Is This WordPress's Worst Hack In History?

Englishالعربية Deutsch Español Français हिन्दी Bahasa Indonesia 日本語 한국어 Português Русский 中文

Internet TechnologyBusiness NewsComputing/Software

Transcript

00:00:00WordPress has seen a string of vulnerabilities recently with the latest so severe

00:00:04they let's hackers gain complete control of the admin panel we're talking sql injection running

00:00:09shell commands pretty bad and maybe you don't care about WordPress but it still runs over 44%

00:00:14of the world's websites so many of the websites that you interact with and give your data to

00:00:19could likely be running WordPress and this vulnerable version so it basically works like

00:00:25this so I've got installed locally a standard stock version of WordPress and I can run this

00:00:29first script to see if the vulnerability is available and you can see we get the response

00:00:34HTTP 207 which means yes it is in fact vulnerable and that means we can now run the second check

00:00:41which is the enter the interactive shell so this sql injects the site creates a brand new admin user

00:00:47and then uploads a malicious plugin that allows me to now interact with any file on this website

00:00:52so let's dive into the issue and see exactly how it works

00:00:58so this repo that I'm looking at shows you exactly how to SQL inject vulnerable WordPress sites that's

00:01:06any site between 6.90 and 6.94 or 7.00 and 7.01 the whole attack starts by calling an unauthenticated

00:01:14endpoint batch v1 which allows you to batch up other requests that themselves are validated and permission

00:01:20checked the batch handler has two parallel arrays which are supposed to stay in sync validation and matches

00:01:26but a bug meant that when the function wp pass URL files due to an invalid path only validation was updated

00:01:33so now the same index used to look at both arrays provided mismatched results the POC takes advantage of this

00:01:41it sends a batch containing just one request a post to the v2 post endpoint which itself carries a request body

00:01:48since the parent's request was correctly validated as a post request any request in the request body end up bypassing the method allow list

00:01:56letting you send get requests then inside that inner batch is a get request to a post that does not exist which triggers the

00:02:02earlier desync causing WordPress to dispatch the same request under a function called get items where a field author

00:02:10exclude maps to author not in which the vulnerable build interpolates into SQL as a string basically because all of this is running

00:02:18the SQL is not escaped the PSC uses a series of requests that ultimately allows a post request to v2 users to create

00:02:25a new admin account the repo actually goes through all of these steps in detail the first five are pre-auth so take advantage of the bug but step six is just normal WordPress behavior for

00:02:35authenticated users which is to upload a malicious package okay so as mentioned earlier this is just the standard stock version of WordPress the vulnerability is not accessed through some sort of malicious plugin

00:02:46you can just install standard WordPress we run this check script first which basically validates if the

00:02:52vulnerability can be run then we can run this read command for example which tells us things like the

00:02:57database user and the database name we can now also run SQL against the website so we can find out things like

00:03:03which version the database is actually running and none of that is actually the bad stuff this is the really bad

00:03:07one where we actually create an admin account that has access to be able to upload a malicious plugin in this

00:03:15case it's called web shell this allows us to access the shell of the website meaning we can now have access to

00:03:22any file on this website and this attack happens in the way that we explained earlier on in the video so

00:03:27after the admin is created the plugin is then uploaded and then finally that user is deleted so the existence

00:03:34of the plugin and what's happened is now more discreet to also demonstrate how bad this is i've created a separate script

00:03:38which will create an admin and then keep it on the system

00:03:40so here i've got a username and a password i'm back on the website ever head over to the wp login route i can enter that

00:03:47username and password click login and now i have full access to the admin panel now if any of this is confusing then don't worry

00:03:54it took me a long time to work out as well the claim is that the resulting exploit chain was so absurdly

00:04:00complex that it would have taken a human security researcher weeks if not months to discover and

00:04:05piece together on its own no security researcher could have found and completed this exploit chain

00:04:10in 10 hours without ai and this is pretty scary because bad actors could effectively have bots scanning

00:04:17repos checking urls just waiting for vulnerabilities to appear and exploiting it in record time using ai

