Happy Friday! Without further ado, here's the Initial Access Intelligence team's exploit delivery for this week.
Immediately following disclosure on July 17, the VulnCheck team began working on an exploit for CVE-2026-63030 and CVE-2026-60137, a pre-authentication remote code execution chain in WordPress core. Nicknamed "WP2Shell," the exploit chains a REST API batch-route confusion flaw with an unauthenticated SQL injection in WP_Query (CVE-2026-60137) to reach code execution on a default installation, with no plugins or special configurations required. An initial exploit was available in the feed on Saturday, July 18, with additional improvements and another variant shipped on Monday, July 20. Over the past week, VulnCheck has validated 40+ public exploits targeting the vulnerabilities. Exploitation in the wild is ongoing — both CVEs were added to VulnCheck KEV on July 17, 2026 and to CISA KEV on July 21, 2026. The team's Censys query finds tens of millions of WordPress installations online.
Our exploit ships with a version scanner, a Docker target, PCAPs, Suricata and Snort rules, a YARA rule, and ASM queries; an information-disclosure exploit variant covers the blind SQL-injection credential read. More details are available in our emerging threat blog.
This week, the team developed an exploit for CVE-2026-61501, a stored XSS vulnerability in Rejetto HFS, a widely used open-source HTTP file server with a notable history of in-the-wild exploitation. The vulnerability was discovered by Zach Hanley of Horizon3.ai and reported through VulnCheck's coordinated disclosure service. An unauthenticated attacker can plant a payload with a single failed login attempt; it then runs in the administrator's browser the moment they open the log viewer. From that foothold, our exploit offers two paths: creating a new administrator account or achieving remote code execution on the host. No in-the-wild exploitation has been reported yet. Our Censys query finds around 680 potentially vulnerable HFS instances online.
Our exploit ships with a version scanner, a Docker target, PCAPs, Suricata and Snort rules, a YARA rule, and ASM queries.
The team developed an exploit for CVE-2026-53576, an unauthenticated RCE vulnerability in popular open-source workflow orchestration platform Kestra. In the vendor's own recommended Docker deployment, that container is handed access to the host's Docker socket, so code execution inside the container becomes full takeover of the underlying host. The vulnerability hasn't yet been exploited in the wild, but we believe that's likely to change. The team's Censys query finds around 450 internet-exposed Kestra instances. Our exploit ships with a version scanner, a target Docker container, PCAPs, Suricata and Snort detection rules, and ASM queries.
The team added an exploit for CVE-2025-14931, an unauthenticated RCE vuln in Hugging Face smolagents, a widely used Python framework for building agentic AI applications. Its remote Python executor trusts the Jupyter kernel server it connects to and deserializes the server's replies with pickle; a rogue server can return a crafted pickle that executes arbitrary code on the smolagents host (CWE-502). This is a client-side issue, so it is exploitable wherever an executor can be pointed at an attacker-controlled Jupyter endpoint, with no authentication. As a client-side flaw it exposes no network surface to fingerprint, so no ASM queries are included. Our exploit stands up a rogue Jupyter server and ships with a PCAP and network rules.
The team added an exploit for CVE-2026-56291, an unauthenticated arbitrary file upload leading to RCE in Balbooa Forms (com_baforms), a form-builder extension for Joomla. Versions before 2.4.1 expose the form.uploadAttachmentFile front-end task with no token or access check, letting an unauthenticated attacker upload a PHP file into a publicly served directory and gain remote code execution as the web user. Amid in-the-wild exploitation, the vulnerability was added to VulnCheck KEV on July 8, 2026 and to CISA KEV two days later. Our ZoomEye query identifies around 1,980 internet-exposed Joomla sites running Balbooa Forms.
Our exploit ships with a version scanner, PCAPs, Suricata and Snort rules, a YARA rule, and ASM queries.
The team also developed an exploit for CVE-2026-48939, an unauthenticated arbitrary file upload leading to RCE in iCagenda (com_icagenda), a Joomla events-management extension by JoomliC. The front-end event-submission controller enforces only a CSRF token and never an access check, so a logged-out caller can upload a PHP file into a web-served directory and gain remote code execution as the web user. The vulnerability has been on VulnCheck and CISA KEV since July 10, 2026, though no specific attribution has been reported. The team's ZoomEye query identifies more than 1,900 internet-exposed Joomla sites running iCagenda.
Our exploit ships with a version scanner, a Docker target, PCAPs, Suricata and Snort rules, a YARA rule, and ASM queries.
Finally, the team added coverage for CVE-2022-21587, an unauthenticated file upload vulnerability impacting versions 12.2.3 - 12.2.11 of Oracle E-Business Suite. The vulnerability was disclosed in October of 2022 before being confirmed exploited in February 2023. Like CVE-2025-61882 and CVE-2025-61884, CVE-2022-21587 became an appealing target for threat actors, with in-the-wild exploitation being attributed to Earth Krahang and Wazawaka. Shadowserver also reports exploitation as recently as May 15th of this year. Our Censys query reports just over 3,500 instances of Oracle E-Business Suite online.
Coverage includes an exploit, PCAPs, network signatures, a YARA rule, and ASM queries.