Active installations100Adoption metric — not a quality score
WordPress.org ratingNo WordPress.org ratings yet
Official packageDirect from WordPress.org
Repository metrics are context, not quality scores. Active installations measure adoption and can strongly reflect a plugin’s age and historical popularity. Ratings, recent updates and “Tested up to” metadata also do not guarantee modern code, error-free operation, security, feature completeness or suitability for a particular site. Why active installs don’t tell the whole story →
WP PlugIndex currently records Batch REST Guard version 1.2.5 as active, updated 2mo ago and tested up to WordPress 7.0.
Overview
About this plugin
Was your site hacked? Did you get a “password changed” email without requesting a reset? You may be a victim of the wp2shell attack — one of the most serious security issues in recent years.
Batch REST Guard is a free security plugin that protects your website from the wp2shell exploit chain ( CVE-2026-63030 + CVE-2026-60137 ). Attackers use this vulnerability to break into sites without a password, create hidden administrator accounts, install backdoor plugins, and change your admin password — all through the REST API batch endpoint.
What does this plugin do?
Blocks the attack entry point — stops unauthenticated requests to /wp-json/batch/v1 and?rest_route=/batch/v1 (including POST body bypasses that fool some WAF rules).
Keeps your site working — logged-in users and the block editor (Gutenberg) continue to work normally.
Blocks known exploit tools — rejects requests from automated wp2shell scanners.
Alerts you if core is still vulnerable — reminds you to update to 6.8.6, 6.9.5, 7.0.2 or later.
Finds signs of an existing hack — warns about suspicious admin users ( w2s_*, wp2_*, wpsvc_* ) and fake plugins ( site-tweaks-…, admin-utils-…, content-tools-… and similar random names).
Who should install this?
Site owners affected by the wp2shell / batch REST vulnerability.
Anyone who cannot update core immediately and needs a temporary security fix.
Agencies and hosts managing multiple client sites.
Sites behind Cloudflare or another WAF — use both; this plugin blocks attacks inside the application where edge rules may miss POST-body bypasses.
What is wp2shell?
Wp2shell is an unauthenticated remote code execution (RCE) attack against the WordPress REST API batch endpoint. It was actively exploited in the wild in 2026. Attackers can:
Create rogue administrator accounts (often named w2s_… or wp2_… ).
Upload webshell plugins with innocent-looking names.
Change existing admin passwords (you receive a “password changed” email).
Take full control of your site without ever logging in.
Updating core is the complete fix. This plugin adds an essential extra layer and helps you spot leftover malware after a cleanup.
Compatible with
All hosting environments (shared, VPS, dedicated).
Cloudflare, Patchstack, Wordfence and other security tools (works alongside them).
PHP 7.2+ and WordPress 4.1+.
Multisite and single-site installations.
Developed by 365dizajn — web design and hosting security.
WordPress.org metadata
Plugin tags
Topics listed for this plugin in the WordPress.org directory.
rest api
exploit
hacked
malware
security
Compatibility & maintenance
Compatibility & maintenance
Tested up to WordPress 7.0
Not yet marked as tested with WordPress 7.1. WordPress.org currently lists Tested up to 7.0.
Current WordPress releaseWordPress 7.1
WordPress.org Tested up to7.0
Minimum requirementsWordPress 4.1 · PHP 7.2
Update activity10 Aug 20262mo ago
“Tested up to” is directory metadata supplied by the plugin author. WP PlugIndex does not turn an older declaration into a claim that the plugin is incompatible.
Changes recorded by WP PlugIndex
Recent tracked changes
No tracked version or compatibility changes have been recorded by WP PlugIndex yet.
Tracking & source
WP PlugIndex tracks public WordPress.org directory metadata and records selected version, compatibility and availability changes as they are detected.
