SQL injection isn't dead

What it is

A July 17 emergency WordPress core release fixing an unauthenticated remote code execution flaw reachable via SQL injection on a stock install. The summary names the bug class; the page adds the concrete remediation target and the response WordPress.org took. Searchlight Cyber reported it and estimates over 500 million sites run WordPress.

Preconditions / Affected

A stock WordPress install is exploitable by an anonymous, unauthenticated attacker — no account or configuration change required. The page frames this as reachable on default installs, which is what drove the severity rating.

What to do

Per the page, move affected sites to Version 7.0.2, or 6.9.5 for the older branch. WordPress.org enabled forced auto-updates because of the severity, so many sites may already be patched — but confirm your version rather than assume the auto-update reached you.

Beyond the WordPress-specific fix, the article's general prescription is unchanged from the summary: parameterized queries, input allowlists, and a RASP-style runtime backstop (its pitch is Aikido Zen). The one framework-specific detail worth carrying is that ORMs (Django, Hibernate, ActiveRecord) parameterize by default but the protection evaporates the moment code drops to a raw query or an unsafe method — the Django CVE-2024-42005 case being a "safe" JSON-field method that passed field names into SQL unsanitized. Audit raw-query escapes and JSON-column field access specifically, not just obvious concatenation.

Caveats

• The AI-generated-code figures are soft: the 40% "Asleep at the Keyboard" number is from a 2021 Copilot study, and the ~12% ChatGPT figure comes from Aikido's own field CTO running one prompt a few hundred times — not a systematic benchmark. The author explicitly notes these "will be out of date in six months."
• The "20% of projects had a SQLi flaw on first scan" and "one in ten of everything reported" stats come from the vendor's own scans and its reading of the GitHub Advisory Database.
• OWASP moving injection from third to fifth in its 2025 Top 10 is real but, the page argues, not evidence the problem shrank — injection still carries the most reported CVEs (60,000+, of which 14,000+ are SQLi).

Note the version numbers (7.0.2 / 6.9.5) as stated on the page; verify them against WordPress's own advisory before acting, since they read unusually for the WordPress release line.