WordPress wp2shell time-based SQL injection via author__not_in SLEEP() derived-table pattern - repeated attempts

Duo Tech@duotech

•updated Jul 23, 2026•0•0•4

Detects multiple repeated web requests targeting WordPress 'author_exclude' or '/wp/v2/batch' endpoints that contain suspicious time-based SQL injection payloads. The rule specifically looks for patterns attempting to leverage SLEEP() functions to infer database information.