WordPress Core is a widely used content management system that powers millions of websites across the globe. Managed by developers, bloggers, and businesses, WordPress offers an extensive plugin architecture and template system to create a wide array of websites from blogs to e-commerce platforms. It is favored for its ease of use, large community support, and adaptability. However, due to its extensive use, it is a common target for cyber attackers looking to exploit vulnerabilities to gain unauthorized access to sensitive data.
The Pre-Authorization SQL Injection vulnerability in WordPress Core allows unauthenticated attackers to exploit the REST API batch endpoint, leading to potential data breaches. By leveraging a route confusion flaw, attackers can bypass normal authentication processes and inject arbitrary SQL queries. This security flaw can be manipulated via a SLEEP-based timing oracle attack, allowing the extraction of sensitive database information instantaneously. The vulnerability impacts specific versions of WordPress Core, necessitating immediate attention to secure affected systems.
Technical details of the vulnerability highlight the manipulation of the "author_exclude" parameter of the /wp/v2/categories endpoint in the REST API batch requests. Attackers make use of nested batch requests, thereby bypassing authentication checks and executing arbitrary SQL commands. By crafting specific requests aimed at logic flaws in the route handling of the API, the vulnerability enables attackers to perform actions without requiring authentication. This highlights significant flaws in the endpoint's validation mechanisms, making it susceptible to timing-based SQL injection attacks.
Exploitation of this vulnerability poses severe risks, as it can lead to full site compromise. Attackers could extract the WordPress database contents, revealing user credentials, posts, stored secrets, and configuration data. Once credentials are extracted, offline password cracking might permit attackers to gain further access, potentially leading to full remote code execution. This highlights the gravity of the vulnerability, emphasizing the need for immediate patching and mitigation measures.
REFERENCES
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
- https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core
- https://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shell
- https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
- https://github.com/sergiointel/wp2shell-poc/
- Update WordPress installations to version 6.9.5 or 7.0.2 immediately to patch this vulnerability.
- As a temporary mitigation, configure the web application firewall (WAF) or reverse proxy to block POST requests to the /?rest_route=/batch/v1 endpoint.
- Regularly monitor and audit database queries and access logs for unauthorized activities.
- Educate your development teams about secure coding practices to prevent similar issues in the future.
- Consider implementing additional access controls on the REST API endpoints to strengthen security.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →