WordPress REST Batch Endpoint (wp2shell) POST Exploitation Activity
Alert on POST requests containing rest_route=/batch/v1 that return HTTP 207, consistent with wp2shell-style REST batch probing/exploitation.
- Category
- webserver
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-07-19
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags requests that attempt to exploit the WordPress REST batch endpoint by sending HTTP POST traffic with a query parameter containing /batch/v1. It relies on webserver telemetry that records the HTTP method, the response status code, and the full request URI query, and it matches only when the server returns a 207 status that indicates the batch endpoint is reachable. The intent is to capture wp2shell-style probing and exploitation activity, where attackers leverage the batch route to progress through pre-auth exploitation stages.
Reporting behind it
- github.comhttps://github.com/Icex0/wp2shell-poc
- slcyber.iohttps://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
- wordpress.orghttps://wordpress.org/news/2026/07/wordpress-7-0-2-release/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/CVE-2026-63030/web_exploit_cve_2026_63030_batch_rest_route_abuse.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: WordPress REST Batch Endpoint (wp2shell) POST Exploitation Activity
id: d913bed8-c202-4420-902c-1c9d04ab436b
status: experimental
description: This rule flags requests that attempt to exploit the WordPress REST batch endpoint by sending HTTP POST traffic with a query parameter containing /batch/v1. It relies on webserver telemetry that records the HTTP method, the response status code, and the full request URI query, and it matches only when the server returns a 207 status that indicates the batch endpoint is reachable. The intent is to capture wp2shell-style probing and exploitation activity, where attackers leverage the batch route to progress through pre-auth exploitation stages.
references:
- https://github.com/Icex0/wp2shell-poc
- https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
- https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/CVE-2026-63030/web_exploit_cve_2026_63030_batch_rest_route_abuse.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-07-19
tags:
- attack.initial-access
- attack.t1190
- detection.emerging-threats
- cve.2026-63030
- cve.2026-60137
logsource:
category: webserver
detection:
selection:
cs-method: POST
sc-status: 207
cs-uri-query|contains:
- rest_route=/batch/v1
- rest_route=%2Fbatch%2Fv1
condition: selection
falsepositives:
- WordPress CLI scripts or maintenance tooling invoking the batch endpoint via query parameter
level: medium
license: DRL-1.1
related:
- id: b8d5f301-2c49-4e6d-af83-4a5b6c7d8e9f
type: derived