Pre-auth RCE check — WordPress Core

Affected versions

Mitigation

Update first: 7.0.2, or 6.9.5 on the 6.9 branch. Until then:

1. Install Disable WP REST API to block anonymous REST (may affect functionality).
2. At the WAF, block both /wp-json/batch/v1 and rest_route=/batch/v1.
3. Temporary plugin — wp-content/plugins/disable-batch-api-for-unauth.php:

   <?php
   /**
    * Plugin Name: Disable Unauthenticated REST Batch API
    * Description: Requires an authenticated WordPress user for REST batch requests.
    * Version: 1.0.0
    * Requires at least: 5.6
    * License: GPL-2.0-or-later
    */
   
   defined( 'ABSPATH' ) || exit;
   
   function wporg_require_authentication_for_rest_batch( $result, $server, $request ) {
       if ( '/batch/v1' !== strtolower( untrailingslashit( $request->get_route() ) ) || is_user_logged_in() ) {
           return $result;
       }
   
       return new WP_Error(
           'rest_batch_authentication_required',
           'Authentication is required to use the batch API.',
           array( 'status' => 401 )
       );
   }
   
   add_filter( 'rest_pre_dispatch', 'wporg_require_authentication_for_rest_batch', -1000, 3 );

Emergency measures only; the durable fix is updating WordPress.

WP Cleanup Service

If the site is affected or looks compromised, reach out for patching, backdoor cleanup, batch lockdown, and hardening — share your scan result.