Bottom line: A validation flaw in WordPress’s REST Batch API enables pre-authentication remote code execution with full control over website, database, and hosting environment.
A vulnerability in the REST Batch API of the WordPress core allows attackers to execute arbitrary code without authentication and without plugins. The flaw affects versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1.
The vulnerability, reported by Adam Kues of Searchlight Cyber, is designated wp2shell and affects the “batch/v1” batch endpoint of the WordPress core. Technical analyses by Hadrian show that an indexing mismatch occurs during validation of incoming batch requests: request objects and their associated permission checks are not correctly matched to one another. A malicious actor can thereby process a manipulated batch request under a false authorization context and execute arbitrary code.
WordPress released the security patch on July 17, 2025. The vulnerability is critical because the REST Batch API is enabled by default and remains accessible via multiple paths — such as /wp-json/batch/v1 or /?rest_route=/batch/v1 — even when URL rewrite rules are not configured. A successful attack grants the attacker complete control over the website and its content, access to the database and credentials and personal data stored in it, and provides an entry point into the surrounding hosting infrastructure.
Affected administrators should immediately update to WordPress 6.9.5 or 7.0.2 and verify successful installation. Where immediate patches are not possible, both REST Batch API endpoints should be blocked at the web server and WAF level from unauthorized access. In parallel, it is necessary to inventory all WordPress deployments — including staging and unused campaign sites — and verify whether unauthorized REST API access is actually required in the respective environment.
Source: www.csoonline.com · Published July 20, 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.