--- title: Wordpress Situation is Absolutely Insane | daily.dev description: A detailed breakdown of two chained WordPress vulnerabilities (affecting versions 6.8.5 through 7.0.1) that together enable unauthenticated remote code... canonical: https://daily.dev/posts/wordpress-situation-is-absolutely-insane-xsgsiwdxn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Wordpress Situation is Absolutely Insane | daily.dev og:description: A detailed breakdown of two chained WordPress vulnerabilities (affecting versions 6.8.5 through 7.0.1) that together enable unauthenticated remote code... og:url: https://daily.dev/posts/wordpress-situation-is-absolutely-insane-xsgsiwdxn og:image: https://api.daily.dev/og/posts/XSgsIwdXn.png og:image:alt: Wordpress Situation is Absolutely Insane og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Wordpress Situation is Absolutely Insane **[Low Level Learning](https://daily.dev/sources/lowlevellearning)** · 10 min read · 51 upvotes · 13 comments ## Summary A detailed breakdown of two chained WordPress vulnerabilities (affecting versions 6.8.5 through 7.0.1) that together enable unauthenticated remote code execution. The first bug is a route confusion in the REST API batch v1 endpoint that allows dispatching GET requests where only POST should be permitted. The second is a blind SQL injection in the post query's author_not_in field that bypasses sanitization when reached via the route mismatch. The exploit chains these to poison WordPress's internal object cache, create a fake admin user, and upload a web shell plugin — all without authentication. A proof-of-concept emerged just 10 hours after disclosure, reportedly with AI assistance. Users on WordPress 7.0.2 or later are not affected; those on versions before 6.8.5 are also not vulnerable. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@doncho** · 10 upvotes > For such a widespread product, WordPress is having so many attackers (including wannabe AI hackers) so it's inevitable to have a critical bug or two discovered. > > > Always be updated 😀 **@agalimberti** · 4 upvotes > i ditched wordpress and php 25 years ago... **@springtofigh** · 4 upvotes > Well, I couldn't agree more with some developers, sometimes WordPress security is really gone to the door. **@zshall** · 1 upvotes > Server-based CMSes like Wordpress make sense for large enterprise use with user-level permissions, teams and collaboration and interactivity (comments, etc.) but in my personal use cases I've found that static site generation is a better fit. You can't hack a database if you don't have one. Systems like Astro that can build a static site as part of a CI action and publish to staging or production based on Git branches are quite rad. Programs like Publii are also neat in case you prefer a desktop-based publishing program that generates a static site instead. **@gaburayondev** · 1 upvotes > Good writeup of a nasty chain, though worth double-checking the version range against WordPress's own advisory — the fix is 7.0.2 (not 7.0.1), patched across 6.8.6/6.9.5/7.0.2. The batch-route confusion is the more interesting bug of the two IMO: two parallel arrays going out of sync by one index so a sub-request gets dispatched with the wrong handler is a subtle enough bug that it's easy to see how it sat undetected. Chaining that into the author__not_in string-vs-array sanitization gap is a clean example of "neither bug alone is exploitable, together it's critical." --- Tags: [#sql](https://daily.dev/tags/sql), [#wordpress](https://daily.dev/tags/wordpress), [#web-security](https://daily.dev/tags/web-security) [View this post on daily.dev](https://daily.dev/posts/wordpress-situation-is-absolutely-insane-xsgsiwdxn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Wordpress Situation is Absolutely Insane","url":"https://daily.dev/posts/wordpress-situation-is-absolutely-insane-xsgsiwdxn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/wordpress-situation-is-absolutely-insane-xsgsiwdxn"},"datePublished":"2026-07-27T13:32:45.560Z","dateModified":"2026-07-28T02:17:29.331Z","description":"A detailed breakdown of two chained WordPress vulnerabilities (affecting versions 6.8.5 through 7.0.1) that together enable unauthenticated remote code...","image":"https://i.ytimg.com/vi/SKuJ60kD8wg/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/SKuJ60kD8wg/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Low Level Learning","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Low Level