WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE

This module chains two WordPress core vulnerabilities, together known as WP2Shell, to gain unauthenticated remote code execution against default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. The vulnerabilities are fixed in WordPress 6.9.5 and 7.0.2. CVE-2026-60137 is an SQL injection in...