WordPress Wp2shell REST Batch Endpoint Exploitation
Detects exploitation attempts against the WordPress REST batch endpoint (CVE-2026-63030, CVE-2026-60137) using the wp2shell PoC tool. The tool sends POST requests to the batch endpoint via the ?rest_route=/batch/v1 query parameter, covering all attack phases from initial probe through SQL injection and pre-auth admin creation. A 207 response confirms the endpoint is active on the target.
Sigma rule (View on GitHub)
1title: WordPress Wp2shell REST Batch Endpoint Exploitation
2id: b8d5f301-2c49-4e6d-af83-4a5b6c7d8e9f
3status: experimental
4description: |
5 Detects exploitation attempts against the WordPress REST batch endpoint (CVE-2026-63030,
6 CVE-2026-60137) using the wp2shell PoC tool. The tool sends POST requests to the batch endpoint
7 via the ?rest_route=/batch/v1 query parameter, covering all attack phases from initial probe
8 through SQL injection and pre-auth admin creation. A 207 response confirms the endpoint is
9 active on the target.
10references:
11 - https://github.com/Icex0/wp2shell-poc
12 - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
13 - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
14author: Swachchhanda Shrawan Poudel (Nextron Systems)
15date: 2026-07-19
16tags:
17 - attack.initial-access
18 - attack.t1190
19 - detection.emerging-threats
20 - cve.2026-63030
21 - cve.2026-60137
22logsource:
23 category: webserver
24detection:
25 selection:
26 cs-method: 'POST'
27 sc-status: 207
28 cs-uri-query|contains:
29 - 'rest_route=/batch/v1'
30 - 'rest_route=%2Fbatch%2Fv1'
31 condition: selection
32falsepositives:
33 - WordPress CLI scripts or maintenance tooling invoking the batch endpoint via query parameter
34level: medium
References
-
-
Critical issue discovered in WordPress Core affecting the majority of WordPress-built sites. The zero-day is a pre-authentication Remote Code Execution (RCE) that can be used by attackers to run malicious code to steal data or seize control without requiring login details...
Read More -
WordPress 7.0.2 is now available. The 7.0.2 security release addresses one critical and one high severity security issue. Because this is a security release, it is recommended that you update your ...
Read More
Related rules
- WordPress Wp2shell Exploitation Tool User-Agent
- WordPress Wp2shell Webshell Plugin Access
- RedTail Cryptominer User-Agent
- Suspicious Child Process of SolarWinds WebHelpDesk
- Linux Suspicious Child Process from Node.js - React2Shell