SkelerSecurity Core Security Plugin

A focused, temporary mitigation for unauthenticated access to WordPress Core’s REST Batch API endpoint.

Overview

SkelerSecurity Core Security Plugin requires authentication before WordPress processes requests to the Core REST Batch API route:

• /wp-json/batch/v1
• /?rest_route=/batch/v1

It is designed as a narrowly scoped defense-in-depth control for the WordPress REST Batch API vulnerability chain commonly referred to as wp2shell. The plugin uses WordPress’s rest_pre_dispatch filter to reject anonymous batch requests with HTTP 401 Unauthorized, while preserving access for authenticated WordPress and REST API users.

[!IMPORTANT] This plugin is a temporary mitigation, not a replacement for WordPress Core updates. Apply the latest WordPress security release immediately and verify that the update completed successfully.

Threat context

Public reporting describes a critical WordPress Core vulnerability chain involving REST Batch API route confusion (CVE-2026-63030) and a related SQL-injection issue (CVE-2026-60137). The affected endpoint can be reached in both pretty-permalink and query-string REST routing forms.

Reported affected Core releases include:

The WordPress 6.8 branch also received related hardening in 6.8.6. Use the newest available supported WordPress release for your environment rather than treating version ranges as a reason to delay updating.

What the plugin does

• Requires a valid authenticated WordPress user for the /batch/v1 REST route.
• Covers both /wp-json/batch/v1 and ?rest_route=/batch/v1, because WordPress resolves both to the same REST route.
• Returns a standard REST error with HTTP status 401 for anonymous requests.
• Runs early in REST dispatch (rest_pre_dispatch priority -1000).
• Allows authenticated REST requests, including valid REST authentication methods recognized by WordPress.
• Provides a Tools → SkelerSecurity Core settings page.
• Includes an optional, privacy-minimized audit log of blocked attempts.
• Deletes its options and log when the plugin is deleted from WordPress.

What the plugin does not do

• It does not patch WordPress Core or remove the underlying vulnerability.
• It does not protect an installation if WordPress fails before plugins can load.
• It does not replace a WAF, reverse proxy, server hardening, monitoring, backups, or incident response.
• It does not determine whether a site was previously compromised.
• It does not block the entire REST API.

For strongest temporary coverage, pair this plugin with a WAF or reverse-proxy rule that blocks anonymous requests to both endpoint forms listed above.

Requirements

• WordPress 5.6 or later
• PHP 7.2 or later
• Administrator access to install and activate plugins

Installation

Option 1: WordPress Admin upload

1. Download the project as a ZIP archive, or use the release package.
2. In WordPress Admin, open Plugins → Add New → Upload Plugin.
3. Select the ZIP archive and choose Install Now.
4. Activate SkelerSecurity Core Security Plugin.
5. Open Tools → SkelerSecurity Core to confirm protection is enabled.

Option 2: Filesystem / SSH / FTP

1. Copy the skelersecurity-core-security directory into:

   root@kitploit:~

   wp-content/plugins/
   

2. Activate the plugin in Plugins → Installed Plugins.

3. Review the plugin status at Tools → SkelerSecurity Core.

Option 3: WP-CLI

wp plugin activate skelersecurity-core-security

Configuration

The plugin is enabled immediately after activation. Visit Tools → SkelerSecurity Core to manage:

Audit-log privacy

The optional audit log stores only:

• UTC timestamp
• HTTP method
• REST route (/batch/v1)

It intentionally does not record IP addresses, cookies, authorization headers, request bodies, usernames, or other sensitive request data.

Expected behavior

An anonymous blocked response uses the error code:

rest_batch_authentication_required

Recommended emergency deployment plan

1. Update WordPress Core immediately. This is the actual remediation.
2. Confirm the updated Core version across production, staging, campaign, and legacy sites.
3. Enable this plugin only as a temporary application-layer mitigation where needed.
4. At the WAF, CDN, reverse proxy, or web server, block anonymous requests matching both:
   • /wp-json/batch/v1
   • rest_route=/batch/v1
5. Review access logs, administrator accounts, installed plugins/themes, uploads, and must-use plugins for signs of compromise.
6. If suspicious activity is found, treat the host as potentially compromised and follow your incident-response process.
7. After Core patching and validation, decide whether the temporary endpoint restriction remains necessary for your environment.

Compatibility and operational considerations

The Batch API may be used by WordPress administration workflows, plugins, themes, mobile clients, or external integrations. Authenticated requests remain permitted, but test business-critical functions after enabling the plugin.

Potential impacts can include integrations that intentionally submit unauthenticated requests to the Core Batch API. If that behavior is required, assess the risk carefully and implement a properly authenticated integration rather than broadly exposing the endpoint.

WAF and reverse-proxy guidance

A network-layer mitigation should cover both routing styles. Blocking only /wp-json/batch/v1 is insufficient because WordPress can also route the request through the rest_route query parameter.

Recommended rule logic:

• Deny anonymous requests whose normalized path is /wp-json/batch/v1 (allow optional trailing slash).
• Deny anonymous requests with query parameter rest_route=/batch/v1.
• Log the block decision using an appropriate rule ID and standard request metadata.
• Avoid retaining sensitive request bodies or credentials in logs unless required and protected by policy.

Test the rule in your environment. This plugin is useful if a WAF change cannot be deployed immediately, but it should not prevent you from patching WordPress Core.

Security reporting

Please do not report security vulnerabilities through public GitHub issues.

Report suspected vulnerabilities privately to your security contact or the repository owner. Include a clear description, affected version, reproducible proof of concept, and impact assessment. Do not include credentials, personal data, or destructive payloads.

References

• Hadrian — wp2shell: Pre-Auth RCE in WordPress Core’s REST API
• Patchstack — Unauthenticated SQL Injection in WordPress Core Fixed in 7.0.2
• Cyber Insider — WordPress releases emergency update for critical “wp2shell” RCE flaw

License

This project is licensed under the GNU General Public License v2.0 or later.