This tool performs non-intrusive remote checks only — it fingerprints your WordPress core and plugin versions and does not attempt any actual injection or exploitation.
Core: wp2shell (CVE-2026-60137 + CVE-2026-63030, unauthenticated RCE on 6.9–7.0.1), plus CVE-2024-31210. Plugins checked: LiteSpeed Cache, Database for Contact Form 7/WPforms/Elementor Forms, UpdraftPlus, Loco Translate, Really Simple Security, WPvivid Backup & Migration.
Only scan sites you own or are authorised to test.