--- title: Wordpress Situation is Absolutely Insane | daily.dev description: A detailed breakdown of two chained WordPress vulnerabilities (affecting versions 6.8.5 through 7.0.1) that together enable unauthenticated remote code... canonical: https://daily.dev/posts/wordpress-situation-is-absolutely-insane-xsgsiwdxn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Wordpress Situation is Absolutely Insane | daily.dev og:description: A detailed breakdown of two chained WordPress vulnerabilities (affecting versions 6.8.5 through 7.0.1) that together enable unauthenticated remote code... og:url: https://daily.dev/posts/wordpress-situation-is-absolutely-insane-xsgsiwdxn og:image: https://api.daily.dev/og/posts/XSgsIwdXn.png og:image:alt: Wordpress Situation is Absolutely Insane og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Wordpress Situation is Absolutely Insane **[Low Level Learning](https://daily.dev/sources/lowlevellearning)** · 10 min read · 51 upvotes · 13 comments ## Summary A detailed breakdown of two chained WordPress vulnerabilities (affecting versions 6.8.5 through 7.0.1) that together enable unauthenticated remote code execution. The first bug is a route confusion in the REST API batch v1 endpoint that allows dispatching GET requests where only POST should be permitted. The second is a blind SQL injection in the post query's author_not_in field that bypasses sanitization when reached via the route mismatch. The exploit chains these to poison WordPress's internal object cache, create a fake admin user, and upload a web shell plugin — all without authentication. A proof-of-concept emerged just 10 hours after disclosure, reportedly with AI assistance. Users on WordPress 7.0.2 or later are not affected; those on versions before 6.8.5 are also not vulnerable. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Which WordPress versions are vulnerable to the REST API batch endpoint SQL injection RCE exploit? WordPress versions from 6.8.5 up to but not including 7.0.2 are vulnerable to this chained exploit. Versions before 6.8.5 are unaffected because the vulnerable batch v1 route confusion behavior was not present yet, and updating to 7.0.2 or later patches the issue. The vulnerability combines a REST API batch handler route confusion bug with a blind SQL injection in the post query author_notin field. _Teams tracking which WordPress versions need urgent patching can follow security disclosures like this on daily.dev._ ### How does the WordPress batch v1 REST API route confusion vulnerability work? The serve_batch_request_v1 handler builds two parallel arrays, matches and validation, indexed by the same offset; when a sub-request path fails WP parse URL, it gets appended only to validation but not to matches, causing the arrays to fall out of alignment. This lets a sub-request get dispatched under the wrong handler, allowing GET requests through a handler meant only to accept POST requests, bypassing authentication logic tied to request type. _Developers debugging REST API request routing edge cases can dig into writeups like this via daily.dev._ ### How was the blind SQL injection in the author_notin WordPress field exploited without time-based delays? Instead of slow conditional time-delay techniques, attackers used the SQL injection to poison WordPress's internal object cache by creating a fake oEmbed cache post, then leaked the cache post ID and used a customizer change set to poison the batch request into creating a new admin user, which was then used to upload a web shell plugin. Security researchers at Tenable suggested only AI assistance could have chained this in roughly 10 hours. _Anyone assessing novel exploit chaining techniques can track detailed breakdowns like this through daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@doncho** · 11 upvotes > For such a widespread product, WordPress is having so many attackers (including wannabe AI hackers) so it's inevitable to have a critical bug or two discovered. > > > Always be updated 😀 **@springtofigh** · 5 upvotes > Well, I couldn't agree more with some developers, sometimes WordPress security is really gone to the door. **@agalimberti** · 4 upvotes > i ditched wordpress and php 25 years ago... **@zshall** · 2 upvotes > Server-based CMSes like Wordpress make sense for large enterprise use with user-level permissions, teams and collaboration and interactivity (comments, etc.) but in my personal use cases I've found that static site generation is a better fit. You can't hack a database if you don't have one. Systems like Astro that can build a static site as part of a CI action and publish to