shadowdao
b892438070
HAProxy Manager Build and Push / Build-and-Push (push) Successful in 2m56s
Adds a frontend virtual patch denying /wp-json/batch/v1 and the ?rest_route=/batch/v1 fallback (including the %2F-encoded spelling) for requests without a wordpress_logged_in_* cookie. wp2shell chains CVE-2026-60137 (core SQL injection) with CVE-2026-63030 (REST batch-route confusion) into unauthenticated RCE on WP 6.9.0-6.9.4 and 7.0.0-7.0.1. Exploits are public and were used against this fleet on 2026-07-19/20; one site was compromised through this path, including a re-injection of wp-includes/plugin.php nine minutes after it was patched. Anonymous-only by design: batch/v1 is used legitimately by the block editor for multi-entity saves, so a blanket deny would break wp-admin. Placed ahead of the SPOE handoff so blocked requests never cost a WAF round-trip, and it works regardless of Coraza mode (whp02 and sdbees run detect_only, where a Coraza rule would log but not block). This is a virtual patch, not a fix. It removes reachability only, and stays until every site is confirmed on a fixed release. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>