wp2shell SQLi Forging Self-Referential post_parent via author_exclude

Duo Tech@duotech

•updated Jul 23, 2026•2•0•11

Detects malicious SQL injection attempts targeting WordPress REST API endpoints that attempt to forge post parameters by injecting self-referential cycles. The pattern specifically looks for 'UNION SELECT' combined with 'author_exclude' and manipulated 'post_parent' values, matching known exploitation patterns for the wp2shell vulnerability (CVE-2026-63030 / CVE-2026-60137).