In reply to Josh Carl.

Here it is in the wild:

212.113.119.6 – – [28/Mar/2023:22:46:22 +1100] “POST /wp-json/wp/v2/plugins HTTP/1.1” 500 96 “https://***/” “Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:48.0) Gecko/20100101 Firefox/48.0”
212.113.119.6 – – [28/Mar/2023:22:46:28 +1100] “POST /wp-json/wp/v2/pages HTTP/1.1” 500 96 “https://***/wp-json/wp/v2/plugins” “Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:48.0) Gecko/20100101 Firefox/48.0”

First hit on the 28th did not work.
Two days later:
212.113.119.6 – – [30/Mar/2023:16:46:55 +1100] “POST /wp-json/wp/v2/plugins HTTP/1.1” 201 647 “https://***/” “Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko”
212.113.119.6 – – [30/Mar/2023:16:47:04 +1100] “POST /wp-json/wp/v2/pages HTTP/1.1” 200 3154 “https://***/wp-json/wp/v2/plugins” “Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko”
212.113.119.6 – – [30/Mar/2023:16:47:06 +1100] “GET /02385bb27cb2.php HTTP/1.1” 200 27 “https://***/wp-json/wp/v2/pages” “Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko”

Used to add a plugin “evalphp” to wordpress at this exact time, which was then used to pivot for full control with the “02385…” upload script.

This was on a test site running wordpress 6.1.1, woocommerce 7.3.0, payments module 5.4.0. NO OTHER PLUGINS it was prettymuch a stock standard install, that was reasonably up to date.

As far as i’m aware the rest-api doesn’t add plugins, so i have zero idea how this was leveraged to add evalphp at the exact time the POST was sent.