JAT Shell Scanner Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is a pair of critical bugs in PHP itself, made public on October 21, 2026 and attacked since October 17. It lets anyone run code on an unpatched server without logging in, and can leak passwords and keys from memory. It’s fixed by updating PHP — usually your host’s job — to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later.
wp2shell (CVE-2026-63030 / CVE-2026-60137) is a WordPress core bug from July 2026, fixed in WordPress 6.8.6, 6.9.5 and 7.0.2.
This plugin tells you whether your site is exposed to either, and looks for signs that an attacker already got in. Scans only read. If something is found, optional one-click fixes can quarantine files or remove admin rights — and every fix can be undone.
What it checks
- The PHP your website runs, including Debian/Ubuntu package versions and build dates (patched without a version change), and the temporary php.ini protections
- Whether the site ran an unpatched PHP during the attack window
- PHP2Shell traces in the PHP error log; exploit tools, known attacker addresses and suspicious bursts in the access log; the /tmp/nfs second stage
- Your WordPress version, and wp2shell exploit plugins, files and traffic
- Webshell code anywhere in the site, PHP hidden in uploads, images and the site root, and PHP auto-loaded via .user.ini / .htaccess
- New or promoted administrators, roles given admin powers, application passwords
- Backdoors kept in the database: code in settings, scripts and hidden links injected into posts, scheduled tasks that carry code
- WordPress core files, and plugins from WordPress.org, against official checksums; unexplained drop-ins
- Its own files, against the checksums WordPress.org publishes for this plugin
Features
- Works on shared hosting with short time limits — scans run in slices with a progress bar
- A ready-to-send message for your host when PHP needs updating
- Weekly or daily automatic scans with email alerts for new, serious findings
- One-click quarantine and admin removal, with undo
- Fleet dashboard: one hub site shows the results of all your sites, with email/Slack/Discord alerts and remote rescans
- Ignore false positives (signed, so attackers can’t forge it)
- Site Health integration
- WP-CLI:
wp jat-shell scan,status,ignore,fix,quarantine,fleet - Multisite aware
Free, open source, no account
Everything in the plugin is free. There is no paid version, no sign-up and no tracking. Development happens in the open on GitHub.
Need hands-on help?
The plugin is made by Jeremy Anderson, who builds and looks after WordPress sites. If you’d rather have someone deal with a vulnerable or hacked site for you, book a call or see the services. Full documentation is on the plugin’s page.
External services
The plugin only contacts outside servers in the cases below. It sends no analytics or personal data, and never sends your site’s files or scan results anywhere you didn’t set up.
- WordPress.org core checksums (api.wordpress.org) — during a scan, to compare your WordPress core files with the official ones. Sends your WordPress version and locale, the same request WordPress itself makes. WordPress.org privacy policy
- WordPress.org plugin checksums (downloads.wordpress.org) — during a scan, to check that this plugin’s files, and those of your other plugins from WordPress.org, haven’t been tampered with. Sends only each plugin’s folder name and version. Turned off with the “Core and plugin files” setting (except this plugin’s own self-check). WordPress.org privacy policy
- Your own fleet hub — only if you turn on the fleet dashboard and connect a site to a hub you run (another WordPress site with this plugin). Requests are signed with your fleet key and a per-site key, and go only to the hub address you enter:
- After each scan, a summary: site name and address, the address of its scanner page, verdict, WordPress, PHP and plugin versions, PHP’s server interface, scan time, finding counts, and the text of serious findings (email addresses removed). The first report also carries a random per-site key so the hub can recognise the site later.
- Once an hour, a check-in with only the site’s address, asking whether someone on the hub requested a new scan.
- Slack or Discord — only if you paste a webhook address into the fleet alert settings. The hub sends alert messages (site address and what was found) to that webhook. Slack terms, Discord terms
- Email alerts use your site’s normal WordPress mail.
Screenshots
The verdict: whether PHP and WordPress are exposed, and whether there are signs of a break-in.
Findings, with what each one means and what to do.
The fleet dashboard for many sites.
Quarantine: every fix can be undone.
