WordPress wp_users Credential Extraction via SQLi on REST Batch Endpoint (wp2shell)

Georgios Maragos@Gmarak

•updated Jul 18, 2026•17•0•79

Detects potential SQL injection attempts targeting the WordPress REST API batch endpoint (/wp-json/batch/v1) specifically attempting to query the wp_users table for credential fields such as user_pass or user_login.