WP CLI

Everything the dashboard does is available from the command line. The command is wp jat-shell (the older names wp php2shell and wp wp2shell still work).

Command	What it does
wp jat-shell scan	Run a full scan now and print the findings
wp jat-shell status	Show the last result without scanning again
wp jat-shell ignore <id>…	Mark finding(s) as ignored (--undo to restore)
wp jat-shell fix <id>…	Apply the one-click fix for finding(s); --all-critical fixes every critical/high file finding; --yes skips the question
wp jat-shell quarantine list	List quarantined items and other fixes (--format=json)
wp jat-shell quarantine restore <id>	Undo a fix: restore a file/plugin, or give admin rights back
wp jat-shell quarantine delete <id>	Delete a quarantined item for good
wp jat-shell fleet hub	Make this site the fleet hub and print its key
wp jat-shell fleet join <hub-url> <key>	Report this site's results to a hub after every scan
wp jat-shell fleet send / status / leave	Report now / show fleet status / stop reporting
wp jat-shell fleet list	On the hub: every site's latest result (--format=csv or json)
wp jat-shell fleet rescan [<site>]	On the hub: ask one site, or all, to scan at their next hourly check-in
wp jat-shell fleet alerts [--email=…] [--webhook=…] [--stale-days=…]	On the hub: show or change alert settings (off turns one off)
wp jat-shell fleet test-alert	On the hub: send a test alert now
wp jat-shell fleet check-in	On a member: check in with the hub now (starts a scan if one was requested)

wp jat-shell scan options

Option	Default	Meaning
--log=<path>	The path saved in settings	Access log to check (.gz works)
--error-log=<path>	The setting, then the log PHP reports	PHP error log to check for PHP2Shell traces (.gz works)
--skip-core	off	Don't verify core and plugin files against wordpress.org
--min=<severity>	low	Hide findings below info, low, medium, high or critical
--format=<format>	table	table, json, csv, yaml or summary (one line)
--include-ignored	off	Also list findings marked as ignored

Note

WP-CLI often runs a different PHP from your website. For the PHP2Shell check, the scanner uses the website's PHP as last recorded by the dashboard (or by a scheduled scan). If it has never seen it, it checks the command-line PHP and says so.

Exit codes — handy for scripts and monitoring:

Code	Result
0	No signs, or Needs review
1	Vulnerable, or Suspicious
2	Compromised

Examples

wp jat-shell scan                                          # human-readable table
wp jat-shell scan --min=high                               # only what needs action
wp jat-shell scan --error-log=/var/log/php-fpm/www-error.log --log=/var/log/nginx/access.log
wp jat-shell scan --format=json > php2shell-report.json    # full report
wp jat-shell scan --format=summary                         # VULNERABLE  https://example.com  wp 7.1.2  php 8.3.10  critical:0 high:1 medium:0
wp jat-shell scan --format=json | jq -r '.findings[] | select(.severity=="critical") | .message'
wp jat-shell status --format=table
wp jat-shell ignore 3f9a1c2b7d10
wp jat-shell fix 3f9a1c2b7d10                              # quarantine one flagged file
wp jat-shell fix --all-critical --yes                      # quarantine everything critical/high
wp jat-shell quarantine list
wp jat-shell quarantine restore k3j9x0p2q7ab

Install with WP-CLI

wp plugin install https://github.com/CptNope/JAT-Shell-Scanner/releases/latest/download/jat-shell-scanner.zip --activate
# Multisite: add --network