Batch route confusion is a request-routing error in which grouped API calls are dispatched to, or handled by, the wrong endpoint or handler. Batch APIs let clients send multiple operations in one request; the server must still apply the correct route, method, permissions, and input checks to each operation.
In security, misrouting can expose code paths or weaken controls that were intended for other requests. Attackers may try to exploit that confusion to reach sensitive functionality or combine it with another flaw, such as SQL injection. Defenders should validate each batched operation independently, enforce authorization after routing, reject ambiguous route formats, and monitor unusual batch traffic. In the WordPress context described, this term refers to a reported REST API logic issue considered alongside a separate injection flaw; the term alone does not establish that a site was compromised.