內容簡介
Compromise Scanner for wp2shell 是一款只讀的取證掃描器，專門檢查 WordPress 核心漏洞 CVE-2026-63030 和 CVE-2026-60137 相關的跡象。它能夠檢查資料庫和外掛目錄，尋找攻擊者留下的痕跡，並在管理介面上提供評分結果。
【主要功能】
• 檢查 oembed_cache 條目及其創建時間
• 檢測不合理的父 ID 和已知的證明概念標題
• 檢查使用 wp2_ 登錄前綴的帳戶
• 尋找孤立的用戶元數據和用戶 ID 序列缺口
• 匹配 webshell 外掛檔案或目錄
外掛標籤
開發者團隊
② 後台搜尋「Compromise Scanner for wp2shell」→ 直接安裝（推薦）
原文外掛簡介
Compromise Scanner for wp2shell is a read-only forensic scanner for the WordPress core exploit chain publicly tracked as CVE-2026-63030 (REST batch route confusion) and CVE-2026-60137 (author__not_in SQL injection), widely referred to as wp2shell.
It inspects the database and the plugin directory for artifacts the exploit leaves behind — even when the attacker cleaned up afterwards — and presents a scored verdict on its own admin screen. It does not change anything on your site, and it does not fix the vulnerability. To close the hole, update WordPress core.
What it checks (each weighted by severity):
oembed_cache entries that loop back to your own site, that number exactly three, or that were created around the disclosure date (the exploit uses oembed rendering as a write primitive).
Object-graph artifacts: posts with implausibly high parent IDs, known proof-of-concept titles/slugs, and customize_changeset entries created since disclosure.
Account artifacts: the wp2_ login prefix and @wp2shell.invalid email used by public exploit code, and non-founder administrator accounts created since disclosure.
Deleted-admin traces: orphaned user metadata and gaps in the user-ID sequence (create-then-delete).
Webshell plugin files or directories matching wp2shell_*.
How it reads: the weighted score maps to No indicators (under 25), Some indicators (25–49), or Multiple indicators (50+). Each check is shown with its severity and detail so you can verify it yourself. Matched checks are not proof of a breach.
Export: the Export report (.zip) button downloads a zip archive for record-keeping or to hand to an investigator. Because the exploit hides its SQL injection and pre-auth admin creation inside a REST batch request body — which web servers do not log — the database artifacts are the primary evidence, so the archive includes the raw rows a human needs to review: the report as JSON and plain text, the relevant oembed_cache, customize_changeset, suspect posts, suspect users (exploit-default logins/emails and new administrators; never password hashes), orphaned usermeta and changed plugin files, plus LOG-COLLECTION-GUIDE.txt listing the server-side logs to gather by hand (the plugin cannot read those itself). If the server lacks the PHP zip extension, a single JSON file with the same data is downloaded instead. The export is generated on the fly and stores nothing on the site.
This is a focused, single-purpose tool. It is best-effort: matched checks are not proof of a breach on their own, and an all-clear result is not a guarantee. Do not act on this quick check alone — verify matched checks with your webmaster, consider a proper investigation (server and access logs, file integrity) if anything is unexplained, and treat reinstalling WordPress as a last resort. It complements, and does not replace, updating core and a professional investigation.
