Read-only bash scanner that checks a multi-site WordPress server for indicators of compromise from the Essential Plugin / wpos-analytics backdoor disclosed April 2026 (31 plugins, 8-month dormant backdoor, wp-config.php injection serving SEO spam to Googlebot via an Ethereum-resolved C2).
Scans each site for: affected plugin slugs, presence of the wpos-analytics/ backdoor module, backdoor code traces (wpos_analytics_anl, fetch_ver_info, etc.), wp-config.php IOC strings, and the rogue wp-comments-posts.php dropper.
Reports per-plugin status (backdoor present / patched / module removed) and a summary count. Assumes layout /var/www/html/<site>/docs/wp-content/plugins — edit the glob for other layouts.