Saw my first `wp2shell` attempts in my logs

2026 Jul 22

The first core wp sql injection attack in recent memory. While I understand it's being actively exploited at the time of writing, it's wild to see it in my own tiny sites' log files. Here's what it looks like for reference.

[22/Jul/2026:10:30:08 -0700] "POST /wp-json/batch/v1 HTTP/1.1" 404 146 "-" "wp2shell"
[22/Jul/2026:10:30:09 -0700] "POST /?rest_route=/batch/v1 HTTP/1.1" 405 150 "-" "wp2shell"

Links:

• https://www.wordfence.com/blog/2026/07/wp2shell-aftermath-the-first-critical-unauthenticated-wordpress-core-rce-in-nearly-a-decade/
• https://slcyber.io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6/