Provenance Record

Well-structured News piece with clear Overview / What We Know / Timeline / What We Don't Know / Analysis sections. Technical depth is appropriate and accurate (PHP code injection mechanism, CVSS vector, CWE classification). Word count (617) is within the News range (400-1200).

All four source snapshots read from disk and verified; sha256 of each uncompressed snapshot matches manifest.json exactly. source-0 (The Hacker News, 200): confirms CVE-2026-3300, unauthenticated RCE, CVSS 9.8, patch March 18 2026 / v1.9.13, exploitation from April 13 2026, 29,300 attempts blocked, Complex Calculation feature, sanitize_text_field() gap, diksimarina admin account + diksimarina@gmail.com + IP 202.56.2.126, ~4,000 installs. source-1 (Infosecurity Magazine, 200): confirms CVSS 9.8, affects up to/including 1.9.12, WPEverest, ~4000 installs, reported via Wordfence bug bounty by handle h0xilo, patched in 1.9.13, attacks began April 13 2026, 29,300 total blocked, May 16 surge over 17,900 in a single day, diksimarina, 202.56.2.126 source of more than 26,300 attempts. source-2 (NVD, 200, primary): confirms verbatim the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base score 9.8 CRITICAL (CNA: Wordfence), CWE-94 Improper Control of Generation of Code (Code Injection), affected versions up to and including 1.9.12, and the process_filter()/eval()/sanitize_text_field() root-cause description. source-3 (SecurityWeek, 200): contains verbatim the direct quote attributed to it ('unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field'), which SecurityWeek attributes to Defiant (Wordfence's maker); also corroborates CVE, CVSS 9.8, v1.9.13, April 13 exploitation, diksimarina, and remediation guidance.

Every number, name, date, and code traces to a cited source: CVE-2026-3300, CVSS 9.8, the full CVSS vector and CWE-94 (NVD), v1.9.12 affected / v1.9.13 fixed, March 18 patch, April 13 exploitation start, 29,300 blocked attempts, May 16 surge of 17,900, IP 202.56.2.126 as source of 26,300+, diksimarina account, h0xilo researcher handle, ~4,000 Pro installs, and the process_filter() root cause. The one direct quote (to SecurityWeek) appears verbatim in the snapshot. No hallucinations detected.

High-quality, fully sourced cybersecurity News submission. All integrity checks pass (including valid Ed25519 signature), all four sources personally read and verified against the claims attributed to them, the single direct quote is verbatim, and every specific is traceable. APPROVE.