WordPress security alert: emergency patches correct a serious remote code execution in the kernel

WordPress published emergency patches on July 17, 2026 to close a remote execution vulnerability of code that, according to the discovery, can be activated with an anonymous HTTP request against a default installation without plugins. The patches appear in versions 6.9.5 and 7.0.2., and the correction is also present in 7.1 beta2; the branches affected were 6.9.0-6.9.4 and 7.0.0-7.0.1. Because the failure is in the core, a newly installed site was theoretically at risk.

The finding was reported by Adam Kues of Assetnote through the HackerOne program of WordPress and published under the pseudonym wp2shell; the firm decided not to reveal the complete technical details and instead made available a public voucher in wp2shell.com for administrators to check their instances. WordPress describes the problem as a combination of confusion in the REST API batch route and a SQL injection that can lead to CERs; files touched by the correction include / wp-includes / rest-api / class-wp-rest-server.php, / wp-includes / class-wp-query.php and / wp-includes / rest-api.php.

There are two practical points that site managers must assume immediately: do not trust that all sites received the patch automatically, and do not expect the CVE-based scanners to detect it yet. WordPress activated a forced update through its self-updates system to try to speed up protection, but the company has not clarified whether that push reaches facilities that have the automatic updates off. In addition, since there was no public CVE or CVSS score published at patch closure, many tools and catalogues (e.g. the CISA KEV catalogue) will not be able to point to the risk until such reference exists; you can see the WordPress version catalogue at the download and file page and the CISA outreach process in Known Exploited Vulnerabilities.

If you administer one or more WordPress sites, see the version you're actually running and apply the update to 6.9.5, 7.0.2 or more. Verify the version can be done from the management panel, by consulting the generating goal in the public HTML (if not removed), or from command line with WP-CLI: runwp core versionand update withwp core updateif you have access. Do not assume that the forced update has already reached all your servers.

As long as it cannot update, there are provisional mitigation measures that prevent anonymous calls from reaching the vulnerable endpoint, although all have functional costs. An alternative is to block both the standard JSON route on the WAF / wp-json / batch / v1 as the variant by query string rest _ route = / batch / v1; Assetnote stresses that both must be blocked because blocking only the first leaves a vector open. Another option is to disable the REST API for anonymous access or deploy a small plugin that rejects anonymous calls to the endpoint / batch / v1 using the hook rest _ pre _ dispatch. Note that these measures can break down legitimate integration that depends on the API.

The lack of a public exploitation test at the moment should not lead to calm. The WordPress ecosystem has a history of mass campaigns that exploit reported and parched failures days or hours before; if the patch code is in a public repository, attackers with sufficient knowledge can compare versions and build exploits quickly. Therefore it is critical to apply patches and monitor abnormal activity before the scans and the exploits appear in the wild.

Recommended concrete actions: update the corrected versions as soon as possible; if you cannot update immediately, block the routes indicated at the border (WAF or server rules) and consider disabling the REST API for anonymous users until it is protected. Review web and WAF logs looking for requests to / wp-json / batch / v1 or containing rest _ route = / batch / v1, inspect recently modified files and check the presence of suspicious administrative accounts or PHP files in wp-content. Make full backup before any intervention, and, if you suspect commitment, keep the instance off-line while investigating.

Finally, remember that the real scope of the problem is not the total number of WordPress facilities but those that run affected versions published since December 2025 (6.9 onwards). If your site is in 6.8 or above does not have this particular failure, but other corrections are pending in those branches; for example 6.8.6 addresses a different SQL injection. Maintaining a regular update, privilege segmentation and anomaly monitoring policy drastically reduces the exposure window against these zero-day errors.