WordPress Wp2shell REST Batch Endpoint Exploitation
Detects exploitation attempts against the WordPress REST batch endpoint (CVE-2026-63030, CVE-2026-60137) using the wp2shell PoC tool. The tool sends POST requests to the batch endpoint via the ?rest_route=/batch/v1 query parameter, covering all attack phases from initial probe through SQL injection and pre-auth admin creation. A 207 response confirms the endpoint is active on the target.
Detection logic
selection
cs-method: POST
sc-status: 207
cs-uri-query|contains:
- rest_route=/batch/v1
- rest_route=%2Fbatch%2Fv1Condition
selectionRaw YAML
title: WordPress Wp2shell REST Batch Endpoint Exploitation
id: b8d5f301-2c49-4e6d-af83-4a5b6c7d8e9f
status: experimental
description: |
Detects exploitation attempts against the WordPress REST batch endpoint (CVE-2026-63030,
CVE-2026-60137) using the wp2shell PoC tool. The tool sends POST requests to the batch endpoint
via the ?rest_route=/batch/v1 query parameter, covering all attack phases from initial probe
through SQL injection and pre-auth admin creation. A 207 response confirms the endpoint is
active on the target.
references:
- https://github.com/Icex0/wp2shell-poc
- https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
- https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-07-19
tags:
- attack.initial-access
- attack.t1190
- detection.emerging-threats
- cve.2026-63030
- cve.2026-60137
logsource:
category: webserver
detection:
selection:
cs-method: 'POST'
sc-status: 207
cs-uri-query|contains:
- 'rest_route=/batch/v1'
- 'rest_route=%2Fbatch%2Fv1'
condition: selection
falsepositives:
- WordPress CLI scripts or maintenance tooling invoking the batch endpoint via query parameter
level: mediumFalse positives
- WordPress CLI scripts or maintenance tooling invoking the batch endpoint via query parameter