wp-cve-2026-87902-checker - Defensive WordPress security scanner for CVE-2026-

项目说明

WP-C Checker

A lightweight, read-only security checker for identifying indicators
associated with C in WordPress installations.

The project provides two complementary Python tools:

> Security note: This project is designed for defensi
> assessment. It does not attempt exploitation, remote code execution,
> file modification, or destructi.

------------------------------------------------------------------------

Features

Local checker

The local checker is intended to run directly on the WordPress server or
on a copy of the WordPress installation.

It can inspect:

The local checker performs read-only analysis and does not modify
the installation.

Remote checker

The remote checker is designed for situations where you have only
HTTP/HTTPS access to a WordPress site.

It can:

The remote checker deliberately avoids:

------------------------------------------------------------------------

Requirements

The scripts use only the Python standard library.

------------------------------------------------------------------------

Installation

Clone the repository:

No pip install step is required.

------------------------------------------------------------------------

Local Checker

Usage

Run the checker against a local WordPress directory:

For example:

or on Linux:

If WP-CLI is installed and a, the checker can use it for
additional WordPress information.

------------------------------------------------------------------------

Remote Checker

Basic usage

Example:

Custom timeout

output

Ignore TLS certificate

For controlled testing en with a self-signed certificate:

Use --insecure only when you understand the TLS implications.

------------------------------------------------------------------------

Assessment states

The remote checker may report results such as:

PATCHED

The detected WordPress core is at or above the corresponding
patched .

POTENTIALLY

The checker detected an affected WordPress together with public
indicators associated with the precondition.

This is an indicator, not proof of exploitability.

AFFECTED CORE

The detected WordPress belongs to an affected release line, but
the remote checker could not establish the additional public
precondition.

INCONCLUSIVE

The information exposed by the target is insufficient to make a reliable
remote assessment.

A remote scan should therefore not be interpreted as a full
assessment.

------------------------------------------------------------------------

Exit codes

The remote checker uses exit codes that can be useful in scripts and
CI/CD en:

| Exit code | Meaning |
|----------:|---------------------------------------------------------------------------|
| 0 | No indicator detected / patched or inconclusi result |
| 1 | Potential detected |
| 2 | Scanner error or unable to perform the assessment |

Always review the textual output in addition to the exit code.

------------------------------------------------------------------------

Local

| Capability | Local checker | Remote checker |
|-----------------------------------|:-------------:|:---------------------------:|
| WordPress | ✅ | ✅ When publicly detectable |
| Filesystem inspection | ✅ | ❌ |
| PHP configuration | ✅ | ❌ |
| pearcmd.php detection | ✅ | ❌ |
| Upload directory inspection | ✅ | ❌ |
| Core checksum | ✅ | ❌ |
| WP-CLI information | ✅ Optional | ❌ |
| Public endpoint checks | Limited | ✅ |
| Theme detection | ✅ | ✅ When publicly detectable |
| Requires ser access | ✅ | ❌ |
| Exploitation | ❌ | ❌ |
| File modification | ❌ | ❌ |

The two scripts ser purposes. The **local checker provides
deeper , while the remote checker is intentionally limited
to information that can be obtained safely over HTTP/HTTPS**.

------------------------------------------------------------------------

Limitations

Remote detection has important limitations.

A web ser does not expose:

Therefore, a remote HTTP checker cannot provide the same level of
confidence as a local inspection.

In particular, the remote checker does not pro.

A result of INCONCLUSIVE does not mean that the installation is
or safe. It means that the required information was not
publicly observable.

For the most reliable assessment, run the local checker with access to
the actual WordPress installation.

------------------------------------------------------------------------

Security Model

This project intentionally follows a read-only / non-destructive
approach.

The scripts do not:

The purpose is to help administrators identify systems that require
further in or patching.

------------------------------------------------------------------------

Responsible Use

Only scan systems that you own or are explicitly authorized to assess.

Do not use this tool to perform unauthorized security testing against
third-party infrastructure.

For security research, penetration testing, or ,
obtain appropriate authorization before testing.

------------------------------------------------------------------------

Recommended Workflow

For a WordPress installation you administer:

1. Start with the remote checker

This provides a quick, non-in external assessment.

2. If you ha access, run the local checker

The local checker can inspect information that is not a
remotely.

3. If the installation is affected

Update WordPress to the appropriate patched release for its release
branch and review the installation for signs of compromise.

4. Review the results

A scanner result should be treated as an input to a security
in, not as a substitute for patch management, logging,
monitoring, or incident response.

------------------------------------------------------------------------

Project Structure

------------------------------------------------------------------------

Example

The exact output depends on what information the target publicly
exposes.

------------------------------------------------------------------------

Why Two Checkers?

The project deliberately separates local inspection from **remote
assessment**.

A local security checker can inspect the actual ser and
filesystem. A remote checker cannot safely obtain that information
without crossing into techniques such as exploitation, authenticated
access, or ser execution.

Keeping the tools separate makes the security boundary explicit and
keeps the remote scanner suitable for low-impact defensive
reconnaissance.

------------------------------------------------------------------------

Contributing

Contributions are welcome.

Useful contributions include:

Please keep contributions consistent with the project’s **read-only and
non-destructive** design.

------------------------------------------------------------------------

Disclaimer

This software is provided for security assessment and defensi
purposes.

No guarantee is made that the checker will detect every or
compromised installation. Remote detection is inherently limited by the
information exposed by the target.

Always important findings through direct administrative
inspection and appropriate security procedures.

------------------------------------------------------------------------

Author

De as a defensi research and WordPress assessment
tool.

If you find a bug or have an impro, please open a GitHub Issue or
Pull Request.

项目信息

开发语言：Python

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Defensive WordPress security scanner for CVE-2026-87902 — local filesystem inspection and safe remote HTTP/HTTPS assessment.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。