A Flaw in WordPress's Core Code Lets Criminals Take Over Websites Without Logging In
A newly discovered vulnerability in WordPress versions 6.9 and 7.0 lets attackers run their own commands on any affected site with no password required. Patches are out now.
Key points
- WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 contain a flaw that lets criminals take full control of a website without supplying any login credentials.
- The bug was first identified by Adam Kues of Searchlight Cyber and sits inside the part of WordPress that handles batched API requests, meaning groups of web instructions sent together.
- Fixed versions 6.9.5 and 7.0.2 were released on July 17, 2024; any site still running the vulnerable versions is exposed right now.
- A successful attack gives criminals access to the site's database, its stored credentials, and any personal data held there.
- Because the vulnerable feature ships enabled by default, no plugin or special setup is needed for a site to be reachable.
WordPress, the software that runs a large share of the world's websites, has patched a serious security hole. No account needed. No special plugin. Just a vulnerable site and a crafted request.
The bug, nicknamed "wp2shell," lives inside WordPress's built-in REST API batch endpoint. A REST API is the channel a website uses to accept and process instructions from other software; the batch endpoint handles several of those instructions at once. Researchers at security firm Hadrian reconstructed the root cause from the patch WordPress released on July 17: an indexing mismatch during request validation causes permission checks to fall out of alignment. A crafted batch request then gets processed under the wrong authorisation context, which can mean no meaningful check at all.
"An attacker who reaches the bug gains unauthenticated code execution on the web server," Hadrian's analysis states. That means full control of the site, access to the database and whatever credentials or personal data it holds, plus a foothold into the surrounding hosting environment.
Kues published a public checker so admins could assess their exposure, but held back technical details until the patch was available. Hadrian followed the same discipline, releasing its reconstruction only after WordPress had shipped the fix.
We reported the first active exploitation tied to wp2shell on 20 July in "WP2Shell: Two WordPress Flaws Are Being Exploited Right Now, and Millions of Sites Are at Risk", which means this isn't a theoretical risk anymore.
Who is at risk and what should site owners do?
Anyone on WordPress 6.9.0 to 6.9.4, or 7.0.0 to 7.0.1, is exposed. Update to 6.9.5 or 7.0.2 immediately. Version 6.8.6 includes the same hardening changes, though earlier 6.8.x releases weren't affected by this flaw.
Check staging environments and old campaign sites running forgotten installations. Where patching can't happen right away, block outside access to "/wp-json/batch/v1" and "/?rest_route=/batch/v1" at the web server or through a WAF, a web application firewall that filters traffic before it reaches the site.
Should you worry if you use a WordPress-powered site?
No immediate action is required for visitors or customers. But if a site you use reports a breach in the coming weeks, this flaw is a plausible cause, and it's worth reconsidering any password you reuse across services.