staging or production based on Git branches are quite rad. Programs like Publii are also neat in case you prefer a desktop-based publishing program that generates a static site instead. **@gaburayondev** · 1 upvotes > Good writeup of a nasty chain, though worth double-checking the version range against WordPress's own advisory — the fix is 7.0.2 (not 7.0.1), patched across 6.8.6/6.9.5/7.0.2. The batch-route confusion is the more interesting bug of the two IMO: two parallel arrays going out of sync by one index so a sub-request gets dispatched with the wrong handler is a subtle enough bug that it's easy to see how it sat undetected. Chaining that into the author__not_in string-vs-array sanitization gap is a clean example of "neither bug alone is exploitable, together it's critical." ## Similar posts on daily.dev - [wp2shell: WordPress Patches a Pre-Auth RCE That Needed No Plugins](https://daily.dev/posts/wp2shell-wordpress-patches-a-pre-auth-rce-that-needed-no-plugins-pmh9adxqu) · Latest Hacking News · 2 upvotes · 0 comments - [WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments](https://daily.dev/posts/wordpress-comment2shell-xss-to-rce-chain-lets-unauthenticated-attackers-compromise-servers-via-mal-8wlrbsg8k) · Orca Security Blog · 3 upvotes · 0 comments - [Hackers exploit auth bypass flaw in Burst Statistics WordPress plugin](https://daily.dev/posts/hackers-exploit-auth-bypass-flaw-in-burst-statistics-wordpress-plugin-tcgzmougc) · BleepingComputer · 2 upvotes · 0 comments --- Tags: [#sql](https://daily.dev/tags/sql), [#wordpress](https://daily.dev/tags/wordpress), [#web-security](https://daily.dev/tags/web-security) [View this post on daily.dev](https://daily.dev/posts/wordpress-situation-is-absolutely-insane-xsgsiwdxn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Wordpress Situation is Absolutely Insane","url":"https://daily.dev/posts/wordpress-situation-is-absolutely-insane-xsgsiwdxn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/wordpress-situation-is-absolutely-insane-xsgsiwdxn"},"datePublished":"2026-07-27T13:32:45.560Z","dateModified":"2026-09-14T08:22:01.482Z","description":"A detailed breakdown of two chained WordPress vulnerabilities (affecting versions 6.8.5 through 7.0.1) that together enable unauthenticated remote code...","image":"https://i.ytimg.com/vi/SKuJ60kD8wg/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/SKuJ60kD8wg/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Low Level Learning","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Low Level Learning","logo":"https://media.daily.dev/image/upload/s--pjLyMMmx--/f_auto/v1724394406/logos/lowlevellearning","url":"https://daily.dev/sources/lowlevellearning"},"commentCount":13,"discussionUrl":"https://daily.dev/posts/wordpress-situation-is-absolutely-insane-xsgsiwdxn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":51},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":13}],"keywords":"sql,wordpress,web-security","timeRequired":"PT10M","video":{"@type":"VideoObject","name":"Wordpress Situation is Absolutely Insane","description":"A detailed breakdown of two chained WordPress vulnerabilities (affecting versions 6.8.5 through 7.0.1) that together enable unauthenticated remote code...","thumbnailUrl":"https://i.ytimg.com/vi/SKuJ60kD8wg/sddefault.jpg","uploadDate":"2026-07-27T13:32:45.560Z","duration":"PT10M","url":"https://api.daily.dev/r/XSgsIwdXn","embedUrl":"https://www.youtube.com/embed/SKuJ60kD8wg"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Low Level Learning","item":"https://daily.dev/sources/lowlevellearning"},{"@type":"ListItem","position":3,"name":"Wordpress Situation is Absolutely Insane"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/wordpress-situation-is-absolutely-insane-xsgsiwdxn","comment":[{"@type":"Comment","text":"For such a widespread product, WordPress is having so many attackers (including wannabe AI hackers) so it’s inevitable to have a critical bug or two discovered.\nAlways be updated 😀","datePublished":"2026-07-28T05:22:35.557Z","url":"https://daily.dev/posts/XSgsIwdXn#c-AT5erNH2r","author":{"@type":"Person","name":"Doncho Angelov","url":"https://daily.dev/doncho","image":"https://media.daily.dev/image/upload/s--j1MSm0hy--/f_auto/v1716369534/avatars/avatar_EB0j0Umzh5v3zGWUSL5ma"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":11}},{"@type":"Comment","text":"Well, I couldn’t agree more with some developers, sometimes WordPress security is really gone to the door.","datePublished":"2026-07-27T20:41:59.047Z","url":"https://daily.dev/posts/XSgsIwdXn#c-IUgDjSjP0","author":{"@type":"Person","name":"Spring Tofigh","url":"https://daily.dev/springtofigh","image":"https://avatars.githubusercontent.com/u/90114320?