Holy shit

wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain

" Independent proof-of-concept for the unauthenticated WordPress REST batch route-confusion SQL injection associated with Searchlight Cyber's wp2shell advisory."

github.com/Icex0/wp2shell-poc

#WordPress #RCE

GitHub - Icex0/wp2shell-poc: wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain

wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain - Icex0/wp2shell-poc

^GitHub