The one to price is wp2shell. Two bugs, one request path: CVE-2026-63030 confuses the WordPress REST batch route into dispatching a request it should have rejected, and that request reaches WP_Query, where CVE-2026-60137 interpolates `author__not_in` into SQL as a string [8]. No login required. Core 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are in range, and 6.9.5 and 7.0.2 closed it on 17 July 2026 [8]. Anything still on an old branch has been reachable since then. What changed this week is the cost of finding it.
Note what the module actually is. The wp2shell addition is an auxiliary scanner limited to confirming the injection, stopping short of shell access [8]. Drupal is the same shape: CVE-2026-9082 is an unauthenticated SQL injection in the PostgreSQL EntityQuery condition handler, and the module proves it with time-based blind queries rather than exploiting it [6]. Across the eleven modules the release notes describe [14], eight are auxiliary and three are exploits [16]. Five of the sixteen carry no description in the notes at all [15], though the summary places Flowise, Langflow, Ruby and SPIP among the exploit set [2].
The exploits that are described want credentials first. Both Tenable Security Center modules are authenticated remote code execution, one through SCAP audit file command injection [11] and one through report charting [12]. That is where the file-read modules in the same release matter. Forgejo's CVE-2026-59774 reads arbitrary files across 7.0 to 15.0.5 and 16.0.0 to 16.0.1 [3]. The Planyo plugin's `ulap.php` AJAX proxy does not validate the scheme of URLs handed to it, so an unauthenticated `file://` request returns local file contents in plugin versions before 3.1 [4]. An attacker could read a config to pull a credential, then use it to run the authenticated exploit. Both halves now ship in the same framework.
One ledger defect worth catching before it reaches a ticket: the report charting entry names CVE-2026-21820 in its description while its own module path reads `cve_2026_19626`, and the pull request number is 21820 [12]. The module path is the more reliable identifier here, and it is worth checking a scanner's mapping against it before trusting the advisory number in the description.
The SCADA additions are inventory tools rather than attack tools. An Ignition gateway fingerprint probes unauthenticated info endpoints across version families [9], and a companion module detects OPC-UA servers over the `opc.tcp://` binary transport [10]. The PAN-OS addition sits in the same category, a checker for CVE-2026-0265 on GlobalProtect portals with Clientless Application Services enabled [7]. Concrete CMS rounds it out: 9.x before 9.5.1 serves the file usage dialog controller with no view permission check [5]. The Check Point SmartConsole authentication bypass module is named in the notes, and the supplied excerpt stops before any detail on it [13].
