Magento no longer permits an unauthenticated user to remotely execute code on the server through APIs. Previously, an unauthenticated user could remotely execute PHP code on the server using either REST or SOAP APIs. (These APIs were enabled by default in most installations.)
Part of patch MAGENTO 2.0.6 SECURITY UPDATE
This vulnerability affects the following application versions:
- Magento 2.0.0
- Magento 2.0.0-rc
- Magento 2.0.0-rc2
- Magento 2.0.1
- Magento 2.0.2
- Magento 2.0.3
- Magento 2.0.4
- Magento 2.0.5