Title: Compromise Scanner for wp2shell Author: eyesecurity Published: Gorffennaf 20, 2026 Last modified: Gorffennaf 20, 2026 --- Search plugins ![](https://ps.w.org/compromise-scanner-for-wp2shell/assets/banner-772x250.png?rev =3614450) ![](https://ps.w.org/compromise-scanner-for-wp2shell/assets/icon-256x256.png?rev =3614441) # Compromise Scanner for wp2shell Gan [eyesecurity](https://profiles.wordpress.org/eyesecurity/) [Llwytho i lawr](https://downloads.wordpress.org/plugin/compromise-scanner-for-wp2shell.1.1.0.zip) * [Details](https://cy.wordpress.org/plugins/compromise-scanner-for-wp2shell/#description) * [Reviews](https://cy.wordpress.org/plugins/compromise-scanner-for-wp2shell/#reviews) * [Installation](https://cy.wordpress.org/plugins/compromise-scanner-for-wp2shell/#installation) * [Development](https://cy.wordpress.org/plugins/compromise-scanner-for-wp2shell/#developers) [Cefnogaeth](https://wordpress.org/support/plugin/compromise-scanner-for-wp2shell/) ## Disgrifiad Compromise Scanner for wp2shell is a **read-only** forensic scanner for the WordPress core exploit chain publicly tracked as **CVE-2026-63030** (REST batch route confusion) and **CVE-2026-60137** (`author__not_in` SQL injection), widely referred to as _wp2shell_. It inspects the database and the plugin directory for artifacts the exploit leaves behind — even when the attacker cleaned up afterwards — and presents a scored verdict on its own admin screen. It does **not** change anything on your site, and it does** not** fix the vulnerability. To close the hole, update WordPress core. **What it checks (each weighted by severity):** * `oembed_cache` entries that loop back to your own site, that number exactly three, or that were created around the disclosure date (the exploit uses oembed rendering as a write primitive). * Object-graph artifacts: posts with implausibly high parent IDs, known proof-of- concept titles/slugs, and `customize_changeset` entries created since disclosure. * Account artifacts: the `wp2_` login prefix and `@wp2shell.invalid` email used by public exploit code, and non-founder administrator accounts created since disclosure. * Deleted-admin traces: orphaned user metadata and gaps in the user-ID sequence( create-then-delete). * Webshell plugin files or directories matching `wp2shell_*`. **How it reads:** the weighted score maps to _No indicators_ (under 25), _Some indicators_( 25–49), or _Multiple indicators_ (50+). Each check is shown with its severity and detail so you can verify it yourself. Matched checks are not proof of a breach. **Export:** the **Export report (.zip)** button downloads a zip archive for record- keeping or to hand to an investigator. Because the exploit hides its SQL injection and pre-auth admin creation inside a REST batch request body — which web servers do not log — the database artifacts are the primary evidence, so the archive includes the raw rows a human needs to review: the report as JSON and plain text, the relevant` oembed_cache`, `customize_changeset`, suspect posts, suspect users (exploit-default logins/emails and new administrators; never password hashes), orphaned usermeta and changed plugin files, plus `LOG-COLLECTION-GUIDE.txt` listing the server-side logs to gather by hand (the plugin cannot read those itself). If the server lacks the PHP zip extension, a single JSON file with the same data is downloaded instead. The export is generated on the fly and stores nothing on the site. This is a focused, single-purpose tool. It is best-effort: matched checks are not proof of a breach on their own, and an all-clear result is not a guarantee. Do not act on this quick check alone — verify matched checks with your webmaster, consider a proper investigation (server and access logs, file integrity) if anything is unexplained, and treat reinstalling WordPress as a last resort. It complements, and does not replace, updating core and a professional investigation. ## Lluniau Sgrin [⌊The scan screen: status, forensic score, and severity-graded findings.⌉⌊The scan screen: status, forensic score, and severity-graded findings.⌉[ The scan screen: status, forensic score, and severity-graded findings. ## Gosod 1. In wp-admin, go to Plugins Add New Upload Plugin and upload the zip, then Activate. 2. Open **Compromise Scanner for wp2shell** in the admin menu. 3. Click **Run scan** and review the findings. 