WordPress Administrator Account Created via REST API with wp2shell IoC Username Prefix (wp2_/w2s_)

Duo Tech@duotech

•updated Jul 23, 2026•0•0•3

Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.