Latest / Wpfavs - Your favourite WordPress news / WordPress RCE Chain Exposes the Plugin Supply Chain

Transcript

WordPress RCE Chain Exposes the Plugin Supply Chain · Wpfavs - Your favourite WordPress news

• 0:13
  On July 17, 2026, WordPress core developers pushed out an emergency background auto
• 0:18
  update for WordPress 7.0.2 to fix two critical flaws, CVE 2026
• 0:25
  63030 and CVE 2026 60137.
• 0:29
  It was an unauthenticated Remote Code Execution exploit chain,
• 0:33
  and it affected millions of sites in a matter of hours.
• 0:36
  Wait, millions of sites forced to auto update all at once?
• 0:39
  That, that means the REST API desynchronization flaw was actively harvestable
• 0:43
  without even needing a login?
• 0:45
  It, it really was.
• 0:47
  What happened was, if an attacker sent batch requests to slash wp json slash batch
• 0:53
  slash v1, parallel validation arrays inside class wp rest server dot php completely
• 0:59
  lost index alignment whenever a sub request hit an error.
• 1:03
  And once those arrays got out of sync, the server skipped route validation entirely.
• 1:08
  It let unauthenticated calls bypass REST security checks.
• 1:12
  So you bypass the route check, but how do you get all the way to Remote Code
• 1:16
  Execution from a broken array alignment?
• 1:18
  That is where the second flaw came in, a REST API batch route confusion and SQL
• 1:24
  injection issue leading to Remote Code Execution.
• 1:27
  In wp includes slash class wp query dot php, passing an array to author not in
• 1:33
  sanitized the inputs properly.
• 1:36
  But if you passed a raw string parameter instead, it completely bypassed
• 1:40
  sanitization.
• 1:41
  Raw SQL got injected right into the query.
• 1:44
  So an unauthenticated attacker hits the batch route, breaks array alignment,
• 1:49
  and feeds a raw string into WP Query to execute arbitrary SQL on the server.
• 1:55
  That is, um, that is terrifyingly elegant.
• 1:58
  And the trickiest part for developers was testing for it.
• 2:01
  If you sent a test request to slash wp json slash batch slash v1,
• 2:06
  both patched and vulnerable sites returned an identical HTTP 200 status code
• 2:11
  response.
• 2:12
  People were looking at surface level HTTP status checks and assuming their firewall
• 2:17
  or site was safe when it was still completely exposed underneath.
• 2:20
  Right, because a 200 OK just means the batch endpoint exists and responded,
• 2:25
  not that class wp rest server dot php is actually validating sub request indexes
• 2:30
  correctly.
• 2:31
  And this ties into a much bigger problem across the entire ecosystem.
• 2:35
  The WP Goldmine report analyzed over fifty seven thousand plugins recently and found
• 2:40
  that twenty four percent of plugins in the ten thousand to one hundred thousand
• 2:43
  active install band have not been updated in over two years.
• 2:47
  That is twelve hundred and nine popular plugins, including things like Limit Login
• 2:51
  Attempts and WP Downgrade, just sitting there abandoned with real user bases.
• 2:56
  Twelve hundred and nine plugins with up to one hundred thousand installs,
• 3:00
  zero maintainers, running on live production sites.
• 3:03
  I mean, at what point does core step in?
• 3:05
  Should WordPress core enforce mandatory deprecation flags or facilitate developer
• 3:10
  takeovers for stale code?
• 3:11
  I, I see the argument for core enforcement, but forcing automatic updates or
• 3:17
  deprecating plugins at the core level carries huge risks for enterprise stacks.
• 3:22
  If core aggressively purges or alters plugins, you risk breaking custom workflows on
• 3:28
  sites that rely on legacy hooks.
• 3:30
  Which is why agencies cannot rely on surface checks or wait for core to fix supply
• 3:35
  chain risk.
• 3:36
  In our own developer workflows, we enforce strict array type casting using wp parse
• 3:42
  id list to ensure string parameters can never reach database queries as unassigned
• 3:47
  types.
• 3:47
  We also automate post update checksum verification to make sure core files match
• 3:52
  official repositories after emergency patches like 7.0.2.
• 3:57
  So instead of guessing whether an endpoint is safe, you verify file integrity at the
• 4:01
  file system level and run automated plugin auditing tools to purge abandoned
• 4:06
  utilities before an exploit chain finds them.
• 4:08
  Clean code discipline at the application layer beat reactive fire drills every
• 4:12
  single time.