=== wp2shell IOC Scanner ===
Contributors: michaelkanda
Author URI: https://designare.at
Plugin URI: https://github.com/michael-kanda/Wp2shell-ioc-scanner
Tags: security, incident-response, wordpress, shadow-admin, ioc
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.4.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Read-only-by-default wp2shell triage: patch state, durable database and filesystem artifacts, account checks, and evidence export.

== Description ==

wp2shell IOC Scanner is a bounded, read-only-by-default triage helper for CVE-2026-60137 and CVE-2026-63030.

It checks:

* affected WordPress core versions;
* public and configurable account indicators;
* hidden and unexpected administrators (the raw comparison is capped at 5,000 users);
* oEmbed, changeset, orphaned-usermeta, and user-ID artifacts;
* official core checksums and extra core PHP files;
* PHP-like files in uploads and recently changed plugin/theme files;
* normal, network-active, MU, and drop-in plugin paths;
* suspicious URL options, missing active plugins, and cron hook names.

Results use four confidence levels so routine updates are not presented like high-confidence account or integrity findings. User and filesystem work is bounded and cached; a scheduled scan refreshes the cache.

The audit screen exports bounded JSON evidence and CSV check results without password hashes, session tokens, or application passwords. It also identifies external logs and host evidence that must be collected outside WordPress.

**No-match is not an all-clear.** The scanner runs inside WordPress, where compromised code can falsify results. It does not replace offline file comparison, server/WAF/PHP logs, process and network review, or professional incident response.

== Controlled Cleanup ==

Destructive cleanup is disabled by default. After exporting evidence and independently verifying the target, temporarily add this to wp-config.php:

`define( 'WP2S_IOC_ENABLE_CLEANUP', true );`

Deletion requires target-specific capabilities, a nonce, typed DELETE confirmation, self/last-admin guards, and extra confirmation before content deletion. Hidden IDs must still match a fresh raw comparison. Multisite deletion is blocked.

The local activity history is not tamper-evident. The `wp2s_ioc_user_deleted` action can forward events to a remote logger or SIEM.

== Installation ==

1. Upload the plugin directory to `/wp-content/plugins/`.
2. Activate the plugin.
3. Open **wp2shell IOC > Forensic Audit**.
4. Run a fresh scan and export evidence before remediation.

== Frequently Asked Questions ==

= Does this prove that a site is clean? =

No. It checks a bounded list of artifacts from inside the potentially compromised runtime.

= Does it remove malware? =

No. Optional cleanup removes only one explicitly selected user. It does not remove files, backdoors, cron persistence, or operating-system compromise.

= Does it support Multisite? =

Scanning includes network plugin paths, but hidden-account comparison and deletion are disabled because network and site user scopes differ.

== Changelog ==

= 1.4.0 =
* Added patch-state classification and durable database-artifact checks.
* Added core checksum, extra-core-PHP, uploads, MU/drop-in/network-plugin, theme, and cron checks.
* Added confidence levels and removed unverified default indicators.
* Added bounded JSON evidence and CSV check exports.
* Added paginated user and cleanup views plus scheduled cached scans.
* Made acknowledgement per administrator.
* Made cleanup opt-in/read-only by default.
* Added target-specific delete capability, typed confirmation, raw last-admin guard, and hidden-ID revalidation.
* Disabled destructive actions and hidden-user comparison on Multisite.
* Renamed the local audit log to activity history and added a remote logging hook.
* Added Composer-based syntax, regression, coding-standard, and PHP compatibility checks.

= 1.3.1 =
* Plugin Check compliance and escaping corrections.

= 1.3.0 =
* Added raw-database hidden-account comparison and cleanup by ID.

= 1.2.0 =
* Added cached dashboard widget and notices.

= 1.1.0 =
* Added configurable indicators and name-independent heuristics.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.4.0 =
Cleanup is now disabled by default and must be explicitly enabled in wp-config.php after evidence export.