A skilled person who already knows WordPress can try a REST batch trick, create an admin, then plant a plugin. Bitdefender MDR and InMotion Hosting documented this 2026 wp2shell chain (CVE-2026-63030 and CVE-2026-60137). Bedrock interrupts that known chain, hunts hidden persistence, and binds stolen admin sessions. It cannot guarantee a fresh 0-day. It is not bulletproof.

On the site: anonymous POSTs to /wp-json/batch/v1 and rest_route=/batch/v1 are dropped when they use triple-slash desync or nested users/posts chains. Unexpected new admins raise a critical Watch alert. Skilled mode can downgrade that user to subscriber and sign sessions out. Administrator sessions can bind to the login IP. A VPN can look like a hop.

The scanner looks for hidden must-use plugins, site-health option mimics, wp-config loader signals, planted plugin folders, disguised PHP in uploads, WordPress cron reinfectors, and unexpected application passwords. Host crontab is outside plugin reach. Ask the host to check account cron if a backdoor returns.

WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1 are the public ranges named for this class of chain. Update WordPress. Bedrock does not patch core.

If Cloudflare is connected, Hub Cloud pushes a block on triple-slash batch posts and a challenge on anonymous batch posts. Login rate limit at Cloudflare still needs a paid plan. The plugin still blocks on the host.

You never change DNS. Read the short note or Ask for a $199 cleanup.