2026-07-21T12:15:05.780392Z"}, {"uuid": "899085ad-483b-4a06-8b54-b37cf35f5618", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-60137", "type": "seen", "source": "https://www.ncsc.nl/alerts/ernstige-kwetsbaarheden-in-wordpress-core-installeer-updates", "content": "", "creation_timestamp": "2026-07-21T12:45:02.893597Z"}]}