WordPress 6.9–7.0 unauthenticated RCE patched, forced auto-update active

Affected Systems

WordPress core versions 6.9.0–6.9.4 and 7.0.0–7.0.1. All sites running these versions are vulnerable to unauthenticated remote code execution via anonymous HTTP requests. Patched in 6.9.5 and 7.0.2.

Exploitation Status

No public PoC or active exploitation confirmed at time of disclosure. Vulnerability discovered by Adam Kues (Assetnote) and patched proactively. WordPress enabled forced auto-updates, suggesting high confidence in exploit feasibility.

Business Impact

Critical impact: unauthenticated RCE allows full site compromise without credentials. WordPress forced auto-updates are active, but sites with disabled auto-updates or custom configurations remain at risk. Expect public PoC and active exploitation within days. Immediate verification required for all WordPress installations.

Urgency

🔴 Immediate

Recommended Actions

• Verify all WordPress sites are updated to 6.9.5 or 7.0.2 immediately via wp-admin or WP-CLI (wp core update)
• Audit sites with disabled auto-updates or custom update policies; manually patch if necessary
• Monitor web server logs for unusual POST/GET requests to WordPress core endpoints from anonymous sources
• Review WordPress installations for signs of compromise: unexpected admin accounts, modified core files, webshells in wp-content/uploads
• If patching is delayed, consider temporary WAF rules blocking unauthenticated requests to vulnerable endpoints (coordinate with WordPress security advisories for specifics)