Core Vulnerability Protection

GuardPress blocks known WordPress core exploit patterns on affected core versions. Update WordPress to the latest release first — GuardPress protection is a safety net for sites that cannot immediately update, not a substitute for updating.

What This Feature Does

Some WordPress core vulnerabilities can be exploited through recognisable request patterns — specific URLs, specific parameter shapes, specific body structures. GuardPress inspects incoming requests for known attack patterns tied to publicly disclosed core CVEs and blocks the ones that match on sites running affected core versions.

The feature is on by default and requires no configuration. When your WordPress install is on a patched core version, the rules are inert — there is nothing to block, so the code short-circuits with no measurable overhead.

This is not a replacement for updating WordPress

Firewall pattern-matching catches known attack shapes. It cannot catch a novel variant of the same vulnerability. Updating WordPress core is always the correct fix; GuardPress is the safety net during the gap between disclosure and your next update window.

Recommended Steps

Update WordPress core

From WP Admin → Dashboard → Updates, install the latest available WordPress version. This is the primary fix for any core vulnerability.

Update GuardPress

From WP Admin → Plugins, make sure GuardPress is on the current version. GuardPress rule sets ship inside the plugin release — keeping GuardPress current keeps the mitigation set current.

Leave the firewall enabled

Core-vulnerability rules live in the existing GuardPress firewall. If GuardPress → Firewall is enabled (default), the rules are active. No separate toggle exists for this feature and no configuration is required.

Confirm WordPress version in Site Health

Once on the latest WordPress, the rules become inert on your install — nothing to match, no overhead. On patched core, the mitigation is effectively invisible.

If You Receive a Critical Admin-Creation Alert

In the rare case an unauthenticated request successfully creates an administrator account through a core vulnerability, GuardPress:

Downgrades the newly-created account to Subscriber (reversible, not deleted)
Blocks the response so the attacker does not receive confirmation
Emails your configured alert address with a one-click restore link
Records the event in GuardPress → Audit Log

The restore link is valid for 5 minutes and is single-use

If the account creation was legitimate (unusual for the endpoints this rule watches), click Restore to Administrator in the email within 5 minutes. If it was not legitimate, no action is needed — the account is safe as a Subscriber and can be reviewed or deleted from WP Admin → Users.

After receiving this alert:

Update WordPress core immediately if you have not already
Review recent activity in GuardPress → Audit Log
Consider running GuardPress → Malware Scanner to check for any files left behind by earlier probe attempts
If you use SiteVault, verify a recent clean backup exists

Advanced: Developer Escape Hatches

The rules are intentionally shape-based and universal — there is no per-rule toggle in the admin UI. If a legitimate integration on your site triggers a false positive (very unusual for the specific patterns these rules target), the following WordPress filters allow developers to exempt specific requests:

// Exempt this request from author-parameter SQL keyword blocking.
add_filter( 'guardpress_wp2shell_detection_b_bypass', function( $bypass, $key, $value ) {
    // Return true only for the specific known-safe case.
    return $bypass;
}, 10, 3 );

// Exempt this request from nested-privileged-write blocking.
add_filter( 'guardpress_wp2shell_detection_c_bypass', function( $bypass, $body ) {
    return $bypass;
}, 10, 2 );

Add the snippet to a must-use plugin (wp-content/mu-plugins/) so it applies before the firewall boots. Do not gate around the whole rule set — scope the exemption tightly to the specific request pattern you intend to allow.

There is no bypass for the anonymous admin-creation rule

An anonymous request creating an administrator account through the batch endpoint has no legitimate use case in normal WordPress operation. If a genuinely legitimate action trips this rule, use the restore link in the alert email — that is the correct recovery path.

Contact Priority Support

If a legitimate request is being blocked by these rules and the developer filter above is not a good fit, email support@royalplugins.com. Priority email support is included with your GuardPress Pro license — typical response time is within 24 hours.

Information to include in your email

WordPress version from WP Admin → Updates
GuardPress version from WP Admin → Plugins
The audit log entry from GuardPress → Audit Log for the blocked request (search for wp2shell)
What legitimate integration is generating the request — page builder, headless client, custom REST integration, etc.