itskill-jp/wordpress-upgrade-checkRead-only check of every WordPress core version on a server. Flags CVE-2026-87902 (fixed in 7.1.2 and backports), auto-updates turned off, and published attack indicators.
Read-only check of the WordPress core version of every site on a server, with the fix table for CVE-2026-87902 (critical, unauthenticated; fixed in WordPress 7.1.2 on 2026-09-22 and backported to every branch down to 4.7).
For web agencies and admins who look after many WordPress sites: run it once over the whole hosting account and get one list.
bash check.sh ~/public_html # every WordPress under the folder
bash check.sh --log ~/logs/access_log ~/public_html # also search an access log for attack requests (.gz OK)
bash check.sh --online ~/public_html # also ask api.wordpress.org: core status, and every plugin / theme vs its latest version
bash check.sh --list ~/public_html # print every plugin and theme with its version
bash check.sh --csv inventory.csv ~/public_html # write the plugin / theme inventory of all sites to a CSV
wp-config.php secrets
(only the two automatic-update constants are checked). --csv writes only the file you name.--online: then it asks api.wordpress.org (never your sites) once for the core list and once per
plugin / theme slug. Note that this tells wordpress.org which plugin slugs you are checking.find, grep, sed, awk.1 if anything is CRITICAL.| # | Check | CRITICAL / REVIEW |
|---|---|---|
| 1 | Core version against the CVE-2026-87902 fix for its branch (7.1.2, 7.0.6, 6.9.9 … 4.7.37) | CRITICAL if older than the fix |
| 2 | With --online: the version's status on wordpress.org | CRITICAL if insecure, REVIEW if outdated |
| 3 | WP_AUTO_UPDATE_CORE false / AUTOMATIC_UPDATER_DISABLED in wp-config.php | REVIEW (security releases won't install themselves) |
| 4 | A theme with a top-level page-* directory (a published precondition of the exploit) | REVIEW |
| 5 | PHP files inside wp-content/uploads | REVIEW |
| 6 | Published indicator files in /tmp and /var/tmp (poc87902.php, wp-pear-rce-flag.php, luci_*.php, zeta_*.php, marker CVE-2026-87902-POC-OK) | CRITICAL |
| 7 | With --log: pagename with ../ or %2e%2e, pagename=templates%2f, pearcmd, config-create, scanner user agents | CRITICAL if answered with 200, REVIEW if not |
| 8 | Plugins and themes: name and version from their file headers (--list, --csv) | — |
| 9 | With --online: each plugin / theme against wordpress.org | CRITICAL if closed for a security issue (no fix will ever come), REVIEW if closed for another reason or a newer version exists |
Plugins cause most real-world WordPress compromises. The CSV inventory is meant to be checked against a vulnerability database such as Wordfence Intelligence, WPScan or Patchstack. Paid or custom plugins are not on wordpress.org; the CSV marks them so you can check with their vendors.
Fixed versions (from GHSA-7hp8-65ch-5whp, checked against api.wordpress.org/core/stable-check on 2026-09-26):
| Branch | Fixed in | Branch | Fixed in | Branch | Fixed in |
|---|---|---|---|---|---|
| 7.1 | 7.1.2 | 6.3 | 6.3.12 | 5.4 | 5.4.23 |
| 7.0 | 7.0.6 | 6.2 | 6.2.13 | 5.3 | 5.3.25 |
| 6.9 | 6.9.9 | 6.1 | 6.1.14 | 5.2 | 5.2.28 |
| 6.8 | 6.8.10 | 6.0 | 6.0.16 | 5.1 | 5.1.26 |
| 6.7 | 6.7.9 | 5.9 | 5.9.18 | 5.0 | 5.0.29 |
| 6.6 | 6.6.9 | 5.8 | 5.8.17 | 4.9 | 4.9.33 |
| 6.5 | 6.5.12 | 5.7 | 5.7.19 | 4.8 | 4.8.32 |
| 6.4 | 6.4.12 | 5.6 | 5.6.21 | 4.7 | 4.7.37 |
| 5.5 | 5.5.22 |
Only the latest release (7.1.x) is actively supported; the older branches received this fix as a courtesy.
uploads and /tmp, and change passwords and keys after cleaning.pagename contains ../ or %2e%2e at your WAF.[ok] does not prove a site was never attacked.Moving to PHP 8 as well? See php8-upgrade-check.
サーバーにあるすべての WordPress の本体の版を、読み取りだけで確かめるスクリプトです。 2026-09-22 の WordPress 7.1.2 で直った重大な脆弱性 CVE-2026-87902（ログイン不要）の修正済みの版を、系列ごとに持っています。
bash check.sh ~/public_html # フォルダの下の WordPress を全部
bash check.sh --log ~/logs/access_log ~/public_html # アクセスログから攻撃の痕跡も探す（.gz も可）
bash check.sh --online ~/public_html # wordpress.org に、本体とプラグイン・テーマが最新か・危険かも問い合わせる
bash check.sh --list ~/public_html # プラグインとテーマを版つきで一覧に
bash check.sh --csv inventory.csv ~/public_html # 全サイトのプラグイン・テーマの一覧を CSV に
wp-config.php の秘密の値も表示しません--online のときだけ api.wordpress.org に問い合わせます（本体の一覧で 1 回、プラグイン・テーマごとに 1 回。あなたのサイトには接続しません）CRITICAL が出たら
pagename に ../ や %2e%2e を含む通信を WAF で止める更新を代わりに行う定額のメニューもあります（1 サイト・税別 5 万円）： WordPress・PHP の更新（IT.Skill）
MIT