WordPress Wp2shell REST Batch Endpoint Exploitation

Description

Detects exploitation attempts against the WordPress REST batch endpoint (CVE-2026-63030, CVE-2026-60137) using the wp2shell PoC tool. The tool sends POST requests to the batch endpoint via the ?rest_route=/batch/v1 query parameter, covering all attack phases from initial probe through SQL injection and pre-auth admin creation. A 207 response confirms the endpoint is active on the target.

Query · sigma

selection:
  cs-method: POST
  sc-status: 207
  cs-uri-query|contains:
  - rest_route=/batch/v1
  - rest_route=%2Fbatch%2Fv1
condition: selection

Known false positives

  • WordPress CLI scripts or maintenance tooling invoking the batch endpoint via query parameter
Raw source WordPress Wp2shell REST Batch Endpoint Exploitation · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: WordPress Wp2shell REST Batch Endpoint Exploitation
id: b8d5f301-2c49-4e6d-af83-4a5b6c7d8e9f
status: experimental
description: |
    Detects exploitation attempts against the WordPress REST batch endpoint (CVE-2026-63030,
    CVE-2026-60137) using the wp2shell PoC tool. The tool sends POST requests to the batch endpoint
    via the ?rest_route=/batch/v1 query parameter, covering all attack phases from initial probe
    through SQL injection and pre-auth admin creation. A 207 response confirms the endpoint is
    active on the target.
references:
    - https://github.com/Icex0/wp2shell-poc
    - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
    - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-07-19
tags:
    - attack.initial-access
    - attack.t1190
    - detection.emerging-threats
    - cve.2026-63030
    - cve.2026-60137
logsource:
    category: webserver
detection:
    selection:
        cs-method: 'POST'
        sc-status: 207
        cs-uri-query|contains:
            - 'rest_route=/batch/v1'
            - 'rest_route=%2Fbatch%2Fv1'
    condition: selection
falsepositives:
    - WordPress CLI scripts or maintenance tooling invoking the batch endpoint via query parameter
level: medium

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.