Emerging Threatmediumexperimental

WordPress Wp2shell REST Batch Endpoint Exploitation

Detects exploitation attempts against the WordPress REST batch endpoint (CVE-2026-63030, CVE-2026-60137) using the wp2shell PoC tool. The tool sends POST requests to the batch endpoint via the ?rest_route=/batch/v1 query parameter, covering all attack phases from initial probe through SQL injection and pre-auth admin creation. A 207 response confirms the endpoint is active on the target.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Swachchhanda Shrawan Poudel (Nextron Systems)Created Sun Jul 19b8d5f301-2c49-4e6d-af83-4a5b6c7d8e9f2026

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    selection:
        cs-method: 'POST'
        sc-status: 207
        cs-uri-query|contains:
            - 'rest_route=/batch/v1'
            - 'rest_route=%2Fbatch%2Fv1'
    condition: selection

False Positives

WordPress CLI scripts or maintenance tooling invoking the batch endpoint via query parameter

References

MITRE ATT&CK

Tactics

TA0001 · Initial Access