wp2shell post-exploitation webshell plugin file drop

Emiliano Mema@Nosalva

•updated Jul 22, 2026•1•0•5

Detects the creation of a PHP file with a specific malicious naming convention ('disable-batch-api-for-unauth.php') commonly associated with wp2shell post-exploitation activity in WordPress plugin or upload directories.