Compromise Scanner for wp2shell

Compromise Scanner for wp2shell is a read-only forensic scanner for the WordPress core exploit chain publicly tracked as CVE-2026-63030 (REST batch route confusion) and CVE-2026-60137 (author__not_in SQL injection), widely referred to as wp2shell.

It inspects the database and the plugin directory for artifacts the exploit leaves behind — even when the attacker cleaned up afterwards — and presents a scored verdict on its own admin screen. It does not change anything on your site, and it does not fix the vulnerability. To close the hole, update WordPress core.

What it checks (each weighted by severity):

• oembed_cache entries that loop back to your own site, that number exactly three, or that were created around the disclosure date (the exploit uses oembed rendering as a write primitive).
• Object-graph artifacts: posts with implausibly high parent IDs, known proof-of-concept titles/slugs, and customize_changeset entries created since disclosure.
• Account artifacts: the wp2_ login prefix and @wp2shell.invalid email used by public exploit code, and non-founder administrator accounts created since disclosure.
• Deleted-admin traces: orphaned user metadata and gaps in the user-ID sequence (create-then-delete).
• Webshell plugin files or directories matching wp2shell_*.

How it reads: the weighted score maps to No indicators (under 25), Some indicators (25–49), or Multiple indicators (50+). Each check is shown with its severity and detail so you can verify it yourself. Matched checks are not proof of a breach.

Export: the Export report (.zip) button downloads a zip archive for record-keeping or to hand to an investigator. Because the exploit hides its SQL injection and pre-auth admin creation inside a REST batch request body — which web servers do not log — the database artifacts are the primary evidence, so the archive includes the raw rows a human needs to review: the report as JSON and plain text, the relevant oembed_cache, customize_changeset, suspect posts, suspect users (exploit-default logins/emails and new administrators; never password hashes), orphaned usermeta and changed plugin files, plus LOG-COLLECTION-GUIDE.txt listing the server-side logs to gather by hand (the plugin cannot read those itself). If the server lacks the PHP zip extension, a single JSON file with the same data is downloaded instead. The export is generated on the fly and stores nothing on the site.

This is a focused, single-purpose tool. It is best-effort: matched checks are not proof of a breach on their own, and an all-clear result is not a guarantee. Do not act on this quick check alone — verify matched checks with your webmaster, consider a proper investigation (server and access logs, file integrity) if anything is unexplained, and treat reinstalling WordPress as a last resort. It complements, and does not replace, updating core and a professional investigation.