How to Actually Protect Yourself From wp2shell (Not Just "Update WordPress")

Everyone's telling you the same thing right now: update WordPress. Which is, fine, yes, obviously but that's not enough. Patching closes the hole. What is someone is already In your system? So let's actually walk through this properly what to do right now, what to do if you can't patch immediately, and what to do if you think you were already hit. Need more context? I wrote a summarising one here. wp2shell: The Bug That Turned an Empty WordPress Install Into a Shell Aditya Pidurkar Aditya Pidurkar Aditya Pidurkar Follow Jul 22 wp2shell: The Bug That Turned an Empty WordPress Install Into a Shell # wordpress # wp2shell # cybersecurity # cve Add Comment 4 min read S1: Stop assuming you're patched. Go check. WordPress flipped on forced automatic background updates for this one because of how serious it is. That's great, except "forced" doesn't mean "guaranteed", VERIFY IT. Go look at your actual running version right now: In the dashboard: wp-admin > Updates Via WP-CLI, if you have shell access: wp core version You want to see 7.0.2 if you're on the 7.0 line, or 6.9.5 if you're on 6.9. If you see anything else — 6.9.0 through 6.9.4, or 7.0.0/7.0.1 — you're still exposed. Update it now!! Come back when done. A few situations where the forced update quietly doesn't happen, in what I read on internet: Managed hosting environments where the host controls the update pipeline and hasn't pushed it yet Sites with a "disable auto-updates" plugin installed months ago for stability reasons and never revisited wp-config.php with WP_AUTO_UPDATE_CORE explicitly set to false Staging or dev environments nobody thinks of as "production" but that are still internet-facing If any of that describes you, don't wait on the automation. Update manually. S2: If you genuinely can't update right now, here's your stopgap aybe you're facing a compatibility issue, a change freeze, or a custom plugin that isn't ready yet. It happens. If you need a little more time before applying the real fix, here'