WordPress REST Probes Appear in Drupal Site Logs

Automated scanners sent WordPress-specific REST API requests to a website running Drupal, providing a practical example of how vulnerability scanning can reach sites regardless of their underlying CMS. Drupal developer Andres Torres Russo documented the activity in a 26 August 2026 LinkedIn article after finding requests for WordPress batch API routes in the access logs for antrecu.com. His logs showed requests for conventional WordPress paths and alternate REST routing forms, with different layers of the site's infrastructure returning 404 and 200 responses.

The route patterns drew attention because they overlap with paths documented in exploitation of two WordPress vulnerabilities patched in July 2026. CVE-2026-63030 involves REST API batch-route confusion, while CVE-2026-60137 is a facilitated SQL-injection vulnerability; chained together on affected versions, they can lead to unauthenticated remote code execution. The WordPress security release says versions 7.0.2 and 6.9.5 contain fixes for both issues, while the 6.8 branch was affected only by the SQL-injection issue and received its fix in version 6.8.6. F5 Labs documented exploitation using the canonical batch endpoint and alternate rest_route forms similar to those recorded by Andres.

Andres stops short of describing the traffic as a confirmed wp2shell exploit attempt because the access logs identify requested endpoints but do not contain the POST bodies needed to establish that the full vulnerability chain was used. Nothing in the evidence he presents indicates that the Drupal site was compromised. He uses the observation to show how Cloudflare, proxy and caching layers, the web server, routing rules, and Drupal can each affect the response to unsolicited traffic.