WordPress Patches Unauthenticated RCE Flaw in Versions 6.9 and 7.0
Summary
WordPress fixed an unauthenticated core RCE affecting default installs on versions 6.9.0–6.9.4 and 7.0.0–7.0.1. Update to 6.9.5 or 7.0.2; blocking the batch endpoint is a temporary mitigation.
Key points
- An anonymous HTTP request could trigger remote code execution on default WordPress installations with no plugins.
- Affected versions are 6.9.0–6.9.4 and 7.0.0–7.0.1; WordPress released fixes in 6.9.5 and 7.0.2 on July 17, 2026.
- WordPress described the reported issue as REST API batch-route confusion and SQL injection leading to RCE.
- Searchlight Cyber's Adam Kues reported the flaw through WordPress's HackerOne program; detailed technical information has not been published.
- Temporary mitigations include blocking both batch endpoint routes, disabling unauthenticated REST API access, or rejecting anonymous batch requests with a drop-in plugin.
- No exploitation attempts had been reported as of July 18, 2026; the article says the issue had no CVE or CVSS score at that time.
Article Details
- Vulnerability Types
- REST API batch-route confusion
- SQL injection
- Remote code execution
- Severity
- WordPress described one critical and one high-severity flaw in the release but did not specify which severity applies to this issue.
- Affected Versions
- WordPress 6.9.0 through 6.9.4
- WordPress 7.0.0 through 7.0.1
- Exploitation Status
- not_reported
- Exploit Availability
- none_reported
- Patch Status
- available
- Workarounds
- At a WAF, block both /wp-json/batch/v1 and rest_route=/batch/v1.
- Disable the WordPress REST API to block unauthenticated REST access.
- Use a drop-in plugin to reject anonymous /batch/v1 requests at rest_pre_dispatch.