Unauthenticated RCE in WordPress core (wp2shell), via SQL injection

WordPress released an emergency security update addressing an unauthenticated SQL injection in the REST batch endpoint (/wp-json/batch/v1) that can be chained to remote code execution; affected versions include 6.9.0–6.9.4 (fix: 6.9.5), 7.0.0–7.0.1 (fix: 7.0.2), and 7.1 beta (fix: beta2). The advisory urges immediate patching, outlines temporary mitigation options (WAF blocking of the path and rest_route parameter, blocking unauthenticated REST access), notes forced auto-updates for affected sites, and promotes runtime protection via Aikido Zen while tracking the issue in Aikido Intel.