WordPress wp2shell Error-Based SQLi via EXTRACTVALUE/UPDATEXML

Duo Tech@duotech

•updated Jul 23, 2026•0•0•4

Detects attempts to perform error-based SQL injection against WordPress instances associated with the wp2shell exploit chain. The rule monitors for the use of MySQL functions EXTRACTVALUE or UPDATEXML within query parameters that are typically targeted by the exploit (author_exclude, author__not_in) or when interacting with the batch REST endpoint.