CVE-2026-63030-POC

wp2shell — CVE-2026-63030 + CVE-2026-60137 一日WordPress RCE利用链。未经身份验证。CVSS 9.8。 零依赖 — 仅需Python 3.8+标准库。 受影响版本 分支| 受影响版本| 已修复版本 ---|---|--- 6.9.x| 6.9.0 – 6.9.4| ≥ 6.9.5 7.0.x| 7.0.0 – 7.0.1| ≥ 7.0.2 利用链 两个CVE串联成未经身份验证的远程代码执行： CVE-2026-63030 route confusion → batch desync bypasses auth +...

abdal-cve-2026-60137

English | فارسی 🛡️ Exploits PoC de Abdal CVE-2026-60137 Abdal CVE-2026-60137 es un verificador defensivo de exposición para WordPress que detecta la sanitización insuficiente del parámetro authornotin en WPQuery, registrado como CVE-2026-60137. La vulnerabilidad puede permitir inyección SQL cuando...

CVE-2026-60137

wpsqli - Extractor SQLi de WordPress CVE-2026-60137 Una herramienta rápida de extracción de bases de datos basada en menús que explota la vulnerabilidad de inyección SQL authornotin en el núcleo de WordPress. Esta herramienta se centra exclusivamente en la enumeración y el volcado de bases de...

CVE-2026-60137-WordPress-Core-SQL-Injection-PoC

CVE-2026-60137 — PoC de inyección SQL en el núcleo de WordPress Prueba de concepto no destructiva y banco de verificación para CVE-2026-60137 , una inyección SQL ciega en el núcleo de WordPress WPQuery::authornotin, accesible a través del parámetro authorexclude de la API REST. Causa raíz...

Exploit for SQL Injection in Wordpress

WP2Shell — Unauthenticated SQL Injection Proof of Concept C...

BIT-WORDPRESS-MULTISITE-2026-60137 WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

WP < 7.0.2 - Facilitated SQLi

Description WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

CVE-2026-60137

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

UBUNTU-CVE-2026-60137

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

CVE-2026-60137

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

CVE-2026-63030: Interpretation Conflict

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

CVE-2026-60137: Improper Neutralization of Special Elements used in an SQL Command

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...