hey yes just surfed a bit and found electrium 2.6 to 3.0.4 was vulnerable by jsonrpc command for 2 years already.
so nothing new , my bad actually, just updated elctrium to 3.1.3 latest version as of toady. thanks