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":5}},{"@type":"Comment","text":"i ditched wordpress and php 25 years ago…","datePublished":"2026-07-28T10:06:18.587Z","url":"https://daily.dev/posts/XSgsIwdXn#c-UGE3XTBQK","author":{"@type":"Person","name":"Aldo Galimberti","url":"https://daily.dev/agalimberti","image":"https://avatars.githubusercontent.com/u/93255079?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4}},{"@type":"Comment","text":"Server-based CMSes like Wordpress make sense for large enterprise use with user-level permissions, teams and collaboration and interactivity (comments, etc.) but in my personal use cases I’ve found that static site generation is a better fit. You can’t hack a database if you don’t have one. Systems like Astro that can build a static site as part of a CI action and publish to staging or production based on Git branches are quite rad. Programs like Publii are also neat in case you prefer a desktop-based publishing program that generates a static site instead.","datePublished":"2026-07-28T14:45:14.409Z","url":"https://daily.dev/posts/XSgsIwdXn#c-dpmpLoUcq","author":{"@type":"Person","name":"Zach Hall","url":"https://daily.dev/zshall","image":"https://media.daily.dev/image/upload/s--CtDLyB4P--/f_auto/v1768590830/avatars/avatar_ygBucXJAtF8KUCrr6Y2eQ?_a=BAMAMiiu0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}},{"@type":"Comment","text":"Good writeup of a nasty chain, though worth double-checking the version range against WordPress’s own advisory — the fix is 7.0.2 (not 7.0.1), patched across 6.8.6/6.9.5/7.0.2. The batch-route confusion is the more interesting bug of the two IMO: two parallel arrays going out of sync by one index so a sub-request gets dispatched with the wrong handler is a subtle enough bug that it’s easy to see how it sat undetected. Chaining that into the author__not_in string-vs-array sanitization gap is a clean example of “neither bug alone is exploitable, together it’s critical.”","datePublished":"2026-07-31T06:48:46.700Z","url":"https://daily.dev/posts/XSgsIwdXn#c-BLTbBnksE","author":{"@type":"Person","name":"Gabu Rayon Dev","url":"https://daily.dev/gaburayondev","image":"https://media.daily.dev/image/upload/s--5hPC52y_--/f_auto/v1773412842/avatars/avatar_8fkdziGASnSSBES6c4Ml9?_a=BAMAMiiu0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/wordpress-situation-is-absolutely-insane-xsgsiwdxn#faq","mainEntity":[{"@type":"Question","name":"Which WordPress versions are vulnerable to the REST API batch endpoint SQL injection RCE exploit?","acceptedAnswer":{"@type":"Answer","text":"WordPress versions from 6.8.5 up to but not including 7.0.2 are vulnerable to this chained exploit. Versions before 6.8.5 are unaffected because the vulnerable batch v1 route confusion behavior was not present yet, and updating to 7.0.2 or later patches the issue. The vulnerability combines a REST API batch handler route confusion bug with a blind SQL injection in the post query author_notin field. Teams tracking which WordPress versions need urgent patching can follow security disclosures like this on daily.dev."}},{"@type":"Question","name":"How does the WordPress batch v1 REST API route confusion vulnerability work?","acceptedAnswer":{"@type":"Answer","text":"The serve_batch_request_v1 handler builds two parallel arrays, matches and validation, indexed by the same offset; when a sub-request path fails WP parse URL, it gets appended only to validation but not to matches, causing the arrays to fall out of alignment. This lets a sub-request get dispatched under the wrong handler, allowing GET requests through a handler meant only to accept POST requests, bypassing authentication logic tied to request type. Developers debugging REST API request routing edge cases can dig into writeups like this via daily.dev."}},{"@type":"Question","name":"How was the blind SQL injection in the author_notin WordPress field exploited without time-based delays?","acceptedAnswer":{"@type":"Answer","text":"Instead of slow conditional time-delay techniques, attackers used the SQL injection to poison WordPress's internal object cache by creating a fake oEmbed cache post, then leaked the cache post ID and used a customizer change set to poison the batch request into creating a new admin user, which was then used to upload a web shell plugin. Security researchers at Tenable suggested only AI assistance could have chained this in roughly 10 hours. Anyone assessing novel exploit chaining techniques can track detailed breakdowns like this through daily.dev."}}]} ```