Learning","logo":"https://media.daily.dev/image/upload/s--pjLyMMmx--/f_auto/v1724394406/logos/lowlevellearning","url":"https://daily.dev/sources/lowlevellearning"},"commentCount":13,"discussionUrl":"https://daily.dev/posts/wordpress-situation-is-absolutely-insane-xsgsiwdxn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":51},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":13}],"keywords":"sql,wordpress,web-security","timeRequired":"PT10M","video":{"@type":"VideoObject","name":"Wordpress Situation is Absolutely Insane","description":"A detailed breakdown of two chained WordPress vulnerabilities (affecting versions 6.8.5 through 7.0.1) that together enable unauthenticated remote code...","thumbnailUrl":"https://i.ytimg.com/vi/SKuJ60kD8wg/sddefault.jpg","uploadDate":"2026-07-27T13:32:45.560Z","duration":"PT10M","url":"https://api.daily.dev/r/XSgsIwdXn","embedUrl":"https://www.youtube.com/embed/SKuJ60kD8wg"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Low Level Learning","item":"https://daily.dev/sources/lowlevellearning"},{"@type":"ListItem","position":3,"name":"Wordpress Situation is Absolutely Insane"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/wordpress-situation-is-absolutely-insane-xsgsiwdxn","comment":[{"@type":"Comment","text":"For such a widespread product, WordPress is having so many attackers (including wannabe AI hackers) so it’s inevitable to have a critical bug or two discovered.\nAlways be updated 😀","datePublished":"2026-07-28T05:22:35.557Z","url":"https://daily.dev/posts/XSgsIwdXn#c-AT5erNH2r","author":{"@type":"Person","name":"Doncho Angelov","url":"https://daily.dev/doncho","image":"https://media.daily.dev/image/upload/s--j1MSm0hy--/f_auto/v1716369534/avatars/avatar_EB0j0Umzh5v3zGWUSL5ma"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":10}},{"@type":"Comment","text":"i ditched wordpress and php 25 years ago…","datePublished":"2026-07-28T10:06:18.587Z","url":"https://daily.dev/posts/XSgsIwdXn#c-UGE3XTBQK","author":{"@type":"Person","name":"Aldo Galimberti","url":"https://daily.dev/agalimberti","image":"https://avatars.githubusercontent.com/u/93255079?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4}},{"@type":"Comment","text":"Well, I couldn’t agree more with some developers, sometimes WordPress security is really gone to the door.","datePublished":"2026-07-27T20:41:59.047Z","url":"https://daily.dev/posts/XSgsIwdXn#c-IUgDjSjP0","author":{"@type":"Person","name":"Spring Tofigh","url":"https://daily.dev/springtofigh","image":"https://avatars.githubusercontent.com/u/90114320?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4}},{"@type":"Comment","text":"Server-based CMSes like Wordpress make sense for large enterprise use with user-level permissions, teams and collaboration and interactivity (comments, etc.) but in my personal use cases I’ve found that static site generation is a better fit. You can’t hack a database if you don’t have one. Systems like Astro that can build a static site as part of a CI action and publish to staging or production based on Git branches are quite rad. Programs like Publii are also neat in case you prefer a desktop-based publishing program that generates a static site instead.","datePublished":"2026-07-28T14:45:14.409Z","url":"https://daily.dev/posts/XSgsIwdXn#c-dpmpLoUcq","author":{"@type":"Person","name":"Zach Hall","url":"https://daily.dev/zshall","image":"https://media.daily.dev/image/upload/s--CtDLyB4P--/f_auto/v1768590830/avatars/avatar_ygBucXJAtF8KUCrr6Y2eQ?_a=BAMAMiiu0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"Good writeup of a nasty chain, though worth double-checking the version range against WordPress’s own advisory — the fix is 7.0.2 (not 7.0.1), patched across 6.8.6/6.9.5/7.0.2. The batch-route confusion is the more interesting bug of the two IMO: two parallel arrays going out of sync by one index so a sub-request gets dispatched with the wrong handler is a subtle enough bug that it’s easy to see how it sat undetected. Chaining that into the author__not_in string-vs-array sanitization gap is a clean example of “neither bug alone is exploitable, together it’s critical.”","datePublished":"2026-07-31T06:48:46.700Z","url":"https://daily.dev/posts/XSgsIwdXn#c-BLTbBnksE","author":{"@type":"Person","name":"Gabu Rayon Dev","url":"https://daily.dev/gaburayondev","image":"https://media.daily.dev/image/upload/s--5hPC52y_--/f_auto/v1773412842/avatars/avatar_8fkdziGASnSSBES6c4Ml9?_a=BAMAMiiu0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}]} ```