WordPress Core (versions 6.9.0 through 7.0.1)
WordPress is the software that powers roughly half of all websites on the internet, from personal blogs to major news outlets.
Root Cause
WordPress's WP_Query function fails to check whether the author__not_in parameter is an array before using it. When a string is passed instead, the raw value drops into the database query unfiltered. The batch endpoint separately allows sub-request arrays to fall out of sync when one sub-request errors, causing a subsequent request to run under the wrong handler and bypass the endpoint's access controls.
Attack Vector
An unauthenticated attacker sends a crafted batch request to /wp-json/batch/v1. A deliberate error in one sub-request shifts the handler assignment. The attacker's input then reaches the vulnerable WP_Query parameter, executing arbitrary database commands and ultimately arbitrary code on the server.
Recommended Actions
- Update to WordPress 6.8.6, 6.9.5, or 7.0.2 immediately. Auto-updates may not have applied if you disabled them — verify manually.
- Check your version now at
wp2shell.com, where Searchlight Cyber has published a dedicated checker. - Review server logs for unusual requests to
/wp-json/batch/v1.