WordPress Core Pre‑Auth RCE Exposes 500M Sites Until Patch 7.0.2
Searchlight Cyber uncovered a pre‑authentication remote code execution flaw in WordPress core that works on a stock install with no plugins. It hits versions 6.9.0‑6.9.4 and 7.0.0‑7.0.1, putting roughly 500 million sites at risk until they upgrade to 7.0.2 (or 6.9.5) or block anonymous batch‑API access.