WP2Shell Scanner

A read-only, non-destructive security audit tool that scans WordPress installations for the wp2shell vulnerability chain.

Overview

WP2Shell Scanner is a bash utility that recursively searches a directory tree for WordPress installations and checks whether each site is running a core version vulnerable to the wp2shell vulnerabilities (CVE-2026-63030 + CVE-2026-60137).

This tool is designed for system administrators and security teams to quickly identify WordPress instances that require urgent patching.

What It Scans

The scanner identifies WordPress installations by locating wp-includes/version.php files within the target directory and all subdirectories. For each installation found, it:

• Extracts the WordPress version number
• Checks if the version falls within a known vulnerable range
• Classifies the vulnerability type and severity
• Generates both console output and optional CSV reports

Vulnerable Versions

The tool detects three vulnerability severity levels:

Full RCE (Unauthenticated Remote Code Execution)

• WordPress 6.9.0 – 6.9.4: Contains both CVEs (SQL injection + REST API batch route confusion)
  • Fix: Upgrade to 6.9.5 or later
  • Urgency: 🔴 CRITICAL – Patch immediately
• WordPress 7.0.0 – 7.0.1: Contains both CVEs (SQL injection + REST API batch route confusion)
  • Fix: Upgrade to 7.0.2 or later
  • Urgency: 🔴 CRITICAL – Patch immediately

SQL Injection Only

• WordPress 6.8.0 – 6.8.5: SQL injection vulnerability (CVE-2026-60137) without the REST API route confusion
  • Fix: Upgrade to 6.8.6 or later
  • Urgency: 🟡 HIGH – Patch but lower priority than RCE versions
  • Note: Not exploitable via the full unauthenticated RCE chain, but still a real vulnerability

Safe

• All other versions are considered safe and do not appear to be affected

Setup

Before using the scanner, make the script executable:

chmod +x wp2shell-scanner.sh

Usage

Basic Scan

./wp2shell-scanner.sh /path/to/scan

Scans the specified directory and all subdirectories for WordPress installations, displaying results to console.

Generate CSV Report

./wp2shell-scanner.sh /path/to/scan --csv report.csv

Performs the same scan but also saves results to report.csv for further analysis or integration with other tools.

Common Examples

# Scan entire web root
./wp2shell-scanner.sh /var/www

# Scan with CSV export
./wp2shell-scanner.sh /home/users --csv wordpress-audit.csv

# Scan web server directory with sudo (if needed for permission)
sudo ./wp2shell-scanner.sh /home

Output

Console Output

The tool displays results with color-coded status indicators:

• [!] VULNERABLE - FULL RCE (Red): Full RCE chain detected – patch immediately
• [!] VULNERABLE - SQLi only (Yellow): SQL injection only – patch soon
• [OK] (Green): Version is safe
• [?] (Yellow): Version could not be determined

Example:

Scanning for WordPress installs under: /var/www
----------------------------------------------------------------------
[!] VULNERABLE - FULL RCE /var/www/site1 -> WP 6.9.3 (patch to 6.9.5 or 7.0.2 immediately)
[!] VULNERABLE - SQLi only /var/www/site2 -> WP 6.8.4 (patch to 6.8.6; no full RCE chain on this branch)
[OK] /var/www/site3 -> WP 7.1.0
[?] /var/www/site4 -> could not determine version
----------------------------------------------------------------------
Scan complete.
Sites found:          4
  Vulnerable (RCE):   1
  Vulnerable (SQLi):  1
  Safe:               1
  Unknown:            1

CSV Output

When using --csv, a file is created with the following format:

path,version,status
"/var/www/site1",6.9.3,VULNERABLE (RCE)
"/var/www/site2",6.8.4,VULNERABLE (SQLi)
"/var/www/site3",7.1.0,SAFE
"/var/www/site4",unknown,UNKNOWN

This format is suitable for importing into spreadsheets, security dashboards, or automated remediation workflows.