WP2Shell Exposure Detection

Steven Lim@KQLWizard

•updated Jul 18, 2026•162•0•378

This KQL detect public internet facing WordPress installation that is susceptible to WP2Shell a pre-auth RCE chain in core that lets anonymous attackers run code on default installs, no plugins required.