wp2shell-check

Non-intrusive exposure checker for the WordPress "wp2shell" pre-authentication RCE chain (CVE-2026-63030 + CVE-2026-60137).

⚠️ Authorized use only. Run this only against WordPress instances you own or have explicit permission to test. It is a triage aid, not an exploit. Scanning systems without permission may be illegal.

What it does

Given a URL, wp2shell-check:

1. Reads the WordPress version from the generator meta tag on the homepage (passive).
2. Compares it against the versions affected by the wp2shell chain.
3. Sends a single benign probe to the REST batch endpoint (?rest_route=/batch/v1) to check whether the REST batch route is reachable.
4. Prints a one-line verdict.

It is designed for fast fleet triage: which of my sites are on an affected version with REST reachable?

What it does not do

• It does not send SQL injection payloads or trigger the route-confusion bug.
• It does not confirm exploitability. The route probe only tells you the batch route is registered and validating input — which is true of virtually any default install with the REST API enabled (the batch endpoint has been in core since WordPress 5.6). The version check is the load-bearing signal.
• It is a reachability + version heuristic, not a proof-of-concept.

The vulnerability (wp2shell)

Two chained WordPress Core flaws, disclosed with an emergency release on 2026-07-17:

Chained, they let an unauthenticated attacker reach SQL injection and escalate to remote code execution on a default install — no plugins, no login. The RCE half only applies when a persistent object cache is not in use.

Fixed in: 6.8.6 (SQLi only), 6.9.5, 7.0.2 (and 7.1 Beta 2+). WordPress enabled forced auto-updates for affected sites — verify the update actually landed.

Reported by Adam Kues (Assetnote / Searchlight Cyber) via WordPress's HackerOne program.

Install

Requires Python 3.9+ and requests.

# with uv
uv pip install requests

# or plain pip
pip install requests

Usage

python wp2shell.py https://target.example

Example output:

https://target.example: VULNERABLE (RCE) [6.9.3]

Interpreting the output

Limitations

• "VULNERABLE" is an exposure signal, not a confirmation. It means affected version + REST reachable. It does not prove the route-confusion / injection is exploitable on that specific host.
• Persistent object cache. The RCE requires that no persistent object cache is in use. A site can be in the affected band yet not RCE-exploitable - and this tool cannot detect that remotely.
• Version detection is best-effort. The generator tag is often removed or spoofed; a missing version yields wordpress not detected, not a guarantee that the site is safe or non-WordPress.
• Single URL per run. No batch input, rate limiting, or output formats beyond the console line.

Remediation

1. Update to 6.8.6, 6.9.5, or 7.0.2 (or newer) for your branch, and confirm the update applied.
2. If you can't patch immediately, block /wp-json/batch/v1 and ?rest_route=/batch/v1 at your WAF, or restrict anonymous access to the REST API.

Disclaimer

Provided as-is, for authorized security testing and educational purposes only. You are solely responsible for how you use it.

References

• WordPress security release, 6.9.5 / 7.0.2 (2026-07-17)
• Cloudflare — WAF protections for the WordPress vulnerabilities
• The Hacker News — wp2shell coverage
• ZeroSec (zsec.uk) — wp2shell code-trace deep dive