WordPress wp2shell Exploitation: Vulnerable Version Banner Co-occurring with Suspicious Batch REST API Activity

Duo Tech@duotech

•updated Jul 23, 2026•1•0•5

Detects attempts to exploit the WordPress wp2shell vulnerability (CVE-2026-63030/CVE-2026-60137) by correlating the identification of a vulnerable WordPress version (6.9.0-6.9.4 or 7.0.0-7.0.1) via response banners with anomalous Batch REST API requests utilizing the 'author__not_in' parameter.