[CptNope]

Merging this releases 1.7.0. The version is bumped, so once CI passes on main the release workflow publishes the GitHub release and deploys to WordPress.org SVN.

Fewer false alarms

Clean sites were getting "Suspicious" or "Compromised" verdicts. The causes were files that newly installed plugins and hosts create, and two signatures that matched ordinary code.

Before	Now
PHP in uploads/<plugin>/ or cache/<plugin>/: high when recent	named after the installed plugin or theme (exact folder-name match only). Older files are low; recent or request-handling files are medium, so an attacker naming a folder after a plugin still gets a "needs review". Code signatures still apply. Generic names (cache, files, backups…) are never claimed by a plugin.
Each PHP file of an update left half-unpacked in wp-content/upgrade/: high	one medium finding per folder, only for WordPress's real layout (wordpress-<ver>/wordpress/…, <slug>[.<ver>]/<slug>/…)
Must-use files from ManageWP, Health Check, WP Staging and others: medium	low for known names, or for files that do nothing but require an installed plugin. Files that also log people in or read requests stay medium.
Drop-ins from caches not on the list: medium	recognised by name (Jetpack Boost, Super Page Cache, FlyingPress…), or a low note when they load an installed plugin
All In One WP Security's aios-bootstrap.php firewall: high "backdoor"	Wordfence, AIOS and MalCare firewalls are trusted only at the site root while their plugin is installed. Previously any path containing wordfence-waf.php, malcare or imunify was trusted.
auto_prepend_file into host vendor folders (/usr/local/<x>/, /opt/<x>/, /usr/share/<x>/, /var/imunify360/) or an installed plugin's folder: high	low. Session files, temp folders, .. paths and site data folders stay high.
public function exec( $request ): critical	not matched; only real calls are
file_put_contents() with $_POST (custom CSS, imports): high	medium. Still high when the file name comes from the request, a PHP file is written, or decoded input is written.
aios-bootstrap.php, malcare-waf.php in the site root; GoDaddy's gd-config.php: "unknown file"	known files, but only while their plugin (or GoDaddy's must-use plugin) is installed

CI: the false-alarm job now also scans the shipped zips of about 55 of the most-installed wordpress.org plugins (security, backup, cache, snippets, SEO, forms, management) and 7 themes.

Independent adversarial review. A separate review found ways to hide a webshell behind the first draft:

• an attacker-chosen folder name like uploads/users/ counted as User Switching's folder
• upgrade/wordpress-1/ counted as a core update
• /var/lib/php/sessions counted as a host-only folder
• an aios-bootstrap.php anywhere was trusted
• a mention of a plugin in a comment could make a login backdoor look like a loader

All are fixed and have regression tests.

New indicators (sources checked)

• PHP2Shell (0x4D31 honeypot captures, Oct 22–24; Defused and Prophet Security):
  • log markers: PHP2SHELL_CORE_…, …CHAIN_OK, …CHECK, the p2s_v2 "alive" probe, shellflow_canary, recon0xdeadbeef, p2s-rider, fixed session IDs and boundaries, /pwn-<ip>
  • shell_<8 hex>.php webshell names
  • response markers in code
  • session files
  • 26 addresses (medium, "investigate")
• wp2shell persistence (Dosdediez incident report):
  • fake plugin folders advanced-cache-handler-<hex>, database-repair-assistant-<hex>, wp2shell-<hex>
  • w2s_ / wpsvc_ admin accounts
  • the _site_transient_health_<hex> option
  • WP_Core_Integrity and wp_compat_<hex> markers
  • class-wp-cache-<hex>.php
• WordPress's Oct 28 security release (7.1.4, 7.0.8, 6.9.11…): a medium reminder for sites below it. It covers the update race-condition RCE. Only wp2shell versions read as "Vulnerable".

Checks

• Integration: 208/208 on the GitHub edition. 207/208 on the WordPress.org build; the miss is the expected self-checksum check, since WordPress.org has no checksums for 1.7.0 yet. 27 new checks are in section 17b, including the reviewer's attack cases.
• Code signatures over 14,337 PHP files from 34 popular plugin repos: no high/critical matches in shipped code. The only 2 are W3 Total Cache's test fixtures, which aren't in its release zip.
• Plugin Check: no errors. Reviewer ruleset: clean.
• Nonce audit with annotations off: every handler checks its nonce and capability. The only reads without one are display-only (tab, done, err), now all annotated.

https://claude.ai/code/session_011ejUFSkKi2KuJi647biNmu

---

Generated by Claude Code