An attacker may exploit a confusion in the REST API batch endpoint routes, which together with a preexisting author__not_in SQL injection flaw in WP_Query, enables extraction and manipulation of database contents. This leads to Remote Code Execution by allowing the attacker to inject and execute arbitrary code on the server. The vulnerability is identified as CWE-436, representing incorrect sanitization, leading to SQL injection.

WordPress installations running version 6.9.x before 6.9.5 and 7.0.x before 7.0.2 are affected. These versions are distributed through the official WordPress repository and are in use by many sites worldwide.

The CVSS score of 9.8 reflects the high severity and potential for complete compromise. The EPSS score of 98% indicates a very high probability of exploitation in the current environment. The vulnerability is listed in the CISA KEV catalog. Based on the description, the likely attack vector is remotely via the REST API; an attacker can send a specially crafted HTTP request to trigger the route confusion and exploit the SQL injection. These conditions do not require prior authentication, making the risk particularly high for publicly exposed WordPress sites.