4. When finished, use **Remove this plugin** on the scan screen to deactivate and delete it. ## Cwestiynau Cyffredin ### Does this change anything on my site? No. It only reads the database and lists files in the plugin directory. It never creates, edits, or deletes posts, users, options, or files (other than removing itself when you click the self-destruct button). ### Does it fix the vulnerability? No. It only detects artifacts. Update WordPress core to a fixed version (6.8.6 / 6.9.5 / 7.0.2 or later) to close the vulnerability. ### A check is marked “Matched” but I know it is legitimate. That can happen — for example, three recent legitimate embeds, or an administrator you onboarded recently, can match individual checks. The verdict is a weighted score across many indicators; review each detected item against your own records. ### A scan matched nothing. Am I safe? It means no known wp2shell artifacts were found. A careful attacker can remove traces, and other attacks leave different evidence, so treat “Clean” as reassuring but not conclusive. ## Adolygiadau ![](https://secure.gravatar.com/avatar/c9176b86f35fd99838106bc16ef65c0bdfd04f633be56a07e5d3ea30a784859c? s=60&d=retro&r=g) ### 󠀁[Thank you for this useful plugin!](https://wordpress.org/support/topic/thank-you-for-this-useful-plugin-5/)󠁿 [Joe C](https://profiles.wordpress.org/joecostello/) Gorffennaf 21, 2026 Provides very useful diagnostics for tracing the recent WP hack [ Read all 1 review ](https://wordpress.org/support/plugin/compromise-scanner-for-wp2shell/reviews/) ## Contributors & Developers “Compromise Scanner for wp2shell” is open source software. The following people have contributed to this plugin. Cyfranwyr * [ eyesecurity ](https://profiles.wordpress.org/eyesecurity/) [Translate “Compromise Scanner for wp2shell” into your language.](https://translate.wordpress.org/projects/wp-plugins/compromise-scanner-for-wp2shell) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/compromise-scanner-for-wp2shell/), check out the [SVN repository](https://plugins.svn.wordpress.org/compromise-scanner-for-wp2shell/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/compromise-scanner-for-wp2shell/) by [RSS](https://plugins.trac.wordpress.org/log/compromise-scanner-for-wp2shell/?limit=100&mode=stop_on_copy&format=rss). ## Cofnod Newid #### 1.1.0 * New: an **Export report (.zip)** button on the scan screen. The archive contains the report (JSON + plain text), the raw database rows an investigator needs to review — `oembed_cache`, `customize_changeset`, suspect posts, suspect users ( exploit-default logins/emails and new administrators; never password hashes or session tokens), orphaned usermeta, user-ID accounting, and changed plugin files— and a `LOG-COLLECTION-GUIDE.txt` explaining which server-side logs to collect by hand. Because the exploit hides its SQL injection and admin creation in a request body that web servers do not log, these database rows are the primary evidence. Rows and content excerpts are capped so the archive stays reviewable. Falls back to a single JSON download when the PHP zip extension is missing. The archive is built in a temporary file removed in the same request — the plugin still changes nothing on the site. #### 1.0.1 * The user-ID-gap check no longer matches on shared-user-table installs (multisite or platform hosting such as WordPress.com), where IDs are allocated platform- wide, and ignores gaps that dwarf the account count (imports, bulk cleanup). It explains in the detail column why it was not counted. * The new-accounts check now counts only administrator accounts, as the exploit creates an administrator; ordinary sign-ups on sites with open registration no longer match. * Documentation: the fixed-version list consistently includes the 6.8.6 backport. #### 1.0.0 * Initial release: read-only scan with a dedicated admin screen, a separate version- status panel, severity-graded checks, and objective, non-alarming reporting. ## Meta * Version **1.1.0** * Last updated **2 ddiwrnod yn ôl** * Active installations **200+** * WordPress version ** 5.6 neu uwch ** * Tested up to **7.0.2** * PHP version ** 7.2 neu uwch ** * Language * [English (US)](https://wordpress.org/plugins/compromise-scanner-for-wp2shell/) * Tags * [forensics](https://cy.wordpress.org/plugins/tags/forensics/)[malware](https://cy.wordpress.org/plugins/tags/malware/) [security](https://cy.wordpress.org/plugins/tags/security/)[vulnerability](https://cy.wordpress.org/plugins/tags/vulnerability/) * [Advanced View](https://cy.wordpress.org/plugins/compromise-scanner-for-wp2shell/advanced/) ## Graddau 5 out of 5 stars. * [ 1 5-star review ](https://wordpress.org/support/plugin/compromise-scanner-for-wp2shell/reviews/?filter=5) * [ 0 4-star reviews ](https://wordpress.org/support/plugin/compromise-scanner-for-wp2shell/reviews/?filter=4) * [ 0 3-star reviews ](https://wordpress.org/support/plugin/compromise-scanner-for-wp2shell/reviews/?filter=3) * [ 0 2-star reviews ](https://wordpress.org/support/plugin/compromise-scanner-for-wp2shell/reviews/?filter=2) * [ 0 1-star reviews ](https://wordpress.org/support/plugin/compromise-scanner-for-wp2shell/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/compromise-scanner-for-wp2shell/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/compromise-scanner-for-wp2shell/reviews/) ## Cyfranwyr * [ eyesecurity ](https://profiles.wordpress.org/eyesecurity/) ## Cefnogaeth Issues resolved in last two months: 0 out of 1 [Gweld y fforwm cefnogi](https://wordpress.org/support/plugin/compromise-scanner-for-wp2shell/)