wtf is wp2shell-scanner?

wp2shell-scanner is a security research tool for detecting and testing a specific WordPress vulnerability, tracked as CVE-2026-63030 and CVE-2026-60137. It is a single Python script with no external dependencies, meant for security researchers and penetration testers checking whether a WordPress site is exposed to this issue, and for demonstrating the exploit chain in an authorized lab setting. The tool has several modes chosen with a command line flag. A basic scan mode simply checks the WordPress version and confirms a certain internal web route is reachable, without sending anything that could actually exploit the site. Other modes go further and are meant only for systems the user owns or has explicit permission to test: one confirms a database timing based vulnerability with a harmless probe, another extracts specific pieces of data from the database using that same timing technique, and two more modes actually attempt to gain code execution on the target, either using a cracked administrator password or, in the more advanced mode, by forging administrator access entirely through the vulnerability itself, without needing any password at all. A final mode checks, without actually escalating anything, whether the conditions needed to go from a web shell to full server access are present. Anything beyond the basic scan mode requires the user to confirm interactively that they are authorized to test the target, unless that prompt is explicitly skipped for automation, and running the tool against a non local target with the most aggressive mode requires an extra flag confirming authorization. The project ships a small local lab environment using Docker Compose so the whole exploit chain can be tried safely against a deliberately vulnerable copy of WordPress rather than a live site. The repository also includes the research notes and patch differences used to work out how the vulnerability functions, along with a template for the Nuclei scanning tool and a linked blog post that walks through the technical details of how the exploit chain was traced. Options exist to scan a single host, a list of hosts, or hosts read from a file, with adjustable thread count, timing delays, and the ability to route traffic through a proxy such as Burp for closer inspection.