WP2Shell Scanner

A command line tool that checks whether a WordPress site is exposed to WP2Shell (CVE-2026-63030 and CVE-2026-60137). It reads the WordPress version and REST API surface over read-only requests and reports a verdict. It does not exploit anything.

Warning

For authorised testing only. Use it on sites you own or have written permission to check. The author (DanSec) takes no responsibility for misuse or damage.

About WP2Shell

WP2Shell chains a SQL injection (CVE-2026-60137) with a REST batch processor flaw (CVE-2026-63030) through the /wp-json/batch/v1 endpoint, giving unauthenticated remote code execution on a default WordPress install. Both CVEs are in CISA's Known Exploited catalog.

Branch	Vulnerable	Fixed in
6.9.x	6.9.0 through 6.9.4	6.9.5
7.0.x	7.0.0 through 7.0.1	7.0.2
7.1 and later	not affected	n/a

Install

Requires Python 3.8+.

pip install -r requirements.txt

requests and rich are required. sublist3r is optional (subdomain enumeration). For wider enumeration, install subfinder (a Go binary, not pip) and pass --subfinder.

Usage

# Check one host
python wpScanner.py example.com --passive

# Enumerate subdomains of a root domain and check each one
python wpScanner.py example.com --subfinder --threads 8

Option	Description	Default
-o, --output	CSV output file	WP2Shell_output.csv
--passive	Check only the given host, skip enumeration	off
--subfinder	Add subfinder as a subdomain source	off
--threads	Concurrent workers	1
--retries	Retries per host	1
--rate-limit	Max requests/sec (single-thread, 0 = no limit)	0

Results

Verdict	Meaning
VULNERABLE	Affected version and the batch endpoint is reachable.
LIKELY_MITIGATED	Affected version, but the batch endpoint looks blocked or REST is disabled.
PATCHED	Fixed version, or predates the affected releases.
VERSION_UNKNOWN	WordPress found, version could not be read.
NOT_WORDPRESS	No WordPress fingerprint.
ERROR	Unreachable or network error.

Results are also written to CSV. When version sources disagree, the tool classifies on the lowest one to avoid a false all-clear. A remote check cannot see a backported patch that left the version string unchanged, so on hosts you control, wp core version is the ground truth.

Remediation

Update core to 6.9.5, 7.0.2, or 7.1+ (wp core update). If you cannot patch yet, block /wp-json/batch/v1 at your firewall and restrict anonymous REST access.

Disclaimer

Provided for authorised, defensive use only. You are responsible for having permission to check any host you point it at.