SQL injection attempt in WP_Query via abused REST batch endpoint (wp2shell)

Emiliano Mema@Nosalva

•updated Jul 22, 2026•6•0•4

Detects potential SQL injection attempts against Azure App Service endpoints (specifically /wp-json/batch/v1 and /batch/v1) by identifying SQL-specific characters in URI query parameters that correlate with SQL syntax error logs within a 5-minute window.