Unauthenticated request to WordPress REST batch API /wp-json/batch/v1 (wp2shell)

Emiliano Mema@Nosalva

•updated Jul 22, 2026•1•0•6

This rule detects unauthenticated HTTP requests to the WordPress REST API batch endpoint (/wp-json/batch/v1). Such requests are characteristic of attempts to exploit the wp2shell vulnerability (CVE-2026-63030), where attackers leverage the batch API to execute unauthorized actions without proper authentication headers (Cookie or Authorization).