Unauthenticated RCE in WordPress core (wp2shell), via SQL injection

What it is

An unauthenticated remote code execution flaw in WordPress core, patched in an emergency release on July 17. WordPress 7.0.2 fixes it (or 6.9.5 on the 6.9 branch). Adam Kues at Searchlight Cyber reported it; the vuln is dubbed wp2shell, with an exposure checker at wp2shell.com (which has been intermittently offline). It triggers against a stock install with no plugins, so the exposed population is large.

How it works

WordPress core's advisory describes it as a REST API batch-route confusion combined with SQL injection that chains into RCE. The entry point is the batch endpoint at /wp-json/batch/v1. An anonymous attacker escalates the injection into arbitrary code execution — no authentication required.

Preconditions / Affected

The RCE affects:

• WordPress 6.9.0–6.9.4 (fixed in 6.9.5)
• WordPress 7.0.0–7.0.1 (fixed in 7.0.2)
• WordPress 7.1 beta (fixed in 7.1 beta2)

Anything below 6.9.0 is not vulnerable to the RCE. Separately, WordPress 6.8 is exposed to a different SQL injection patched in the same round — 6.8 sites should move to 6.8.6. Versions before 6.8 are unaffected by either issue. WordPress.org has enabled forced auto-updates for affected sites given the severity.

What to do

Update immediately to 7.0.2 (or 6.9.5 on the 6.9 branch). Most sites with background updates will receive it automatically, but confirm the version in your dashboard rather than assuming. If you can't patch right away, the disclosure lists temporary measures:

• Install a plugin that blocks unauthenticated access to the REST API.
• At your WAF, block both the path /wp-json/batch/v1 and the query parameter rest_route=/batch/v1.
• Add a small must-use plugin requiring authentication on the REST batch route.

Caveats

Each temporary measure can interfere with legitimate REST API traffic — treat them as short-term cover, not a substitute for patching. The wp2shell.com checker has been going offline occasionally. Note this is a vendor post: the article promotes Aikido Zen (embedded runtime firewall) as SQL-injection mitigation and Aikido Intel as a vuln feed, which frames the "if you can't patch" advice.