WordPress batch API sub-requests combining categories/0 DELETE with block-renderer paragraph POST (wp2shell handler crossover)

Emiliano Mema@Nosalva

•updated Jul 22, 2026•0•0•4

Detects suspicious batch requests to the WordPress REST API (/wp-json/batch/v1) containing both a DELETE operation on category ID 0 and a POST operation to the core block-renderer, which is characteristic of attempts to exploit vulnerabilities like CVE-2024-27956 to achieve unauthenticated remote code execution.