wp2shell IOC Scanner

Version 1.4.0 · GPL-2.0-or-later · WordPress 6.0+ · PHP 7.4+

A read-only-by-default triage tool for the WordPress core vulnerabilities CVE-2026-60137 and CVE-2026-63030 (“wp2shell”). It checks patch state, accounts, durable database artifacts and file integrity, separates findings by confidence, and exports bounded evidence for external investigation.

The default indicators wp2_*, w2s_*, @wp2shell.invalid, and @wp2shell.shellcode.lol are documented by the public Eye Security Defenders Guide. Unverified account, plugin, or metadata names are no longer preconfigured. Fixed WordPress releases are documented in the official WordPress security release.

What version 1.4 checks

• WordPress patch status for 6.8.6, 6.9.5, 7.0.2, and 7.1 beta2 or later.
• Configurable login, email, user-meta, and plugin indicators.
• Recently created or non-allow-listed administrators.
• Accounts present in the raw user table but hidden from the normal WordPress query; this comparison is capped at 5,000 users and deliberately disabled on Multisite.
• oembed_cache loopbacks, suspicious customize_changeset/object-graph rows, orphaned user metadata, and plausible user-ID gaps.
• Raw home/siteurl values, missing active plugin files, and suspicious cron hook names.
• Official WordPress core checksums and unexpected PHP files in wp-admin or wp-includes.
• PHP-like files under uploads, public wp2shell_* plugin paths, and recently changed standard, network, MU, drop-in, plugin, and theme files.

Work is bounded: users are processed in batches with administrators prioritised, filesystem walks and export rows are capped, and results are cached for an hour. WP-Cron refreshes the cache; unrelated admin requests do not trigger an unannounced full scan.

Results and evidence

Findings are split into critical, high, medium, and low. A normal plugin or theme update remains a heuristic and is not presented like a hidden administrator. “No tested indicators matched” is explicitly not a guarantee of safety.

The audit screen provides a full JSON evidence export, a CSV check export, paginated user tables, and a checklist of external web-server, WAF, PHP, process, network, and cron evidence to preserve. Password hashes, session tokens, and application passwords are not exported.

Controlled Cleanup

Cleanup is disabled by default. Export evidence and independently verify the target first, then temporarily enable it in wp-config.php:

define( 'WP2S_IOC_ENABLE_CLEANUP', true );

Deletion then requires both delete_users and target-specific delete_user, a valid nonce, the exact text DELETE, self/last-admin guards, a current hidden-ID match when applicable, and an additional acknowledgement when content reassignment is disabled. Multisite deletion is fully blocked. Remove the constant again after remediation.

The local activity history is not tamper-evident. Integrations can forward the wp2s_ioc_user_deleted event to a remote logger or SIEM.

Important limits

• The plugin runs inside WordPress; compromised code can falsify queries, files, or output.
• It cannot read hosting, WAF, operating-system, or historical network logs.
• Timestamps can be forged and artifacts can be removed.
• It does not remove webshells, backdoors, malware, or persistence outside one explicitly selected user.
• Installing a plugin changes the filesystem. Reliable forensics requires offline copies, external logs, and professional incident response.

Development

composer install
composer test

Tests cover PHP syntax, version/IOC regression cases, destructive guards, WordPress Coding Standards, and PHP 7.4+ compatibility. GitHub Actions repeats the checks.

Provided without warranty. A match is not proof by itself; no match is not an all-clear.