WordPress Wp2shell REST Batch Endpoint Exploitation

Status: experimental
Severity: medium
Log source: category webserver
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects exploitation attempts against the WordPress REST batch endpoint (CVE-2026-63030, CVE-2026-60137) using the wp2shell PoC tool. The tool sends POST requests to the batch endpoint via the ?rest_route=/batch/v1 query parameter, covering all attack phases from initial probe through SQL injection and pre-auth admin creation. A 207 response confirms the endpoint is active on the target.

Known false positives

WordPress CLI scripts or maintenance tooling invoking the batch endpoint via query parameter

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application

Rule body

title: WordPress Wp2shell REST Batch Endpoint Exploitation
id: b8d5f301-2c49-4e6d-af83-4a5b6c7d8e9f
status: experimental
description: |
    Detects exploitation attempts against the WordPress REST batch endpoint (CVE-2026-63030,
    CVE-2026-60137) using the wp2shell PoC tool. The tool sends POST requests to the batch endpoint
    via the ?rest_route=/batch/v1 query parameter, covering all attack phases from initial probe
    through SQL injection and pre-auth admin creation. A 207 response confirms the endpoint is
    active on the target.
references:
    - https://github.com/Icex0/wp2shell-poc
    - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
    - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-07-19
tags:
    - attack.initial-access
    - attack.t1190
    - detection.emerging-threats
    - cve.2026-63030
    - cve.2026-60137
logsource:
    category: webserver
detection:
    selection:
        cs-method: 'POST'
        sc-status: 207
        cs-uri-query|contains:
            - 'rest_route=/batch/v1'
            - 'rest_route=%2Fbatch%2Fv1'
    condition: selection
falsepositives:
    - WordPress CLI scripts or maintenance tooling invoking the batch endpoint via query parameter
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    cs-method: 'POST'
    sc-status: 207
    cs-uri-query|contains:
        - 'rest_route=/batch/v1'
        - 'rest_route=%2Fbatch%2Fv1'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`cs-method`	eq	`POST`	`field:"cs-method" kind:eq value:"POST"`
`cs-uri-query`	match	`rest_route=%2Fbatch%2Fv1` `rest_route=/batch/v1`	`field:"cs-uri-query" kind:match`
`sc-status`	eq	`207`	`field:"sc-status" kind:eq value:"207"`