{"id":350230,"date":"2026-08-10T06:45:48","date_gmt":"2026-08-10T06:45:48","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/batch-rest-guard\/"},"modified":"2026-08-10T06:45:17","modified_gmt":"2026-08-10T06:45:17","slug":"batch-rest-guard","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/batch-rest-guard\/","author":23469591,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.2.5","stable_tag":"1.2.5","tested":"7.0.3","requires":"4.1","requires_php":"7.2","requires_plugins":null,"header_name":"Batch REST Guard","header_author":"365dizajn","header_description":"Protect your site from the wp2shell hack (CVE-2026-63030): blocks unauthenticated REST batch API attacks, detects fake admin accounts and malicious plugins.","assets_banners_color":"","last_updated":"2026-08-10 06:45:17","external_support_url":"","external_repository_url":"","donate_link":"https:\/\/365dizajn.com","header_plugin_uri":"","header_author_uri":"https:\/\/365dizajn.com","rating":0,"author_block_rating":0,"active_installs":0,"downloads":49,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.2.2":{"tag":"1.2.2","author":"vladanrs","date":"2026-08-10 06:45:17"},"1.2.3":{"tag":"1.2.3","author":"vladanrs","date":"2026-08-10 06:45:17"},"1.2.4":{"tag":"1.2.4","author":"vladanrs","date":"2026-08-10 06:45:17"},"1.2.5":{"tag":"1.2.5","author":"vladanrs","date":"2026-08-10 06:45:17"}},"upgrade_notice":{"1.2.3":"<p>Improved description and FAQ. No code changes \u2014 safe to update.<\/p>","1.2.2":"<p>New plugin slug: batch-rest-guard. Delete the old wp2shell-guard folder before installing.<\/p>"},"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.2.2","1.2.3","1.2.4","1.2.5"],"block_files":[],"assets_screenshots":{"screenshot-1.jpg":{"filename":"screenshot-1.jpg","revision":3640066,"resolution":"1","location":"assets","locale":"","width":1485,"height":254}},"screenshots":{"1":"Plugin active on the Plugins screen with core status."}},"plugin_section":[],"plugin_tags":[1182,7900,1184,23853,600],"plugin_category":[54],"plugin_contributors":[274943],"plugin_business_model":[],"class_list":["post-350230","plugin","type-plugin","status-publish","hentry","plugin_tags-exploit","plugin_tags-hacked","plugin_tags-malware","plugin_tags-rest-api","plugin_tags-security","plugin_category-security-and-spam-protection","plugin_contributors-vladanrs","plugin_committers-vladanrs"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/batch-rest-guard.svg","icon_2x":false,"generated":true},"screenshots":[{"src":"https:\/\/ps.w.org\/batch-rest-guard\/assets\/screenshot-1.jpg?rev=3640066","caption":"Plugin active on the Plugins screen with core status."}],"raw_content":"<!--section=description-->\n<p><strong>Was your site hacked? Did you get a \"password changed\" email without requesting a reset?<\/strong> You may be a victim of the <strong>wp2shell<\/strong> attack \u2014 one of the most serious security issues in recent years.<\/p>\n\n<p>Batch REST Guard is a free security plugin that protects your website from the <strong>wp2shell<\/strong> exploit chain (<strong>CVE-2026-63030<\/strong> + <strong>CVE-2026-60137<\/strong>). Attackers use this vulnerability to break into sites <strong>without a password<\/strong>, create hidden administrator accounts, install backdoor plugins, and change your admin password \u2014 all through the REST API batch endpoint.<\/p>\n\n<h4>What does this plugin do?<\/h4>\n\n<ul>\n<li><strong>Blocks the attack entry point<\/strong> \u2014 stops unauthenticated requests to <code>\/wp-json\/batch\/v1<\/code> and <code>?rest_route=\/batch\/v1<\/code> (including POST body bypasses that fool some WAF rules).<\/li>\n<li><strong>Keeps your site working<\/strong> \u2014 logged-in users and the block editor (Gutenberg) continue to work normally.<\/li>\n<li><strong>Blocks known exploit tools<\/strong> \u2014 rejects requests from automated wp2shell scanners.<\/li>\n<li><strong>Alerts you if core is still vulnerable<\/strong> \u2014 reminds you to update to 6.8.6, 6.9.5, 7.0.2 or later.<\/li>\n<li><strong>Finds signs of an existing hack<\/strong> \u2014 warns about suspicious admin users (<code>w2s_*<\/code>, <code>wp2_*<\/code>, <code>wpsvc_*<\/code>) and fake plugins (<code>site-tweaks-\u2026<\/code>, <code>admin-utils-\u2026<\/code>, <code>content-tools-\u2026<\/code> and similar random names).<\/li>\n<\/ul>\n\n<h4>Who should install this?<\/h4>\n\n<ul>\n<li>Site owners affected by the <strong>wp2shell<\/strong> \/ <strong>batch REST<\/strong> vulnerability.<\/li>\n<li>Anyone who cannot update core immediately and needs a <strong>temporary security fix<\/strong>.<\/li>\n<li>Agencies and hosts managing multiple client sites.<\/li>\n<li>Sites behind Cloudflare or another WAF \u2014 use <strong>both<\/strong>; this plugin blocks attacks inside the application where edge rules may miss POST-body bypasses.<\/li>\n<\/ul>\n\n<h4>What is wp2shell?<\/h4>\n\n<p>Wp2shell is an unauthenticated <strong>remote code execution (RCE)<\/strong> attack against the WordPress REST API batch endpoint. It was actively exploited in the wild in 2026. Attackers can:<\/p>\n\n<ul>\n<li>Create rogue administrator accounts (often named <code>w2s_\u2026<\/code> or <code>wp2_\u2026<\/code>).