WordPress REST Batch endpoint wp2shell exploitation via POST with rest_route=/batch/v1

Alert on POST requests containing rest_route=/batch/v1 that return HTTP 207, consistent with wp2shell-style REST batch probing/exploitation.

FreeUnreviewedSigmamediumv1

wordpress-rest-batch-endpoint-wp2shell-exploitation-via-post-with-rest-route-bat-b8d5f301

title: WordPress REST Batch endpoint wp2shell exploitation via POST with rest_route=/batch/v1
id: d913bed8-c202-4420-902c-1c9d04ab436b
status: experimental
description: This rule flags exploitation attempts against the WordPress REST batch endpoint by looking for HTTP POST requests with a query parameter specifying /batch/v1. The behavior matters because attackers can use the wp2shell PoC to drive multi-step attacks through the batch endpoint, including probing and payload delivery. Detection relies on webserver HTTP telemetry capturing the request method, query string (rest_route), and the 207 (Multi-Status) response indicating the endpoint is reachable.
references:
  - https://github.com/Icex0/wp2shell-poc
  - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
  - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/CVE-2026-63030/web_exploit_cve_2026_63030_batch_rest_route_abuse.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-07-19
tags:
  - attack.initial-access
  - attack.t1190
  - detection.emerging-threats
  - cve.2026-63030
  - cve.2026-60137
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    sc-status: 207
    cs-uri-query|contains:
      - rest_route=/batch/v1
      - rest_route=%2Fbatch%2Fv1
  condition: selection
falsepositives:
  - WordPress CLI scripts or maintenance tooling invoking the batch endpoint via query parameter
level: medium
license: DRL-1.1
related:
  - id: b8d5f301-2c49-4e6d-af83-4a5b6c7d8e9f
    type: derived

What it detects

This rule flags exploitation attempts against the WordPress REST batch endpoint by looking for HTTP POST requests with a query parameter specifying /batch/v1. The behavior matters because attackers can use the wp2shell PoC to drive multi-step attacks through the batch endpoint, including probing and payload delivery. Detection relies on webserver HTTP telemetry capturing the request method, query string (rest_route), and the 207 (Multi-Status) response indicating the endpoint is reachable.

Known false positives

WordPress CLI scripts or maintenance tooling invoking the batch endpoint via query parameter

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.