WordPress 7.0.2: REST Batch + SQL Injection Chain to RCE
Core WordPress 6.9 and 7.0 sites were exposed to unauthenticated remote code execution that is now exploited; most sites got a forced update, so your job is to confirm every one actually did.
Must act: Anyone running WordPress 6.9.x before 6.9.5 or 7.0.x before 7.0.2 (RCE chain), or 6.8.x before 6.8.6 (SQL injection), especially with auto-updates disabled or blocked.
Can relax: Sites already on 7.0.2, 6.9.5, 6.8.6 or later (including 7.1), and WordPress versions before 6.8, which WordPress says are not affected.
- Check every site's core version (wp core version) and confirm it is 7.0.2, 6.9.5, 6.8.6 or later.
- Update any site that missed the forced update: wp core update --minor, or Dashboard > Updates.
- Find out why auto-updates did not apply (AUTOMATIC_UPDATER_DISABLED, WP_AUTO_UPDATE_CORE=false, read-only filesystems, version-pinned images) and fix it.