v1.0.0

Standalone mitigation plugin for two actively exploited WordPress core vulnerabilities:

• CVE-2026-60137 — SQL injection via author__not_in in WP_Query: coerces author__in / author__not_in to positive integers before the SQL is built (pre_get_posts priority 0 + request filter).
• CVE-2026-63030 — REST API batch endpoint route confusion, chained to RCE: unregisters /batch/... routes and blocks any dispatch to /batch/ with a 403.

For sites that cannot yet be updated to a patched core (6.8.6 / 6.9.5 / 7.0.2). Remove the plugin once the core is updated.

Tested matrix: PHP 5.4 → 8.2 (logic harness), WordPress 4.9 + PHP 5.6, WP 5.6 + PHP 7.2, WP 5.8 + PHP 7.4, WP 6.4 + PHP 8.2 (full behavioral suite on real installs — no 500s, legitimate REST API unaffected).

Install: download wp2shell-fixer-1.0.0.zip below, upload via Plugins → Add New → Upload Plugin, activate.