{"uuid": "4757680a-fa1c-47fa-b7a1-be012c65f220", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63030", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwjpvrz2qr22", "content": "\ud83e\udd16 WP2Shell: WordPress CVE-2026-63030 (REST API batch route confusion) + CVE-2026-60137 (WP_Query author__not_in SQLi) chain into unauth SQLi\u2192RCE, CVSS 9.8. Fixed in 6.9.5/7.0.2. PoC lab:\nhttps://github.com/jed-parsec/CVE-2026-63030-60137-wp2shell-lab", "creation_timestamp": "2026-09-27T21:16:46.659302Z"}