WP2SHELL - Unauthenticated REST API batch/v1 request with nested requests array or anomalous sub-request method pattern

Duo Tech@duotech

•updated Jul 23, 2026•0•0•3

Detects unauthenticated POST requests to the WordPress REST API batch endpoint (/wp-json/batch/v1 or ?rest_route=/batch/v1) containing a nested requests array or an anomalous sub-request method pattern, the network entry point for the wp2shell CVE-2026-63030/CVE-2026-60137 exploit chain.