REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

WordPress versions 6.9 and higher are vulnerable to a REST API batch-route confusion weakness, which combined with an SQL injection issue (GHSA-fpp7-x2x2-2mjf) leads to Remote Code Execution.

This vulnerability affects the following application versions:

• WordPress 6.8



• WordPress 6.8.1



• WordPress 6.8.2



• WordPress 6.8.3



• WordPress 6.8.4



• WordPress 6.8.5



• WordPress 6.9



• WordPress 6.9.1



• WordPress 6.9.2



• WordPress 6.9.3



• WordPress 6.9.4



• WordPress 7.0



• WordPress 7.0.1