Holy shit
wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain
" Independent proof-of-concept for the unauthenticated WordPress REST batch route-confusion SQL injection associated with Searchlight Cyber's wp2shell advisory."
https://github.com/Icex0/wp2shell-poc
#WordPress #RCE
stux⚡️
npub1s2…ntwmm
2026-07-27 13:21:48 UTC
Author Public Key
npub1s20wsx5d90r4sqljl03v9g4fw6h7cuhw3rj45qrmxmfr8ea29klqwntwmmPublished at
2026-07-27 13:21:48 UTCEvent JSON
{
"id": "a8c869c760fc697d9b157a6530a7c4be23a2a35f1739a23894e3f40f4ee47df7",
"pubkey": "829ee81a8d2bc75803f2fbe2c2a2a976afec72ee88e55a007b36d233e7aa2dbe",
"created_at": 1785158508,
"kind": 1,
"tags": [
[
"t",
"wordpress"
],
[
"proxy",
"https://mstdn.social/@stux/116992148035124375",
"web"
],
[
"t",
"rce"
],
[
"proxy",
"https://mstdn.social/users/stux/statuses/116992148035124375",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://mstdn.social/users/stux/statuses/116992148035124375",
"pink.momostr"
],
[
"-"
]
],
"content": "Holy shit\n\nwp2shell (CVE-2026-63030 \u0026 CVE-2026-60137) - full RCE chain\n\n\" Independent proof-of-concept for the unauthenticated WordPress REST batch route-confusion SQL injection associated with Searchlight Cyber's wp2shell advisory.\" \n\nhttps://github.com/Icex0/wp2shell-poc\n\n#WordPress #RCE",
"sig": "7ff9c692482083256d61abd3e7e0b41ee71786f0259bf185326d3825be9e9c3ca00d9fbc1197e769d4cd09b843d27c4db6c9dee5043ca8b75f6f46e57c7a7365"
}