WordPress 7.1 Beta 2 Integrates Emergency Security Patches for wp2shell

According to The Hacker News, the flaw enables unauthenticated attackers to execute arbitrary code on unpatched installs. Per CyberSecurityNews, the patch was released as an emergency update reaching "millions of WordPress sites," with Beta 2 confirming the fix lands on the 7.1 release line.

The wp2shell profile

Per CyberSecurityNews, wp2shell is classified as a critical unauthenticated RCE; an emergency patch was shipped to the stable channel. The Hacker News corroborates the unauthenticated attack vector. cyberkendra.com labels the flaw as a critical core issue letting "anyone run code." The exact code surface — specific function, endpoint, or sanitization gap — is not present in the snippets available to us. Do not propagate third-party specifics until the official Trac changeset is reviewed. Treat any pre-patch install as remotely exploitable from the public internet until proven otherwise.

What Beta 2 changes

WordPress News states Beta 2 backports the wp2shell fix into the 7.1 line. Operational implications:

• Stable installs already received the patch through the prior emergency release. Confirm via wp core version against the latest point release on your branch.
• Trunk and pre-release testers must revalidate staging environments against Beta 2 before merging.
• Plugin and theme authors should diff against the patched core APIs, particularly any custom handling around REST endpoints, admin-ajax handlers, or sanitization layers near the affected subsystem.

Operator diagnostic workflow

Run before staging Beta 2:

1. Verify core version. wp core version. Expected baseline: latest stable on your branch with the wp2shell backport applied.

2. List active plugins and themes. wp plugin list --status=active --format=table and wp theme list --status=active. Cross-check each against the WordPress.org 7.1 Beta 2 compatibility log.

3. Inspect the PHP error log. tail -n 500 /var/log/php_errors.log | grep -iE "fatal|warning|deprecated". Expect zero new entries referencing the patched subsystem after the upgrade.

4. Audit unauthenticated endpoints. Disable xmlrpc.php unless explicitly required; review REST namespace exposure under Settings → Permalinks and via the rest_authentication_errors filter.

5. Pull WAF and access logs. Filter for repeated POSTs to /xmlrpc.php and /wp-login.php from single ASNs — typical wp2shell probe signatures. Count probes pre- and post-patch.

6. Snapshot autoload size. wp db query "SELECT SUM(LENGTH(option_value)) FROM wp_options WHERE autoload='yes'". Record the value; compare post-upgrade for drift.

7. Capture TTFB on the home page and a representative product or post page. Use a synthetic check from a single region; record baseline values.

Post-upgrade baseline to confirm:

• PHP error log: zero fatal entries referencing wp2shell or the patched subsystem.
• WAF: no further probe pattern matches after the patch is live.
• TTFB: within ±10% of pre-patch baseline.
• Autoload size: unchanged or smaller.
• Core integrity: wp core verify-checksums returns clean.

What we still need: the official Trac changeset diff for the wp2shell fix, the CVE assignment with CVSS score, and managed host advisories confirming fleet-wide backport propagation across shared environments.