High-volume sequential POST requests to WordPress batch API (wp2shell SQLi extraction)

Emiliano Mema@Nosalva

•updated Jul 22, 2026•1•0•13

Detects high-frequency requests to WordPress REST API batch endpoints, which are commonly used in automated exploitation or scanning attempts against WordPress installations. An unusual volume of these requests from a single client IP within a short time window is a strong indicator of unauthorized probing or exploit activity.