wp2shell Follow-on Plugin Install/Upload or Privileged User REST Endpoint Access After Batch API Anomaly

Duo Tech@duotech

•updated Jul 23, 2026•0•0•3

Detects requests to WordPress plugin-install/upload or privileged user REST endpoints occurring shortly after anomalous WordPress REST API batch activity, consistent with post-exploitation follow-through in the wp2shell chain.