WordPress Core Update/Downgrade

Alert ID: core_update MITRE ATT&CK: T1072 – Software Deployment Tools

---

Severity / Criticality

Level	Condition
Info	Normal WordPress core update
High	Version downgrade detected, highly suspicious

---

Why is it considered malicious?

• Downgrades reintroduce already patched vulnerabilities.
• Modified versions may contain backdoors or trojanized code.
• Fake updates may install altered versions for malicious purposes.
• After-hours or unauthorized changes are indicators of manipulation.

Danger

In production, downgrades are never normal practice and always require review.

---

When does the alert trigger?

• Manual update: _core_updated_successfully hook.
• Automatic update: automatic_updates_complete hook.
• Downgrade detected: through version_compare() when the new version is lower.
• Version analysis: comparison between old_version and new_version.

---

Technical Indicators (IOCs)

Type	Pattern / Example	Description
file_pattern	wp-includes/version.php	Modified file containing the core version
file_pattern	wp-admin/includes/update.php	Altered update-system hooks
behavior	Beta or RC versions in production	Use of unstable versions
behavior	Major downgrade (>2 versions)	Significant system regression

---

Common false positives

• Legitimate automatic updates.
• Planned rollbacks due to temporary incompatibility.
• Testing in development or staging environments.

Caution

In production, any detected downgrade should be investigated immediately.

---

Investigation steps

1. Verify core integrity:

   wp core verify-checksums --skip-plugins --skip-themes

2. Check the currently installed version:

   wp core version --extra

3. Analyze context: confirm whether the update or rollback was authorized and by whom.

4. If downgraded, identify the reason, review modified files, and confirm integrity.

---

Recommended mitigations

Immediate

Danger

• Urgently investigate any detected downgrade.
• Verify checksums for all core files.
• Compare the installation with a clean original version.
• Review logs and remove suspicious or modified files.

Preventive

Tip

Restrict automatic updates to minor versions:

define('WP_AUTO_UPDATE_CORE', 'minor');

• Document and control all system updates.
• Test changes in staging first.
• Create backups before every update.
• Implement continuous file-integrity monitoring.

---

References

• WordPress Update Services
• Core Checksums Verification