WP2Shell Scanner

A command line tool that checks whether a WordPress site is exposed to WP2Shell (CVE-2026-63030 and CVE-2026-60137). It reads the WordPress version and REST API surface over read-only requests and reports a verdict. It does not exploit anything.

[!WARNING] For authorised testing only. Use it on sites you own or have written permission to check. The author (DanSec) takes no responsibility for misuse or damage.

About WP2Shell

WP2Shell chains a SQL injection (CVE-2026-60137) with a REST batch processor flaw (CVE-2026-63030) through the /wp-json/batch/v1 endpoint, giving unauthenticated remote code execution on a default WordPress install. Both CVEs are in CISA's Known Exploited catalog.

Branch	Vulnerable	Fixed in
6.9.x	6.9.0 through 6.9.4	6.9.5
7.0.x	7.0.0 through 7.0.1	7.0.2
7.1 and later	not affected	n/a

Install

Requires Python 3.8+.

pip install -r requirements.txt

requests and rich are required. sublist3r is optional (subdomain enumeration). For wider enumeration, install subfinder (a Go binary, not pip) and pass --subfinder.

Usage

# Check one host
python wpScanner.py example.com --passive

# Enumerate subdomains of a root domain and check each one
python wpScanner.py example.com --subfinder --threads 8

Option	Description	Default
-o, --output	CSV output file	WP2Shell_output.csv
--passive	Check only the given host, skip enumeration	off
--subfinder	Add subfinder as a subdomain source	off
--threads	Concurrent workers	1
--retries	Retries per host	1
--rate-limit	Max requests/sec (single-thread, 0 = no limit)	0

Results

Verdict	Meaning
VULNERABLE	Affected version and the batch endpoint is reachable.
LIKELY_MITIGATED	Affected version, but the batch endpoint looks blocked or REST is disabled.
PATCHED	Fixed version, or predates the affected releases.
VERSION_UNKNOWN	WordPress found, version could not be read.
NOT_WORDPRESS	No WordPress fingerprint.
ERROR	Unreachable or network error.

Results are also written to CSV. When version sources disagree, the tool classifies on the lowest one to avoid a false all-clear. A remote check cannot see a backported patch that left the version string unchanged, so on hosts you control, wp core version is the ground truth.

Remediation

Update core to 6.9.5, 7.0.2, or 7.1+ (wp core update). If you cannot patch yet, block /wp-json/batch/v1 at your firewall and restrict anonymous REST access.

Disclaimer

Provided for authorised, defensive use only. You are responsible for having permission to check any host you point it at.