- WordPress has released a patch for the wp2shell pre-auth RCE vulnerability, addressing a critical security flaw that could be exploited without any plugins.
- Defenders should verify patch status and consider blocking the batch endpoint at the WAF layer as a temporary workaround, not a permanent fix.
WordPress has addressed a critical vulnerability known as wp2shell, which allows remote code execution without authentication on versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1. The flaw was discovered by Adam Kues from Assetnote, who reported it through WordPress's HackerOne program.12
The vulnerability is described as “REST API batch-route confusion and SQL injection” that leads to remote code execution. It can be exploited via a single web request to the batch endpoint located at /wp-json/batch/v1 or its older alias ?rest_route=/batch/v1.
WordPress released patches in versions 6.9.5 and 7.0.2, with the GitHub Security Advisory rating the vulnerability as Critical with a CVSS score of 7.5. The project has implemented forced updates through its auto-update system to ensure all affected sites are patched, regardless of user action.
In light of the vulnerability's severity, Rapid7 Labs anticipates a public proof of concept (PoC) will emerge soon, and recommends blocking the batch endpoint at the WAF layer as a temporary measure. Site owners can verify their exposure using a public checker at wp2shell.com.345
As stated in the release notes, the vulnerability is classified as high severity by WordPress, but it is crucial not to underestimate its impact compared to other critical bugs.
“Rapid7 warns that a public exploit is likely soon because the patch diff is public and can be weaponized in hours. The firm also recommends defenders block the batch endpoint at the WAF layer as a temporary workaround.”
