A Flaw in WordPress's Core Code Lets Criminals Take Over Websites Without Logging In
A newly discovered vulnerability in WordPress versions 6.9 and 7.0 lets attackers run their own commands on any affected site with no password required. Patches are out now.
Key points
- WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 contain a flaw that lets criminals take full control of a website without supplying any login credentials.
- The bug was first identified by researcher Adam Kues of Searchlight Cyber and sits inside a part of WordPress that handles batched API requests, meaning groups of web instructions sent together.
- Fixed versions 6.9.5 and 7.0.2 were released on July 17, 2024; any site still running the vulnerable versions is exposed right now.
- A successful attack gives criminals access to the site's content, its database, and any customer or staff data stored there.
- WordPress powers roughly 40 percent of all websites on the internet, making the scale of potential exposure unusually large.
WordPress, the software that runs a large share of the world's websites from small blogs to major news outlets, has patched a serious security hole. The flaw lets a criminal run whatever commands they like on a vulnerable website's server, with no account or password needed.
The bug, nicknamed "wp2shell" by the researcher who found it, lives inside WordPress's built-in REST API batch endpoint. A REST API is the channel a website uses to accept and process instructions from other software. The "batch" part means it can handle several of those instructions at once.
The problem is a mismatch in how WordPress checks permissions when instructions arrive in a batch. WordPress lines up each request with a permission check, but researchers at security firm Hadrian found the alignment can be thrown off by a specially crafted request. When that happens, a request gets processed under the wrong permission level, which can mean no permission check at all.
"An attacker who reaches the bug gains unauthenticated code execution on the web server," Hadrian's analysis states. In plain terms: criminals break in and can do anything, including reading customer databases, stealing stored passwords, altering site content, or using the server as a launchpad to attack other systems.
Who is at risk and what should site owners do?
Anyone running WordPress 6.9.0 to 6.9.4, or 7.0.0 to 7.0.1, is at risk right now. Because the vulnerable feature ships switched on by default, no special plugin or configuration is required for a site to be exposed.
The fix is straightforward: update to WordPress 6.9.5 or 7.0.2 immediately. Version 6.8.6 also includes the same protective changes, even though earlier 6.8.x releases were not affected by this specific flaw.
Site owners should also check staging environments and old campaign sites that may be running forgotten WordPress installations. If updating is not immediately possible, blocking outside access to the paths "/wp-json/batch/v1" and "/?rest_route=/batch/v1" at the web server level will reduce exposure.
For customers and users of websites, there is no action required today. But if a site you use notifies you of a data breach in the coming weeks, this vulnerability is a plausible cause worth noting when deciding whether to change passwords you share across services.
The flaw was first reported by CSO Online. Hadrian published its technical reconstruction after the patch was already available, following the responsible practice of withholding details until admins had time to update.
