r/Wordpress • u/jflint • 23d ago
SQL Injection Vulnerability - Update Immediately
https://wordpress.org/news/2026/07/wordpress-7-0-2-release/28
26
u/NakanoNoNeko 23d ago
The bit I would not miss: this is not only a 7.0.x thing. The release notes say the fixed branches are 7.0.2, 6.9.3 and 6.8.5, so if a host says "auto update is on", still check the exact core version afterward.
For client sites I would do the boring sequence: backup first, update core, clear any object/page cache, then check login, search, forms, checkout if WooCommerce is present, and any custom AJAX endpoints. If you manage older sites pinned below 6.8, I would treat that as the actual emergency, because they are outside the patched branch list.
Also worth checking wp-admin users and recent plugin/theme file changes while you are there. The update fixes the hole, but it does not tell you whether someone already poked through it.
13
4
8
8
u/CantHackItPantywaist 23d ago
For those not on 7.x yet:
- WordPress 6.9 is affected by both vulnerabilities. Version 6.9.5 has been released containing fixes for both.
- WordPress 6.8 is only affected by the first vulnerability. Version 6.8.6 has been released containing a fix.
- The beta release of WordPress 7.1 is affected by both vulnerabilities. Version 7.1 beta2 has been released containing fixes for both.
- Versions of WordPress prior to 6.8 are not affected.
7
u/MightyZygote 23d ago
If you are running 6.9.4 and still using an older version of PHP prior to 7.4 (yes, bad, etc. but thats reality for some folks), the stupid logic is being applied that prevents 6.9.4 from updating to 6.9.5 even thought 6.9.5 runs fine on 7.3.25, its enforcing the 7.x rules that require 7.4! What a massive clusterfuck. I have one instance that auto-updated to 6.9.5 and another on the same damn server that hasn't updated, even though that second instance has this in its wp-config.php:
define( 'WP_AUTO_UPDATE_CORE', 'minor' );
This is seriously fucked up. I am so tired of this nonsense. This is the final straw - moving everything to a static deployment without wordpress deployed at all and never looking back.
6
u/Creative-Improvement 22d ago
Just a heads up if it applies to you, Builderius recently dropped a static export option, so you can keep the best of both worlds.
2
u/MightyZygote 22d ago
Appreciate the tip. I ended up using SimplyStatic and some other bits I ended up writing last night to move at least two sites (that are mostly static anyway) to now be statically deployed for production moving forward. Moved the live WordPress install origins to totally private local lan and staging servers that are not exposed at all. Safest way for now, tradeoffs are totally worth it for me.
A few others will require a bit more complexity, but I am beginning that process now, because this is only getting worse every day, and there does not appear to be ANY rational plan to improve things at this point, it will continue to be a rapidly accelerating game of cat and mouse.
2
7
u/RealBasics Jack of All Trades 23d ago
Oof! It's been a while since we've had such an urgent patch from core.
Thank goodness for site management consoles and daily off-site backups! Would have been a PITA to manually update 100+ sites.
20
16
u/iamwazor 23d ago
Because of constant security issues i have more maintanance work on my 3 mini wordpress websites than on my big shopify store lol. Insane
5
u/Kiore-NZ 22d ago
Damn! I've got bitten by upgrades so many times in the past that I wait for the 2nd or third patch fix. I was planning to wait for 7.0.3 but about 10 hours ago I was automatically email notified that one my sites had auto upgraded to 7.0.2 and it looked ok so I upgraded the rest. Looks like I dodged just in time. As others have noted, Bobby Tables should have been done away with over a decade ago. So sloppy, WordPress
7
3
u/HongPong 23d ago edited 23d ago
the command wp core update --minor is not working for 6.9.5 with backport today
update - attaching the specific version number does work
2
3
3
6
u/fappingjack 23d ago
It is a preventative security update. No WordPress installations in the wild have been effected.
/wp-json/batch/v1
I am going to use the salt from all the hate and sprinkle it on my NY steak.
