wp2Shell Scanner – with PoC

CVE-2026-63030 and CVE-2026-60137 – WordPress wp2shell vulnerability-chain scanner

Authorized security-research tool with optional command-verification PoC.

wp2shell-scanner detects the WordPress wp2shell vulnerability chain by validating public WordPress evidence, fingerprinting exposed versions, checking REST batch behavior, and measuring an active timing differential. It is intended for authorized defensive research, CTF environments, and systems you own or administer.

⚠️ Legal & ethical disclaimer

This project is provided strictly for authorized security testing and defensive research.

• Use it only against systems you own, administer, or have explicit permission to assess.
• Do not scan public websites, production systems, or infrastructure you do not control.
• -p/--poc changes WordPress state before attempting best-effort cleanup.
• You are responsible for complying with all applicable laws, regulations, and agreements.

Features

Detection workflow

• Scan a single target or a deduplicated list of targets.
• Detect public WordPress HTML, header, and REST API markers.
• Fingerprint exposed WordPress versions when possible.
• Check REST batch behavior and collect structural route markers.
• Use repeated baseline and delayed timing probes for active confirmation.

Researcher-focused CLI

• Concurrent list scanning with a configurable worker count.
• Clear per-target completion progress and a final status breakdown.
• Color-coded terminal output that automatically remains plain when piped or redirected.
• JSON export with optional inclusion of every scan result.
• Quiet multiline command output and verbose PoC response diagnostics.
• Actionable input, network, and response errors.
• Optional command-verification PoC after active confirmation, using whoami by default or a researcher-supplied command.

Requirements

• Python 3.10 or later
• Dependencies listed in requirements.txt:
  • requests
  • colorama

Installation

Obtain this repository, then install the dependencies from its root directory.

1. Change to the project directory:

   root@kitploit:~

   cd wp2shell-scanner
   

2. Optional but recommended: create and activate a virtual environment:

   root@kitploit:~

   python3 -m venv .venv
   source .venv/bin/activate
   # Windows PowerShell: .venv\Scripts\Activate.ps1
   

3. Install dependencies:

   root@kitploit:~

   python3 -m pip install -r requirements.txt
   

4. Confirm the CLI is available:

   root@kitploit:~

   python3 wp2shell-scanner.py -h
   

Usage

Display help:

python3 wp2shell-scanner.py -h

Running the tool without a target displays the branded help text and exits with a usage error. Supply exactly one target source: -u/--url for one target or -l/--list for a target file.

python3 wp2shell-scanner.py -u https://wordpress.example

Targets without a scheme are treated as http:// URLs. Target-list files use one URL per line; blank lines and lines starting with # are ignored. Invalid entries are reported with their line number.

The supported entry point is the root script:

python3 wp2shell-scanner.py -u https://wordpress.example

Command-line options

Targets

Scan and PoC behavior

Output and presentation

Examples

Scan one target:

python3 wp2shell-scanner.py --url https://wordpress.example

Scan a target list with 20 workers:

python3 wp2shell-scanner.py --list targets.txt --threads 20

Run the state-changing verification PoC only after the scanner actively confirms the target:

python3 wp2shell-scanner.py -u https://wordpress.example -p

Run a researcher-supplied command and print only its normalized multiline output:

python3 wp2shell-scanner.py --url https://wordpress.example -p --command "ls -la" --quiet

Write only confirmed vulnerable results to JSON, or include every target with --all-results:

python3 wp2shell-scanner.py --list targets.txt --output results.json
python3 wp2shell-scanner.py --list targets.txt --output results.json --all-results

Result interpretation

Affected stable releases are WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Update to 6.9.5 or 7.0.2, or a later release, immediately.

Exit codes

Credits & acknowledgements

• Hidden Investigations – for publishing the wp2Shell scanner and PoC tool.
• @sakibulalikhan – tool author.

License

This project is licensed under the MIT License. See LICENSE for details.

📬 Contact us: [email protected]