=== Batch REST Guard ===
Contributors: vladanrs
Donate link: https://365dizajn.com
Tags: security, rest-api, malware, exploit, batch
Requires at least: 4.1
Tested up to: 7.0
Stable tag: 1.2.2
Requires PHP: 7.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Blocks unauthenticated REST batch requests used by the wp2shell exploit chain and warns about known indicators of compromise.

== Description ==

Batch REST Guard protects sites from unauthenticated abuse of the REST API batch endpoint (`/wp-json/batch/v1` and `?rest_route=/batch/v1`). That endpoint is the entry point of the **wp2shell** exploit chain (CVE-2026-63030 + CVE-2026-60137).

* Blocks anonymous access to the REST batch endpoint.
* Still allows logged-in users (the block editor may use the batch API).
* Blocks requests with known exploit User-Agent signatures.
* Warns administrators if core is still in a vulnerable version range.
* Warns about known attack indicators such as `w2s_*` admin accounts and suspicious randomly named plugin folders.

**Important:** Updating core to a patched release (6.8.6, 6.9.5, 7.0.2, or later) remains the complete fix. This plugin is an extra layer of protection.

== Installation ==

1. Upload the plugin files to `/wp-content/plugins/batch-rest-guard/`, or install through Plugins → Add New → Upload.
2. Activate the plugin through the Plugins screen.

== Frequently Asked Questions ==

= Do I still need this if core is already updated? =

Yes, as an extra layer. On 6.8.6 / 6.9.5 / 7.0.2 or newer, core is patched. The plugin still blocks anonymous batch requests and can alert you to leftover malicious admin users or fake plugins.

= Will this break the block editor (Gutenberg)? =

No. Logged-in users can still use the batch API. Only unauthenticated requests are blocked.

= What about Cloudflare or other WAF rules? =

Use both. WAF rules help at the edge; this plugin blocks the request inside the application, including cases where `rest_route` is sent in the POST body.

== Changelog ==

= 1.2.2 =
* Renamed plugin to Batch REST Guard (WordPress.org trademark compliance).
* Slug changed to batch-rest-guard.
* Requires at least WordPress 4.1 (wp_json_encode compatibility).
* Plugin Check fixes: error_log phpcs ignore, ZIP paths.

= 1.2.1 =
* Fixed ZIP packaging for Linux servers.

= 1.2.0 =
* First public release (as wp2shell-guard).

== Upgrade Notice ==

= 1.2.2 =
New plugin slug: batch-rest-guard. Delete the old wp2shell-guard folder before installing.

== Screenshots ==

1. Plugin active on the Plugins screen with core status.
