WordPress Core Update/Downgrade

Alert ID: core_update MITRE ATT&CK: T1072 – Software Deployment Tools

---

Severity / Criticality

Level	Condition
Info	Normal WordPress core update
High	Version downgrade detected, highly suspicious

---

Why is it considered malicious?

• Downgrades reintroduce already patched vulnerabilities.
• Modified versions may contain backdoors or trojanized code.
• Fake updates may install altered versions for malicious purposes.
• After-hours or unauthorized changes are indicators of manipulation.

!!! danger "" In production, downgrades are never normal practice and always require review.

---

When does the alert trigger?

• Manual update: _core_updated_successfully hook.
• Automatic update: automatic_updates_complete hook.
• Downgrade detected: through version_compare() when the new version is lower.
• Version analysis: comparison between old_version and new_version.

---

Technical Indicators (IOCs)

Type	Pattern / Example	Description
file_pattern	wp-includes/version.php	Modified file containing the core version
file_pattern	wp-admin/includes/update.php	Altered update-system hooks
behavior	Beta or RC versions in production	Use of unstable versions
behavior	Major downgrade (>2 versions)	Significant system regression

---

Common false positives

• Legitimate automatic updates.
• Planned rollbacks due to temporary incompatibility.
• Testing in development or staging environments.

!!! warning "" In production, any detected downgrade should be investigated immediately.

---

Investigation steps

1. Verify core integrity:

   wp core verify-checksums --skip-plugins --skip-themes

2. Check the currently installed version:

   wp core version --extra

3. Analyze context: confirm whether the update or rollback was authorized and by whom.

4. If downgraded, identify the reason, review modified files, and confirm integrity.

---

Recommended mitigations

=== “Immediate”

!!! danger ""
    - Urgently investigate any detected downgrade.
    - Verify checksums for all core files.
    - Compare the installation with a clean original version.
    - Review logs and remove suspicious or modified files.

=== “Preventive”

!!! tip ""
    Restrict automatic updates to minor versions:

    ```php
    define('WP_AUTO_UPDATE_CORE', 'minor');
    ```

    - Document and control all system updates.
    - Test changes in staging first.
    - Create backups before every update.
    - Implement continuous file-integrity monitoring.

---

References

• WordPress Update Services
• Core Checksums Verification