SQL injection via author_exclude/author__not_in scalar parameter (wp2shell)

Emiliano Mema@Nosalva

•updated Jul 22, 2026•0•0•8

Detects HTTP request attempts to exploit WordPress vulnerabilities (associated with 'wp2shell' activity) targeting the 'author_exclude' or 'author__not_in' parameters with SQL injection payloads, such as sleep() functions or comment injection characters.