wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution

The wp2shell exploit chain enables pre-authenticated remote code execution on default WordPress installs via a REST API vulnerability, with public PoCs already driving widespread attacks, but defenders can reliably detect and stop exploitation by patching promptly and monitoring for telltale web server-to-shell behavior and specific file and process activity.