WordPress batch API desync: categories request returns block_cannot_read error

Emiliano Mema@Nosalva

•updated Jul 22, 2026•0•0•4

Detects anomalous server responses for WordPress REST API requests targeting /wp/v2/categories/0 where the error message 'block_cannot_read' is returned instead of the expected 'rest_term_invalid'. This behavior is indicative of attempted exploitation using the wp2shell batch-handler desync vulnerability.