ZephrFish/wp2shell-scanner ? reverse-engineered prompt

Build me a Python command line tool that checks WordPress sites for exposure to wp2shell and can also validate the issue in a safe lab setting.

I want one script I can run against a single target or a list of hosts. The first mode should do a non destructive scan that fingerprints the WordPress version and confirms the REST batch route is reachable, with optional JSON output for easy automation. The other modes should be for an authorized local test environment only, letting me confirm the timing based SQL injection, read a few useful values, and then test the shell and RCE paths in the bundled lab.

Keep it simple and self contained, using only the Python standard library. It should print a small banner when it starts, support common options like timeout, proxy, and concurrency for scans, and be careful about asking for confirmation before anything that executes code. If you need current details, look up the latest docs online first.