wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution

Searchlight Cyber disclosed "wp2shell", a pre-auth remote code execution chain in WordPress Core with public PoCs appearing rapidly; the report walks a lab run of the Icex0 PoC, shows live telemetry of exploitation (web server spawning shells, plugin directories created, access-log markers), maps detection rules that fire (file-creation and web-server-to-shell behavioral rules), and provides network/host IOCs and mitigation guidance (patch to 7.0.2 or 6.9.5 and block REST batch endpoints if immediate patching is not possible).