| Server IP : 64.225.102.56 / Your IP : 216.73.216.220 Web Server : Apache/2.4.68 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/3.0.2 System : Linux smtp.zejefoy.com 5.15.0-185-generic #195-Ubuntu SMP Fri Jun 19 17:11:50 UTC 2026 x86_64 User : auto ( 1002) PHP Version : 7.4.33 Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,exec,system,passthru,shell_exec,proc_open,popen MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : ON Directory : /home/auto/web/cifisoa.com/public_html/wp-content/mu-plugins/ |
Upload File : |
<?php
/**
* Plugin Name: WP2Shell Batch Guard (Must-Use)
* Description: Blocks anonymous REST batch API (wp2shell mitigation).
* Version: 1.1.0
*/
if (!defined('ABSPATH')) {
exit;
}
function wp2shell_fixer_is_batch_route($route) {
$route = strtolower((string) $route);
$route = function_exists('untrailingslashit') ? untrailingslashit($route) : rtrim($route, '/');
if ($route === '/batch/v1' || $route === 'batch/v1') {
return true;
}
return (bool) preg_match('#(^|/)batch/v1$#', $route);
}
function wp2shell_fixer_require_auth_for_rest_batch($result, $server, $request) {
if (!is_object($request) || !method_exists($request, 'get_route')) {
return $result;
}
if (!wp2shell_fixer_is_batch_route($request->get_route())) {
return $result;
}
if (function_exists('is_user_logged_in') && is_user_logged_in()) {
return $result;
}
return new WP_Error(
'rest_batch_authentication_required',
'Authentication is required to use the batch API.',
array('status' => 401)
);
}
add_filter('rest_pre_dispatch', 'wp2shell_fixer_require_auth_for_rest_batch', -1000, 3);
add_filter('rest_authentication_errors', function ($result) {
if (true === $result || is_wp_error($result)) {
return $result;
}
$uri = isset($_SERVER['REQUEST_URI']) ? (string) $_SERVER['REQUEST_URI'] : '';
$rest = isset($_REQUEST['rest_route']) ? (string) $_REQUEST['rest_route'] : '';
$hit = (stripos($uri, 'batch/v1') !== false)
|| (stripos($rest, 'batch/v1') !== false)
|| (stripos($uri, 'rest_route=/batch') !== false);
if (!$hit) {
return $result;
}
if (function_exists('is_user_logged_in') && is_user_logged_in()) {
return $result;
}
return new WP_Error(
'rest_batch_authentication_required',
'Authentication is required to use the batch API.',
array('status' => 401)
);
}, 99);