SQL Injection Archives

Dark terminal graphic showing four WP-CLI compromise-assessment checks, with verify-checksums clean and an unknown administrator, unknown application password and two PHP files in uploads flagged red

You Patched wp2shell. Now Prove You Were Not Already Breached

Both wp2shell CVEs went into CISA's KEV catalog on 21 July and public exploits are circulating. Patching closed the door; it did not tell you whether anyone was already inside. A WP-CLI compromise-assessment runbook, and the line where cleanup stops and rebuild begins.

Varun Dubey · July 29, 2026 · 11 min read

Dark terminal graphic reading wp2shell with CVE-2026-63030 and CVE-2026-60137, showing wp core version returning 7.0.1 as exposed and wp core update installing WordPress 7.0.2

Security

wp2shell: The WordPress Core RCE Chain That Needs No Login

Two chained WordPress core flaws give an anonymous attacker remote code execution on a default install. What CVE-2026-63030 and CVE-2026-60137 actually are, how to check your exposure with WP-CLI, and how to tell whether you were hit before you patched.

Varun Dubey · July 26, 2026 · 11 min read

Security

7 WordPress Security Mistakes Even Experienced Developers Make

Even seasoned WordPress developers make predictable security mistakes: nonce misuse, missing capability checks, SQL injection via $wpdb, incorrect file permissions, debug mode in production, no direct file access protection, and gaps in sanitization and escaping. This guide shows each mistake with the wrong pattern and the correct fix.

Varun Dubey · March 11, 2026 · 11 min read

Tag: SQL Injection

You Patched wp2shell. Now Prove You Were Not Already Breached

wp2shell: The WordPress Core RCE Chain That Needs No Login

7 WordPress Security Mistakes Even Experienced Developers Make