Active Exploitation Alert: CISA Warns of Critical WordPress Core SQL Injection Vulnerability
Executive Summary
On July 22, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent threat warning adding a critical WordPress Core SQL Injection Vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability affects millions of self-hosted WordPress web applications globally, allowing unauthenticated remote attackers to execute arbitrary SQL commands directly against underlying MySQL/MariaDB database instances. Active threat campaigns are weaponizing this flaw to exfiltrate hashed administrator credentials, create unauthorized super-user accounts, and write persistent PHP web shells to hijack web hosting environments.
Deep-Dive Technical Analysis
Forensic analysis of active exploitation traffic demonstrates that the flaw stems from inadequate input sanitization within core database query wrapper functions:
1. Flawed Database Query Sanitization: The vulnerability exists in how WordPress core functions (specifically $wpdb->prepare()) process unescaped array arguments passed through specific REST API and XML-RPC endpoints. When malformed HTTP queries are submitted with nested arrays containing SQL meta-characters, the query builder fails to properly escape single quotes and wildcard characters.
2. Exploitation & Data Exfiltration Mechanics: Unauthenticated attackers transmit crafted POST requests containing time-based or union-based SQL payloads (e.g., ' UNION SELECT 1, user_pass, user_login FROM wp_users--). This allows attackers to bypass core authentication barriers, exfiltrate the entire wp_users table (including salted MD5/phpass password hashes), and modify the wp_options table to set users_can_register to enabled with default roles set to administrator.
3. Web Shell Deployment: Once administrative access is gained or forged via SQL injection, threat actors navigate to the WordPress theme editor or plugin installer to upload malicious PHP scripts (such as wso.php or custom backdoor loaders), securing full remote command execution (RCE) on the web server operating system.
Industry Impact and Mitigation Strategies
Given that WordPress powers over 40% of the top 10 million websites globally, this active SQL injection campaign poses an existential threat to online publishing, e-commerce, and enterprise web portals:
* Immediate Core Security Updates: Website administrators MUST immediately update WordPress core installations to the latest patched version (including maintenance releases across active branches).
* Disable XML-RPC & Restrict Unused API Endpoints: Disable xmlrpc.php and restrict access to /wp-json/wp/v2/ REST API endpoints using Web Application Firewall (WAF) rules or server-level .htaccess configurations if public submission is not required.
* Database Privilege Hardening: Enforce strict principle-of-least-privilege for MySQL/MariaDB database users. Ensure the WordPress database user account lacks administrative permissions like FILE, SUPER, or DROP DATABASE.
* Database & File Integrity Audits: Audit the wp_users table for unauthorized administrator accounts created recently, scan wp-content directories for suspicious PHP files, and rotate all administrative passwords immediately.
References:
* CISA Warns of WordPress Core SQL Injection Vulnerability Actively Exploited
* CISA Known Exploited Vulnerabilities (KEV) Catalog