wp2shell IOC Scanner 1.4.0

Highlights

• Adds WordPress patch-state classification for the documented wp2shell vulnerability ranges.
• Adds bounded forensic checks for account, database, cron, plugin, theme, upload, and WordPress core artifacts.
• Adds JSON evidence and CSV check exports without password hashes, session tokens, or application-password data.
• Prioritises administrator scanning and retains the raw-vs-visible shadow-admin comparison with explicit safety limits.
• Separates critical, high, medium, and low-confidence findings to make legitimate file changes easier to distinguish from strong compromise indicators.
• Adds cached scheduled scans, per-administrator acknowledgement, pagination, Multisite safety handling, and explicit scan limits.
• Adds German and English documentation and translation updates.
• Adds automated syntax, regression, WordPress Coding Standards, PHP 7.4+ compatibility, and GitHub Actions checks.

Important cleanup change

Controlled account deletion is now disabled by default. Export evidence and independently verify a target before temporarily adding this to wp-config.php:

define( 'WP2S_IOC_ENABLE_CLEANUP', true );

Remove the constant again after remediation. Cleanup remains blocked on Multisite and does not remove malware, backdoors, or modified core files.

Verification

The release commit passed 24 regression tests and the GitHub Actions matrix on PHP 7.4, 8.1, 8.3, and 8.5.