cyber.hendryadrian.com
Vulnerability & Exploit · aikido.dev

WordPress Patches Unauthenticated RCE Vulnerability Chained From SQL Injection

· Original article ↗

Summary

WordPress 7.0.2 and 6.9.5 fix an unauthenticated RCE flaw involving REST API batch-route confusion and SQL injection. The article urges affected sites to patch and outlines temporary mitigations.

Key points

  • The article says the flaw can enable unauthenticated remote code execution on affected WordPress installations without plugins.
  • WordPress versions 6.9.0–6.9.4 are fixed in 6.9.5; versions 7.0.0–7.0.1 are fixed in 7.0.2; WordPress 7.1 beta is fixed in beta2.
  • The article describes the issue as REST API batch-route confusion chained with SQL injection, with /wp-json/batch/v1 as an entry point.
  • WordPress reportedly enabled forced auto-updates for affected sites, but administrators are advised to confirm installed versions.
  • Temporary mitigations include restricting unauthenticated REST API access or blocking the batch route and rest_route=/batch/v1; these measures may disrupt legitimate API traffic.
  • The article says WordPress 6.8 has a separate SQL injection issue fixed in 6.8.6.
  • A checker is available at wp2shell[.]com, though the article notes it may go offline intermittently.

Article Details

Vulnerability Types
  • Unauthenticated remote code execution
  • SQL injection
Affected Versions
  • WordPress 6.9.0 through 6.9.4
  • WordPress 7.0.0 through 7.0.1
  • WordPress 7.1 beta
  • WordPress 6.8 (separate SQL injection issue)
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Install a plugin that blocks unauthenticated access to the REST API.
  • Block /wp-json/batch/v1 and rest_route=/batch/v1 at the WAF.
  • Add a must-use plugin requiring authentication on the REST batch route.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe article describes an anonymous attacker triggering a vulnerability in a stock WordPress installation through its REST API batch endpoint to achieve remote code execution.

People

Adam KuesReported the WordPress flaw and published a checker for testing exposure.

Vendors

Aikidoauto-updates for affected sites because of how severe this is. We are tracking this vulnerability in Aikido Intel.

Products

Aikido Intelauto-updates for affected sites because of how severe this is. We are tracking this vulnerability in Aikido Intel.Aikido ZenGetting on the correct version is top priority. If you run Aikido Zen, its embedded firewall is built to block the SQL injection this flaw relies on, so an unpatched site keeps a runtime defense while the update rollsWordPressSQL injections are still among us. On July 17, WordPress released an emergency security update. Version 7.0.2 fixes an unauthenticated remote code execution flaw in WordPress core that an anonymous attacker can trigger

Related Articles