VulnBox WP2Shell (CVE-2026-63030 and CVE-2026-60137): WordPress 6.9, 6.9.1, 6.9.2, 6.9.3, 6.9.4, 7.0, 7.0.1 - Unauthenticated Remote Code Execution (Route Confusion and SQL Injection) - Jul 21, 2026 CVE-2026-63030: WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 - Route Confusion CVE-2026-60137: WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 - SQL Injection