00:04:23one user on reddit said that their site was compromised just two days after it was discovered

00:04:27and since they only upgrade on weekends an attacker was able to create a new admin and login for those

00:04:33vulnerable the exploit was fixed in version 7.0.2 so you can upgrade to that but that is a pretty mad one

00:04:40you can find the repo and the article in the comments that i've used to run the poc and why not

00:04:46subscribe to better stack to stay up to date with all of the tech news i hope you enjoy that one guys and

00:04:50of course as always i'll see you in the next one

Key Takeaway

An AI-discovered exploit chain in core WordPress (versions 6.9.0–6.9.4 and 7.0.0–7.0.1) enables unauthenticated attackers to gain complete server shell access, making an immediate upgrade to version 7.0.2 critical.

Highlights

A severe unauthenticated SQL injection vulnerability affects stock WordPress installations across versions 6.9.0–6.9.4 and 7.0.0–7.0.1.
The vulnerability allows remote attackers to bypass API permissions, extract database credentials, create persistent administrator accounts, and execute arbitrary shell commands via custom plugin uploads.
WordPress powers over 44% of all websites globally, making millions of sites vulnerable without needing third-party plugins installed.
The multi-step exploit chain was pieced together in just 10 hours using AI, a process that traditionally would take human security researchers weeks or months.
Automated exploitation started almost immediately after discovery, with site compromises reported within two days of exposure.
WordPress version 7.0.2 fully patches the vulnerability.

Timeline

Core WordPress Vulnerability and Severity Overview

WordPress core contains a critical flaw permitting full remote takeover of the admin panel.
The exploit grants attackers SQL injection capabilities, administrative privilege escalation, and arbitrary shell command execution.
Over 44% of global websites run on WordPress, exposing massive user data reserves.

Standard stock installations of WordPress without any third-party plugins are vulnerable to this exploit. Probing an unpatched site returns an HTTP 207 response, confirming that an attacker can initiate interactive shell access. Once confirmed, the script executes an SQL injection to create a new administrator account and deploy a malicious web shell plugin.

Technical Breakdown of the Exploit Mechanism

Vulnerable versions span WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1.
The attack initiates through an unauthenticated batch v1 API endpoint by exploiting an array synchronization bug.
Unescaped string interpolation during item queries turns author filtering requests into executable SQL injection.

The attack begins at the unauthenticated batch v1 endpoint, designed to group multiple validated requests. A bug in the wp_pass_url_files function updates only the validation array when handling invalid paths while leaving the matches array unchanged. This array desynchronization allows inner request bodies to bypass method allowlists, turning POST requests into GET requests directed at non-existent posts. WordPress then dispatches these requests to get_items, where unescaped string interpolation of the author_exclude parameter yields direct SQL injection.

Execution of Remote Code and Admin Account Creation

Pre-authentication SQL injection exposes internal database names, software versions, and credentials.
Attackers automatically upload web shell plugins to gain direct file system access.
Admin accounts can be purged after plugin installation to evade detection or left active for manual login.

Exploit execution starts by probing system parameters to retrieve database metadata. Attackers then send a POST request to the v2 users endpoint to register a high-privilege administrator. Once logged in, the exploit uploads a malicious plugin named web shell, establishing arbitrary command access over server files. The automated script can delete the created admin user right after plugin deployment to remain discreet, or maintain persistent login credentials for complete dashboard control.

AI-Driven Threat Landscape and Mitigation Path

AI tools assisted in synthesizing the entire complex exploit chain within 10 hours.
Automated scanner bots now target publicly exposed repositories and URLs to exploit disclosed flaws rapidly.
WordPress version 7.0.2 fixes the core vulnerability.

Discovering this multi-step vulnerability chain manually would traditionally take security researchers weeks or months. AI assistance reduced discovery time to 10 hours, enabling rapid development of working proofs of concept. Automated threat actors actively scan target sites, with reported compromises occurring within two days of vulnerability publication. Upgrading core installations to version 7.0.2 resolves the bug completely.

Community Posts

Write about this video