WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion

Description

WordPress core 6.9.0 - 6.9.4 and 7.0.0 - 7.0.1 are affected by an unauthenticated SQL injection reachable through the REST API batch endpoint (/batch/v1).

The batch controller builds parallel $matches (the matched handler per sub-request) and $validation (the validation result per sub-request) arrays, then indexes both by the same offset when dispatching. A sub-request whose path fails wp_parse_url() is appended to $validation but not to $matches, desynchronising the two arrays so a sub-request is dispatched under a different sub-request's handler (CVE-2026-63030).

Nesting the primitive twice lets a GET on the single-post item route /wp/v2/posts/999999, carrying the collection-only parameter author_exclude, be dispatched under the posts collection get_items() handler, where author_exclude maps to the WP_Query author__not_in query var. The vulnerable builds interpolate that value into SQL as a string (CVE-2026-60137), producing a pre-authentication boolean- and time-based blind SQL injection in the post_author NOT IN (...) clause.

This module confirms the route-confusion primitive with a benign marker probe, then uses a time-based blind injection to dump WordPress user logins and password hashes. It is read-only and does not create posts, users, or other content.