Executive brief
WordPress, the world's most popular website management platform, is affected by a critical security flaw in its core software. This vulnerability allows attackers to bypass security controls by confusing how the system processes web requests, potentially leading to the theft of sensitive database information or full control over the website. Because this flaw is reportedly being exploited in the wild, organizations should update their WordPress installations to versions 6.9.5 or 7.0.2 immediately to prevent unauthorized access and data breaches.
Technical details
WordPress Core is vulnerable to an interpretation conflict (CWE-436) within its REST API batch endpoint. The flaw stems from route confusion that allows an attacker to bypass intended security constraints. When chained with a separate SQL injection vulnerability in the 'author__not_in' parameter of WP_Query, an unauthenticated remote attacker can execute arbitrary SQL commands. This chain can ultimately be leveraged to achieve Remote Code Execution (RCE) on the underlying server. The vulnerability is addressed in WordPress versions 6.9.5 and 7.0.2.
Affected products
- WordPress WordPress Core 6.9.x before 6.9.5, 7.0.x before 7.0.2
Timeline
- 2026-07-17: advisory: Initial NVD publication and CISA-ADP enrichment
- 2026-07-21: disclosed: Public disclosure date
- 2026-07-21: exploited: Reported as exploited in the wild in the advisory summary
- 2026-07-21: patched: Fixes released in WordPress 6.9.5 and 7.0.2