<\/li>\n<li>Upload webshell plugins with innocent-looking names.<\/li>\n<li>Change existing admin passwords (you receive a \"password changed\" email).<\/li>\n<li>Take full control of your site without ever logging in.<\/li>\n<\/ul>\n\n<p><strong>Updating core is the complete fix.<\/strong> This plugin adds an essential extra layer and helps you spot leftover malware after a cleanup.<\/p>\n\n<h4>Compatible with<\/h4>\n\n<ul>\n<li>All hosting environments (shared, VPS, dedicated).<\/li>\n<li>Cloudflare, Patchstack, Wordfence and other security tools (works alongside them).<\/li>\n<li>PHP 7.2+ and WordPress 4.1+.<\/li>\n<li>Multisite and single-site installations.<\/li>\n<\/ul>\n\n<p>Developed by <a href=\"https:\/\/365dizajn.com\">365dizajn<\/a> \u2014 web design and hosting security.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the plugin files to <code>\/wp-content\/plugins\/batch-rest-guard\/<\/code>, or install through <strong>Plugins \u2192 Add New \u2192 Upload Plugin<\/strong>.<\/li>\n<li>Click <strong>Activate<\/strong>.<\/li>\n<li>Check the Plugins screen \u2014 you should see <strong>Core OK \u2014 guard active<\/strong>.<\/li>\n<li>If you see red admin warnings, follow the instructions (update core, delete suspicious users\/plugins).<\/li>\n<\/ol>\n\n<p>No configuration required. Protection starts immediately after activation.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"my%20admin%20password%20was%20changed%20and%20i%20did%20not%20request%20a%20reset.%20can%20this%20help%3F\"><h3>My admin password was changed and I did not request a reset. Can this help?<\/h3><\/dt>\n<dd><p>Yes. That is a common sign of the wp2shell attack. Install this plugin, update core immediately, delete any unknown admin users, and remove suspicious plugins. The plugin will alert you to known indicators of compromise.<\/p><\/dd>\n<dt id=\"do%20i%20still%20need%20this%20if%20core%20is%20already%20updated%3F\"><h3>Do I still need this if core is already updated?<\/h3><\/dt>\n<dd><p>Yes, as an extra layer. On 6.8.6 \/ 6.9.5 \/ 7.0.2 or newer, core is patched. The plugin still blocks anonymous batch requests and can alert you to leftover malicious admin users or fake plugins from a previous attack.<\/p><\/dd>\n<dt id=\"will%20this%20break%20the%20block%20editor%20%28gutenberg%29%3F\"><h3>Will this break the block editor (Gutenberg)?<\/h3><\/dt>\n<dd><p>No. Logged-in users can still use the batch API. Only unauthenticated (anonymous) requests are blocked.<\/p><\/dd>\n<dt id=\"i%20use%20cloudflare%20waf%20rules.%20is%20this%20plugin%20still%20needed%3F\"><h3>I use Cloudflare WAF rules. Is this plugin still needed?<\/h3><\/dt>\n<dd><p>Yes. Some early WAF rules only checked the URL, but attackers can send <code>rest_route=\/batch\/v1<\/code> in the POST body. This plugin blocks that inside WordPress regardless of your WAF.<\/p><\/dd>\n<dt id=\"does%20this%20replace%20wordfence%20or%20a%20security%20plugin%3F\"><h3>Does this replace Wordfence or a security plugin?<\/h3><\/dt>\n<dd><p>No. It complements them. Batch REST Guard focuses specifically on the wp2shell \/ REST batch attack vector. Keep your main security plugin and keep core updated.<\/p><\/dd>\n<dt id=\"what%20suspicious%20users%20and%20plugins%20does%20it%20detect%3F\"><h3>What suspicious users and plugins does it detect?<\/h3><\/dt>\n<dd><p>Administrator accounts starting with <code>w2s_<\/code>, <code>wp2_<\/code>, or <code>wpsvc_<\/code>, attacker email domains, and plugin folders matching known fake utility names or random hex suffixes (for example <code>site-tweaks-ab4378ea9c<\/code>).<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.2.5<\/h4>\n\n<ul>\n<li>Removed Plugin URI header (same as Author URI \u2014 WordPress.org submission requirement).<\/li>\n<\/ul>\n\n<h4>1.2.4<\/h4>\n\n<ul>\n<li>Short description trimmed to 150 characters (WordPress.org readme requirement).<\/li>\n<\/ul>\n\n<h4>1.2.3<\/h4>\n\n<ul>\n<li>Expanded plugin description and FAQ for better discoverability and clearer use cases.<\/li>\n<\/ul>\n\n<h4>1.2.2<\/h4>\n\n<ul>\n<li>Renamed plugin to Batch REST Guard (WordPress.org trademark compliance).<\/li>\n<li>Slug changed to batch-rest-guard.<\/li>\n<li>Requires at least WordPress 4.1 (wp_json_encode compatibility).<\/li>\n<li>Plugin Check fixes: error_log phpcs ignore, ZIP paths.<\/li>\n<\/ul>\n\n<h4>1.2.1<\/h4>\n\n<ul>\n<li>Fixed ZIP packaging for Linux servers.<\/li>\n<\/ul>\n\n<h4>1.2.0<\/h4>\n\n<ul>\n<li>First public release (as wp2shell-guard).<\/li>\n<\/ul>","raw_excerpt":"Block wp2shell REST batch attacks (CVE-2026-63030). Detect fake admins and backdoor plugins. Extra security for hacked sites.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/350230","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=350230"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/vladanrs"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=350230"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=350230"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=350230"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=350230"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=350230"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=350230"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}