Version 1.6.0

On-site security scanning + wp2shell protection

wp2shell (CVE-2026-63030 / CVE-2026-60137)

WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 have a core flaw that is being mass-exploited to create rogue administrators and upload malicious plugins. On affected versions this release:

• Blocks anonymous requests to the REST batch endpoint (/wp-json/batch/v1) until WordPress is updated. Logged-in editors are unaffected. Opt out with add_filter('errorvault_wp2shell_virtual_patch', '__return_false');
• Shows an admin notice urging an immediate core update.

This is a stop-gap. Update WordPress (6.9.5 / 7.0.2 or later).

Added

• Security scan, reported to your ErrorVault dashboard. It runs every 24 hours, or on demand from the portal or Settings → ErrorVault → Run Security Scan Now. It checks:
  • Core files against official WordPress.org checksums, including unknown PHP in wp-admin, wp-includes and the site root
  • Administrator accounts, read directly from the database so hidden admins are caught, with last login time and IP
  • Plugins against WordPress.org plugin checksums, for modified or extra files, plus PHP folders in wp-content/plugins that aren't real plugins
  • Webshell and backdoor signatures, known wp2shell malware hashes and fun-<hex> / fun-proof-<hex> folders
  • PHP files and PHP-enabling .htaccess in uploads, auto_prepend_file persistence, tampered wp-config.php, open registration as an admin role, and disabled core auto-updates

Installation

Update via the WordPress admin "Plugins → Updates" screen, or download errorvault-wordpress.zip below and upload manually.