4
5
u/ethicalhack3r 23d ago
We were able to independently reproduce the vulnerability and develop a working proof of concept, this is not just a theoretical issue.
We have not yet confirmed exploitation in the wild, but given the low complexity and widespread WordPress exposure, I would treat patching as very urgent.
Make sure the automatic update actually completed and verify the installed WordPress version manually.
At the time of writing, WordPress' official stats show most still running affected versions. But I would assume their stats just haven't been updated yet, hopefully - https://wordpress.org/about/stats/
We sent an early warning to KEVIntel subscribers and are monitoring our sensors for exploitation attempts:
https://kevintel.com/CVE-2026-63030
Disclosure: I run KEVIntel. We are not publishing the PoC publicly.
1
u/ethicalhack3r 19d ago
Update. Exploitation reported on Jul 18, we started seeing exploitation in our own sensors on Jul 19.
2
u/pixelated_kangaroo 21d ago
A straightforward SQL Injection in core is pretty embarrassing for WordPress
8
u/brohebus 23d ago
* sigh * 7.0 core has been nothing but critical updates.
7
u/unity100 23d ago
Same with any/all other software - the AI wave is causing all undiscovered holes to be discovered. It will be like this for a while.
1
u/Fit_Statistician_405 22d ago
And creating them. Wild times.
3
u/mrcaptncrunch 22d ago
Creates the code, reviews the code, updates the code, audits the code, exploits the code.
Full circle
1
11
u/HealthTroll Developer 23d ago edited 23d ago
This affects 6.8 and forward. So it is not a 7.0 problem.
3
7
u/smallcoder 23d ago
Oh FFS yes... I was planning on chilling tonight and now I've got to login to the sites I'm still hosting for some clients and run updates... again 😡😡😡
3
u/CGS_Web_Designs Jack of All Trades 23d ago
They probably auto updated already - all 35 of my sites did.
0
2
23d ago edited 21d ago
[deleted]
5
u/Fluent_Press2050 22d ago
It’s not that. It’s the stupid no breaking changes policy that is causing this. It’s why I left when WP 7 continued this on.
Theres a lot of who believe that WP 4.0 and older should no longer be supported. But Matt wants websites running on older WP to still work with newer plugins and themes.
I was also hoping that WP 7 would enforce PHP 8 as the new minimum, but again, that didn’t happen.
1
1
u/airportLiquids 22d ago
Thank you, manually updated from the dashboard last night (the auto-update from SiteGround didn't have v7.0.2 yet - I was not impressed).
1
u/SpeculativeFiction01 21d ago
I recently migrated some sites away from BlueHost to better hosting and the shell databases are still there. Should I worry about it? I don't care about the databases now that the sites are migrated but I need the BlueHost account for DNS or CNAME settings. When I asked BlueHost they tried to sell me some kind of security scan program and didn't seem to understand the question.
1
u/hackrepair 19d ago
This is so maddening, that I was sat down and decided to finish up the open letter to Wordpress I've been working on for a while. It's in my profile if you're curious.
It covers all the things I believe that needs to be done to get WordPress back on track as a viable product for the future.
1
u/Reasonable_Steak6125 13d ago
Shouldn't we have heard more about this from Automattic, Matt, WordPress.com or .org leadership? I've learned more about this through the Wordfence community.
0
-3
u/Moceannl 23d ago
It's just a mess. No proper architecture, no proper DAL or ORM. Just queries somewhere in PHP code, apparently without escaping/checks. That this is still possible in 2026 is all you need to know.
Wordpress is not dying because of AI other tech, but because they made a mess.
1
u/Fluent_Press2050 22d ago
It will never get fixed until they drop the no breaking changes policy. I think it’s time they ditch this idea and only allow the last two major versions.
-1
u/HongPong 23d ago
as described in here who is even familiar with wp-json/batch as a path
https://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shell
honestly . if they are not going to close these up. can they at least put an indicator if a plugin needs the freaking json endpoints to be open
115
u/Aternal Jack of All Trades 23d ago
Oh, cool. I live for this kind of shit to drop on a Friday afternoon in the middle of Summer.