WP2Shell Scanner

A command line tool that checks whether a WordPress site is exposed to WP2Shell (CVE-2026-63030 and CVE-2026-60137). It reads the WordPress version and REST API surface over read-only requests and reports a verdict. It does not exploit anything.

[!WARNING] For authorised testing only. Use it on sites you own or have written permission to check. The author (DanSec) takes no responsibility for misuse or damage.

About WP2Shell

WP2Shell chains a SQL injection (CVE-2026-60137) with a REST batch processor flaw (CVE-2026-63030) through the /wp-json/batch/v1 endpoint, giving unauthenticated remote code execution on a default WordPress install. Both CVEs are in CISA's Known Exploited catalog.

Install

Requires Python 3.8+.

pip install -r requirements.txt

requests and rich are required. sublist3r is optional (subdomain enumeration). For wider enumeration, install subfinder (a Go binary, not pip) and pass --subfinder.

Usage

# Check one host
python wpScanner.py example.com --passive

# Enumerate subdomains of a root domain and check each one
python wpScanner.py example.com --subfinder --threads 8

Results

Results are also written to CSV. When version sources disagree, the tool classifies on the lowest one to avoid a false all-clear. A remote check cannot see a backported patch that left the version string unchanged, so on hosts you control, wp core version is the ground truth.

Remediation

Update core to 6.9.5, 7.0.2, or 7.1+ (wp core update). If you cannot patch yet, block /wp-json/batch/v1 at your firewall and restrict anonymous REST access.

Disclaimer

Provided for authorised, defensive use only. You are responsible for having permission to check any host you point it at.