Report for IP: 129.146.127.121

This IP matched an entry on one of this site's local threat-intelligence blocklists (compiled from community-maintained abuse/attacker feeds) at the time of the request. Being listed on a reputation feed means other infrastructure has already independently observed and flagged this IP for malicious activity.

This IP probed the WordPress ?author= parameter to enumerate valid usernames, feeding a list of real accounts into subsequent credential-stuffing attacks. Pure reconnaissance with no legitimate use case.

This IP requested an installed plugin or theme's readme.txt/changelog.txt directly over HTTP — the file's "Stable tag:" line names the exact installed version, which an attacker cross-references against known CVEs for that version before firing the real exploit. WordPress.org's own tooling reads this file server-side, never over HTTP.

This IP attempted the "wp2shell" exploit chain (CVE-2026-63030 / CVE-2026-60137) — a WordPress core REST API vulnerability where the /batch/v1 endpoint's route dispatch can be confused into bypassing authentication, then chained with a SQL injection for unauthenticated remote code execution. Publicly weaponized since July 2026 with automated exploit toolkits circulating on GitHub. Patched in WordPress core 7.0.2 and 6.9.5 — any unpatched site remains fully exposed to this pre-auth RCE.