# Core Vulnerability Protection

> GuardPress Core Vulnerability Protection blocks known WordPress core exploit patterns on affected versions, a safety net for sites that cannot update at once.

- Canonical: <https://royalplugins.com/support/guardpress/core-vuln-protection/>
- Last updated: 2026-07-30
- HTML version: <https://royalplugins.com/support/guardpress/core-vuln-protection/>

---

GuardPress blocks known WordPress core exploit patterns on affected core versions. **Update WordPress to the latest release first** — GuardPress protection is a safety net for sites that cannot immediately update, not a substitute for updating.

### Primary action — update WordPress core

From **WP Admin → Dashboard → Updates**, install the latest WordPress version. Updating core is always the right first step; GuardPress firewall rules are a fallback for sites that cannot update immediately.

## What This Feature Does

Some WordPress core vulnerabilities can be exploited through recognisable request patterns — specific URLs, specific parameter shapes, specific body structures. GuardPress inspects incoming requests for known attack patterns tied to publicly disclosed core CVEs and blocks the ones that match on sites running affected core versions.

The feature is on by default and requires no configuration. When your WordPress install is on a patched core version, the rules are inert — there is nothing to block, so the code short-circuits with no measurable overhead.

This is not a replacement for updating WordPress

Firewall pattern-matching catches known attack shapes. It cannot catch a novel variant of the same vulnerability. Updating WordPress core is always the correct fix; GuardPress is the safety net during the gap between disclosure and your next update window.

## Recommended Steps

#### Update WordPress core

From **WP Admin → Dashboard → Updates**, install the latest available WordPress version. This is the primary fix for any core vulnerability.

#### Update GuardPress

From **WP Admin → Plugins**, make sure GuardPress is on the current version. GuardPress rule sets ship inside the plugin release — keeping GuardPress current keeps the mitigation set current.

#### Leave the firewall enabled

Core-vulnerability rules live in the existing GuardPress firewall. If GuardPress → Firewall is enabled (default), the rules are active. No separate toggle exists for this feature and no configuration is required.

#### Confirm WordPress version in Site Health

Once on the latest WordPress, the rules become inert on your install — nothing to match, no overhead. On patched core, the mitigation is effectively invisible.

## If You Receive a Critical Admin-Creation Alert

In the rare case an unauthenticated request successfully creates an administrator account through a core vulnerability, GuardPress:

- Downgrades the newly-created account to Subscriber (reversible, not deleted)
- Blocks the response so the attacker does not receive confirmation
- Emails your configured alert address with a one-click restore link
- Records the event in **GuardPress → Audit Log**

The restore link is valid for 5 minutes and is single-use

If the account creation was legitimate (unusual for the endpoints this rule watches), click **Restore to Administrator** in the email within 5 minutes. If it was not legitimate, no action is needed — the account is safe as a Subscriber and can be reviewed or deleted from **WP Admin → Users**.

After receiving this alert:

1. Update WordPress core immediately if you have not already
2. Review recent activity in **GuardPress → Audit Log**
3. Consider running **GuardPress → Malware Scanner** to check for any files left behind by earlier probe attempts
4. If you use SiteVault, verify a recent clean backup exists

## Advanced: Developer Escape Hatches

The rules are intentionally shape-based and universal — there is no per-rule toggle in the admin UI. If a legitimate integration on your site triggers a false positive (very unusual for the specific patterns these rules target), the following WordPress filters allow developers to exempt specific requests:

```
// Exempt this request from author-parameter SQL keyword blocking.
add_filter( 'guardpress_wp2shell_detection_b_bypass', function( $bypass, $key, $value ) {
    // Return true only for the specific known-safe case.
    return $bypass;
}, 10, 3 );

// Exempt this request from nested-privileged-write blocking.
add_filter( 'guardpress_wp2shell_detection_c_bypass', function( $bypass, $body ) {
    return $bypass;
}, 10, 2 );
```

Add the snippet to a **must-use plugin** (`wp-content/mu-plugins/`) so it applies before the firewall boots. Do not gate around the whole rule set — scope the exemption tightly to the specific request pattern you intend to allow.

There is no bypass for the anonymous admin-creation rule

An anonymous request creating an administrator account through the batch endpoint has no legitimate use case in normal WordPress operation. If a genuinely legitimate action trips this rule, use the restore link in the alert email — that is the correct recovery path.

## Contact Priority Support

If a legitimate request is being blocked by these rules and the developer filter above is not a good fit, email **[support@royalplugins.com](mailto:support@royalplugins.com)**. Priority email support is included with your GuardPress Pro license — typical response time is within 24 hours.

#### Information to include in your email

- **WordPress version** from **WP Admin → Updates**
- **GuardPress version** from **WP Admin → Plugins**
- **The audit log entry** from **GuardPress → Audit Log** for the blocked request (search for `wp2shell`)
- **What legitimate integration is generating the request** — page builder, headless client, custom REST integration, etc.

Related GuardPress topics

- [**Firewall False Positives**](https://royalplugins.com/blog/wordpress-firewall-false-positives/) — how to identify and resolve legitimate requests being blocked.
- [**Emergency Lockdown Recovery**](https://royalplugins.com/support/guardpress/emergency-lockdown-recovery/) — if a rule locks out a legitimate action and you need immediate access.
- [**IP Blocking & Whitelisting**](https://royalplugins.com/support/guardpress/ip-blocking-whitelisting/) — how to exempt trusted IPs from all firewall rules.

[Back to GuardPress Support](https://royalplugins.com/support/guardpress/)
[GuardPress Plugin Page](https://royalplugins.com/guardpress/)