What is wp2shell-detect?

wp2shell-detect is a security scanning tool that checks whether a WordPress website is exposed to a specific vulnerability called wp2shell, without ever exploiting it. wp2shell is a chain of two flaws in WordPress core disclosed in July 2026: a routing bug in the REST batch endpoint, and a SQL injection reachable through that same routing bug. Combined, they would let an unauthenticated attacker create a fake administrator account and install a malicious plugin on a default WordPress install, with no other plugin or theme needed. This tool only detects exposure, it does not attack anything. Every request it sends is a normal, read-only request that any web crawler could make. It figures out the WordPress core version from several public clues, such as the generator meta tag, version numbers on core script and style files, the RSS feed generator tag, the login page assets, and the version file, cross-checking these sources against each other and reporting how confident it is in the result. It then compares that version against the known vulnerable version ranges. It also sends a harmless request to the REST batch route that returns the route's structure without ever running the actual handler, which tells it whether the vulnerable endpoint is reachable or blocked at the edge. Finally, it can detect when a website's visible front end is not WordPress itself but is connected to a separate WordPress backend on another subdomain, and optionally follow that connection to scan the real WordPress host. The tool can be installed via pip or run directly as a single Python file with no dependencies, requiring only Python 3.8 or newer. It supports scanning a single site or a list of many targets in parallel, outputting results as plain text or JSON, and it returns a specific exit code when a vulnerable target is found, which makes it easy to use inside automated security checks. The README states plainly that vulnerable WordPress versions should be updated to the patched releases, and that if patching is not possible right away, the affected REST route can be blocked at the edge as a temporary measure. The README also includes a legal notice that the tool is meant for authorized security assessments only, and that scanning systems without permission may be illegal. The project is released under the MIT license.