# Wordpress Situation is Absolutely Insane

Source: https://www.youtube.com/watch?v=SKuJ60kD8wg
Recap page: https://rapidrecap.app/video/SKuJ60kD8wg
Generated: 2026-07-27T13:37:28.092+00:00

---
## The Gist

WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 contain two chained vulnerabilities that allow unauthenticated remote code execution via a route confusion flaw and a blind SQL injection. Attackers can exploit these flaws by nesting requests within the REST API batch endpoint to create an administrator account and upload a webshell.

## Quick Overview

WordPress contains two critical REST API vulnerabilities that combine to achieve unauthenticated remote code execution. The first bug exploits a route confusion flaw in the batch v1 endpoint to force a GET request through a POST handler, while the second bug uses a blind SQL injection in the post query method to bypass sanitization. Attackers chain these primitives together to fabricate an administrator user and upload a webshell within ten hours of disclosure.

**Key Points:**
- WordPress versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 are affected by a severe unauthenticated remote code execution chain.
- The REST API batch endpoint at batch v1 allows unauthenticated callers to execute multiple sub-requests in a single call.
- A route confusion flaw occurs when path parsing fails and indexes get out of step between validation and matching arrays.
- The second bug relies on a blind SQL injection in the post query method where the author not in parameter lacked integer validation.
- Attackers bypass authorization by using query parameter mismatches to trigger write operations on the author not in field.
- A proof of concept released by Tenable achieves full remote code execution in ten hours using artificial intelligence tools.
- Patches are available in WordPress version 7.0.2 which restricts author not in values to integers and fixes batch handler mappings.

![Screenshot at 08:14: The exploit successfully authenticates as the newly created administrator and deploys a custom webshell on the target server.](https://ss.rapidrecap.app/screens/SKuJ60kD8wg/00-08-14.jpg)

**Context:** WordPress powers over forty percent of all websites on the internet, making its core software a prime target for security researchers and attackers. The discovery of high severity vulnerabilities in core REST API endpoints allows remote actors to completely bypass authentication mechanisms and compromise hosting servers.

## Detailed Analysis

The vulnerability chain begins with the unauthenticated batch v1 endpoint in the WordPress REST API which accepts multiple sub-requests in a single HTTP post. Because the batch handler only supports post requests by design, an attacker exploits an array indexing mismatch between the validation and matching routines to smuggle a get request into a post handler context. This route confusion bypasses normal security checks and triggers a blind SQL injection via the author not in query parameter. By forcing the database to process unvalidated string inputs, the attacker creates a temporary oembed cache post to leak object IDs. These IDs are then utilized in a poisoned batch request to generate a new administrator account. Finally, the attacker logs in with the newly minted administrator credentials to upload and execute a webshell.

### Affected Versions and Scope

The vulnerability impacts specific modern versions of WordPress while leaving older and fully updated installations safe.

- Versions prior to 6.8.5 are completely unaffected by this specific vulnerability chain.
- WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to the exploit.
- Updating the WordPress installation immediately to version 7.0.2 resolves the security flaws.

![Screenshot at 00:52: The vulnerability chart displays the specific affected version ranges for the WordPress core software.](https://ss.rapidrecap.app/screens/SKuJ60kD8wg/00-00-52.jpg)

### Route Confusion in the Batch Endpoint

The first component of the exploit relies on abusing the batch v1 REST API endpoint.

- The batch v1 endpoint is unauthenticated and permits multiple sub-requests within a single call.
- Path parsing inconsistencies cause validation arrays and match arrays to fall out of step during dispatch.
- The route confusion allows an attacker to sneak a get request through a handler designed exclusively for post requests.

![Screenshot at 03:15: Code analysis reveals how the serve batch request function handles parallel arrays and indexing offsets.](https://ss.rapidrecap.app/screens/SKuJ60kD8wg/00-03-15.jpg)

### Blind SQL Injection via Author Filters

The second component injects malicious database commands through unvalidated query parameters.

- The post query method includes an author not in parameter that previously failed to enforce integer values.
- Attackers exploit the route confusion to direct queries into the author not in field without proper sanitization.
- The resulting blind SQL injection creates an object cache hydration poisoning effect.

![Screenshot at 04:32: The source code diff highlights the missing integer validation on the author not in query variable.](https://ss.rapidrecap.app/screens/SKuJ60kD8wg/00-04-32.jpg)

### Privilege Escalation and Webshell Deployment

The final stage leverages the database manipulation to gain administrative access.

- The SQL injection tricks the system into creating a fake post and revealing its cached ID.
- The attacker poisons a batch request using customizer changeset parameters to create an administrator user.
- The newly created administrator account is used to upload and execute a functional PHP webshell.

![Screenshot at 07:57: The readme documentation details the exact sequence of five steps required to achieve remote code execution.](https://ss.rapidrecap.app/screens/SKuJ60kD8wg/00-07-57.jpg)