wp2shell-associated User-Agent observed on WordPress batch API traffic

Duo Tech@duotech

•updated Jul 23, 2026•0•0•1

Detects HTTP requests to the WordPress REST API batch endpoint carrying User-Agent strings associated with public wp2shell exploitation tooling (wp2shell, cve-2026-63030/1.0, rezwp2shell).