wp2shell oEmbed write abuse forging admin account without admin UI session

Emiliano Mema@Nosalva

•updated Jul 22, 2026•0•0•3

Detects unauthorized modifications to the 'wp_users' table in a WordPress database. The rule correlates specific WordPress REST API calls (oEmbed or batch processing endpoints) originating from the same source IP address that performs database inserts or updates, while explicitly excluding activity originating from verified Admin UI sessions.