Skip to content

README.md

Latest commit

 

History

History
49 lines (35 loc) · 1.72 KB

README.md

File metadata and controls

49 lines (35 loc) · 1.72 KB
Raw

WP2Shell Fixer

Standalone mitigation plugin for two actively exploited WordPress vulnerabilities (CISA catalog). Deploy on sites that cannot be updated yet to a patched core (6.8.6 / 6.9.5 / 7.0.2). Compatible with PHP 5.6+ and old WordPress versions.

This plugin is a temporary band-aid. The real fix remains updating WordPress. Remove the plugin once the core is updated.

Covered vulnerabilities

CVE Vulnerability Applied mitigation
CVE-2026-60137 SQL injection via author__not_in in WP_Query (CWE-89) Coerces author__in / author__not_in to positive integers via pre_get_posts (priority 0) and the request filter, before the SQL is built.
CVE-2026-63030 REST API batch endpoint route confusion (CWE-436), chained to RCE Unregisters the /batch/... routes (rest_endpoints) and blocks any dispatch to /batch/ with a 403 (rest_pre_dispatch).

Installation

Drop the wp2shell-fixer.php file into wp-content/plugins/, then activate "WP2Shell Fixer" in the admin, or via WP-CLI:

wp plugin activate wp2shell-fixer

No configuration required.

Re-enabling the batch endpoint (rare)

The batch endpoint is mostly used by the block editor for grouped saves. If you really need it, add this in a mu-plugin:

add_filter( 'wp2shell_fixer_disable_batch', '__return_false' );

Tests

  • PHP 5.6 compatibility (syntax + runtime + logic): 
    docker run --rm --platform linux/amd64 -v "$PWD":/app -w /app tetraweb/php:5.6 \
  php test/php56-compat.php
  • Behavior on a real WordPress (WP 5.8 + WP-CLI via Docker): 
    bash test/run-tests.sh

Both suites must print "ALL TESTS PASS".