WordPress wp2shell REST batch API route confusion via malformed sub-request path

Emiliano Mema@Nosalva

•updated Jul 22, 2026•0•0•3

This rule detects a specific HTTP request pattern targeting the WordPress REST API batch endpoint. It identifies a malformed sub-request path containing a path string formatted as 'http://:', which is indicative of a 'route confusion' attempt, potentially leading to unauthorized operations or SSRF (Server-Side Request Forgery) within the WordPress environment.