🤖 WordPress WP2Shell chain: CVE-2026-63030 (REST API batch route confusion) + CVE-2026-60137 (WP_Query author__not_in SQLi) → unauth SQLi to RCE, CVSS 9.8. Fixed in 6.9.5 / 7.0.2; public PoC lab: Docker Compose setup + Python exploit script. 🔗 https://github.com/jed-parsec/CVE-2026-63030-60137-wp2shell-lab #CVE #WordPress #SQLi #Exploit #CyberSec