Given the active exploitation of wp2shell (CVE-2026-63030 + CVE-2026-60137)
I put together a HestiaCP-specific compromise scanner and wanted to share it
with the community.
Most existing scanners only check the WordPress version. This one goes further —
it’s built specifically for HestiaCP servers and scans every hosted site
automatically, checks for the direct fingerprints of an active compromise
(rogue admin accounts, database traces, poisoned cache rows), does a
line-by-line diff of each site’s core files against the official clean WordPress
release, and sends a per-client email report to the CONTACT address stored in
Hestia for each user.
Everything is read-only. The scripts never modify anything on your server.
Full documentation, configuration options, and usage instructions on GitHub:
One important reminder: updating to WordPress 7.0.2 / 6.9.5 / 6.8.6 closes
the vulnerability, but if a site was exploited before the patch it remains
compromised. The update alone doesn’t clean it — that’s what this scanner
is for.
Hope it helps. Happy to take questions or suggestions.
as I usually would advise against running any code/script just posted in any forum, without checking it first, I had a quick glance at it, but did not dive deep enough to actually tell, if I’d trust to run this just so.
no offense meant, this is just something that requires trust nowadays.
therefore I would really suggest that you make sure all outputs and also comments are in englisch instead of greek. it is just a burden, if you want to review something and have to translate it
nice, looks simply more trustworthy and is much easier to read.
I did not find anything worrysome, so I even tested it on one of my servers…
more feedback: the first checks for version, admins and checksums are the actually good ones. but be aware, that not updated or customised themes or plugins might already trigger that checksum warning.
the php checks I think are not really helping, at least in their current form.
the idea is great, but:
30-days check on most system will list nearly everything legit that received an update in that time frame. due to the CVEs this can quickly be a lot on actually updated systems.
if such a system was already compromised, you will have a hard time finding actual malware between all the ‘false positives’. I think you’ll need some additional filter to reduce that.
similar goes for the pattern check. a lot of the listed files probably legitimately contain one or more of the patterns/function you are looking for and while you warn about the possibility of many falsely flagged files, a lot of users will not be able to distinguish or know how to follow up on it.
maybe you want to combine the recent change check with the patterns? at least for my test cases, that would bring down the numbers of false positives immediately by a lot.
also maybe add at least the matching line for the pattern to the output, so one does not need to pull every single file individually
nice work though, could be helpful to people, thanks for sharing
Thanks for the thorough feedback, really appreciate you testing it!
You are right on all points.
The most valuable suggestion is combining the recent-change check with
the pattern scan — only flagging files that match both conditions would
cut false positives significantly. A file with eval() that hasn’t been
touched in months is a very different risk from one modified the week of
the disclosure.
The 30-day window is also too broad for recently patched systems, agreed.
Planning to make it tighter (around the disclosure date) and configurable.
And showing the actual matching line inline rather than just the filename
is an obvious improvement — will add that to the pattern output section.
Will push an updated version with these changes shortly.
@Blats sorry for the late reply. I checked and your script currently is broken, because a variable is not populated (I tested only the fast server-wide scan)
wp2shell-scan.sh: Zeile 418: DANGER_PATTERNS ist nicht gesetzt.
for the sake of testing, I populated that with a pattern from your older version:
which yields a lot of hits, so probably is by far to wide and needs proper curation.
but confirm it works then. I do like the calculators though.
another potential bug: the wp options claim for all my sites url is not matching and tell “expected: web” , which feels a bit weird. I didn’t dig into it though.
looks good now. the ‘not recently updated’ php files might still bring a lot of clutter, and I wouldn’t actually even list them, but overall it is still good readable to me.
showing the matching lines also helps a lot to quickly assess, if that is a false positive!
nice work, should help some people with larger fleets to at least get a quick overview
