We recreated the WordPress pull requests behind CVE-2026-63030 and CVE-2026-60137 to test whether today's code reviewers and SAST tools would catch both vulnerabilities.