How to Actually Protect Yourself From wp2shell (Not Just "Update WordPress")

Short summary

This is a practical incident-response guide for the wp2shell WordPress vulnerability (CVE disclosed July 17), going beyond 'just update' to cover verification, temporary workarounds for unpatchable sites, and post-compromise forensics. It details how to block the vulnerable REST endpoint at the WAF level, and lists specific checks for detecting persistence: rogue admin accounts, modified theme/plugin files, unfamiliar cron jobs, and suspicious POST requests in access logs. The author stresses that forced auto-updates don't guarantee patching and urges manual verification.

• •Verify your WordPress version is 7.0.2 or 6.9.5 — forced auto-updates can silently fail in managed hosting or disabled-update configs
• •Temporary workaround: block anonymous access to /wp-json/batch/v1 at your WAF or reverse proxy if you can't patch immediately
• •Post-patch forensics: check for rogue admin accounts, unexpected file modifications in wp-content, unfamiliar wp_cron tasks, and anonymous POST requests in access logs

Generated with AI, which can make mistakes.