wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution

wp2shell is a pre-authentication remote code execution chain against WordPress Core's batch REST endpoint (affecting 6.9.0–6.9.4 and 7.0.0–7.0.1) that has public PoCs and observed scanning/exploitation in the wild; attackers can upload plugin-backed webshells or write PHP to disk (e.g., INTO OUTFILE), then spawn shells via the web server. The report provides a defender-focused lab walkthrough mapping the attack stages to Elastic Defend rules, lists network and host IOCs (batch POST requests, wp2shell_<hex> plugin directories, temp-write-test-* probes, User-Agent markers), and recommends immediate patching to 7.0.2 or 6.9.5, blocking anonymous batch REST access as a temporary mitigation, and relying on behavioral detections for durable coverage.