WordPress wp2shell CVE-2026-63030 Batch Route Confusion - Nested Sub-Request Malformed Path with Co-occurring Error Markers

Duo Tech@duotech

•updated Jul 23, 2026•0•0•4

Detects the WordPress REST API batch-route confusion technique (CVE-2026-63030) via a malformed nested sub-request path combined with the co-occurring parse_path_failed/block_cannot_read/rest_batch_not_allowed error marker pattern.