WordPress Core 6.9-7.0.1 - Pre-Auth Blind SQL Injection (Batch-Route Confusion)
WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication timing-based blind SQL injection via the REST API batch endpoint. A route confusion vulnerability (CVE-2026-63030) allows nested batch requests to bypass authentication checks, while a SQL injection flaw (CVE-2026-60137) in the author_exclude parameter of /wp/v2/categories allows arbitrary SQL queries via a SLEEP-based timing oracle. An unauthenticated attacker can extract the full database contents including user credentials. References: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core https://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shell https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ https://github.com/sergiointel/wp2shell-poc/ Remediation: Update WordPress immediately to version 6.9.5 or 7.0.2. As a temporary mitigation, block POST requests to /?rest_route=/batch/v1 at the WAF or reverse proxy level.
10 assets checked · domain, subdomain, ipv4