# WordPress Core Flaw Enables Unauthenticated Code Execution on 500M+ Sites — No CVE Yet
## The Threat
A critical unauthenticated remote code execution vulnerability in WordPress core has forced the project into emergency patching mode just seven months after the vulnerable code shipped. Discovered by Adam Kues at Assetnote (Searchlight Cyber's attack surface management division), the flaw allows an anonymous attacker to execute arbitrary code on any WordPress installation running versions 6.9.0 through 7.0.1 with zero preconditions or authentication required.
The vulnerability stems from a REST API batch-route confusion issue combined with SQL injection in the core query handling logic. The batch endpoint itself is not new—WordPress has maintained this functionality since version 5.6 (November 2020)—but a change introduced in the 6.9 release shifted from protected to exposed handling of batch requests. An attacker can craft a specially formed HTTP request to the /wp-json/batch/v1 endpoint on any vulnerable site and achieve immediate code execution, even on a clean WordPress installation with no plugins, no custom configuration, and no exposed authentication mechanisms.
WordPress responded with forced emergency updates, pushing 6.9.5 and 7.0.2 to users through its auto-update infrastructure on July 17, 2026. However, critical questions remain unanswered: the vulnerability has not been assigned a CVE identifier, no CVSS score has been published, and the full technical details remain under embargo. That gap creates a dangerous window where scanners cannot automatically detect vulnerable instances, patched sites cannot prove their status through standard CVE databases, and defenders lack the signature-based detection necessary to identify active exploitation attempts.
## Severity and Impact
| Aspect | Details |
|--------|---------|
| CVE Identifier | Pending (not yet assigned) |
| CVSS v3.1 Score | Not published |
| Vector String | Not published |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| CWE-89 | SQL Injection |
| Flaw Category | REST API Route Confusion + SQL Injection → RCE |
| Scope of Impact | Remote Code Execution |
Estimated Affected Install Base: WordPress powers over 500 million websites globally. While the flaw only affects versions released in the past eight months (6.9.0 and newer, introduced December 2, 2025), the sheer scale means hundreds of millions of websites fall within the vulnerable version range. Searchlight has not published the exact number of unpatched instances, and no authoritative count exists until broader scanning infrastructure updates to include this vulnerability.
## Affected Products
WordPress versions:
Key Detail: The vulnerability exists in core WordPress code only. A bare WordPress installation with zero plugins is fully exploitable. Default WordPress configurations, shared hosting platforms, managed WordPress services, and all derivative distributions (WordPress.com VIP, Kinsta, WP Engine, Bluehost, etc.) using vulnerable core versions are affected.
## Mitigations
Immediate Actions (in priority order):
1. Update to patched versions immediately: Upgrade to WordPress 6.9.5, 7.0.2, or later. WordPress announced forced auto-updates through its update infrastructure, but verify your actual running version:
- Check via WP-Admin dashboard or wp core version (WP-CLI)
- Do not assume the forced push reached your installation, especially if auto-updates are disabled
2. If you cannot update today, Searchlight Cyber recommends three temporary network-layer mitigations (all carry risk of breaking legitimate integrations):
- Web Application Firewall (WAF): Block traffic to both /wp-json/batch/v1 AND rest_route=/batch/v1 (both routes must be blocked; restricting only the /wp-json path leaves the query-string variant open)
- Disable WordPress REST API entirely: Remove all unauthenticated REST endpoint access via plugin or .htaccess rules (kills legitimate third-party integrations relying on REST)
- Plugin workaround: Deploy a drop-in PHP file that rejects anonymous requests to /batch/v1 at the rest_pre_dispatch hook
3. Verify patch deployment: After updating, confirm the running version is 6.9.5 or 7.0.2+. Automated systems may fail to apply forced updates on hosts with restrictive file permissions, disabled cron, or custom deployment pipelines.
4. Scan for signs of exploitation: Although no active exploitation in the wild has been reported as of July 18, 2026, enable logging on the REST API endpoint and monitor for suspicious batch requests to /wp-json/batch/v1 in web server access logs. Mass exploitation will likely follow within days or hours once public technical details emerge.
## References
---
## HackWire Analysis
The wp2shell vulnerability exposes a critical blind spot in WordPress security infrastructure: the absence of a CVE identifier creates a 24–48 hour window where mass exploitation can occur undetected. While WordPress's forced auto-update system is laudable, the security community cannot inventory vulnerable instances, CISA cannot add the flaw to its Known Exploited Vulnerabilities (KEV) catalog without a CVE record, and traditional vulnerability scanners lack the baseline to flag at-risk sites.
This is not theoretical risk. Searchlight's own research demonstrates WordPress vulnerability exploitation has industrialized: the WP-SHELLSTORM campaign compromised over 17,000 sites using a single patched caching plugin before the vulnerability was even widely known. A Drupal SQL injection patch in May was reverse-engineered into two working proofs of concept within hours of patch release. WordPress is the clear target of choice—half a billion websites is an incomparable attack surface. The combination of recent code (6.9 shipped eight months ago), a pre-authentication RCE, and no CVE barrier means defenders are racing against both automated scanners and opportunistic threat actors.
The REST API batch endpoint's attack window is particularly dangerous because it bypasses WordPress's standard authentication layer entirely. Unlike plugin vulnerabilities (which require non-default configurations), this flaw operates at the framework level. Even hardened deployments—those running security hardening plugins, WAF rules, or network segmentation—will fall if they don't specifically restrict the /batch/v1 route before patching completes.
For hosted WordPress platforms (WP Engine, Kinsta, WordPress.com VIP), the timeline is critical: if they update their infrastructure before individual customer sites apply patches, customers may gain a false sense of security. Verify your actual running version, not your hosting provider's update status. Organizations on enterprise deployments or airgapped infrastructure should treat this as a critical incident and manually validate patch application immediately. The next 72 hours will determine whether this remains a theoretical vulnerability or becomes the next mass-exploitation incident.
— HackWire Editorial
## Related Coverage