WordPress REST user-create request flips from 401 to 201 (wp2shell account forgery)

Emiliano Mema@Nosalva

•updated Jul 22, 2026•0•0•6

Detects rapid sequence of unsuccessful (401) followed by successful (201) POST requests to the WordPress user API endpoint from the same source IP, indicating potential brute force or account enumeration attempts.