Wordpress Situation is Absolutely Insane | Low Level

The Gist

WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 contain two chained vulnerabilities that allow unauthenticated remote code execution via a route confusion flaw and a blind SQL injection. Attackers can exploit these flaws by nesting requests within the REST API batch endpoint to create an administrator account and upload a webshell.

Quick Overview

WordPress contains two critical REST API vulnerabilities that combine to achieve unauthenticated remote code execution. The first bug exploits a route confusion flaw in the batch v1 endpoint to force a GET request through a POST handler, while the second bug uses a blind SQL injection in the post query method to bypass sanitization. Attackers chain these primitives together to fabricate an administrator user and upload a webshell within ten hours of disclosure.

Key Points: WordPress versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 are affected by a severe unauthenticated remote code execution chain. The REST API batch endpoint at batch v1 allows unauthenticated callers to execute multiple sub-requests in a single call. A route confusion flaw occurs when path parsing fails and indexes get out of step between validation and matching arrays. The second bug relies on a blind SQL injection in the post query method where the author not in parameter lacked integer validation. Attackers bypass authorization by using query parameter mismatches to trigger write operations on the author not in field. A proof of concept released by Tenable achieves full remote code execution in ten hours using artificial intelligence tools. Patches are available in WordPress version 7.0.2 which restricts author not in values to integers and fixes batch handler mappings.

Context: WordPress powers over forty percent of all websites on the internet, making its core software a prime target for security researchers and attackers. The discovery of high severity vulnerabilities in core REST API endpoints allows remote actors to completely bypass authentication mechanisms and compromise hosting servers.