# WordPress Recovery Playbook — offline companion 1.0.0

By Qentra; book author **qentra.tech**. Reference runtime: **Python 3.12.14**, standard library only. No `pip install`, account, network call or API key is needed. This kit does not connect to WordPress, inspect a server, test an exploit, send a support message, change PHP, or restore a real backup.

The advisory snapshot is **23 October 2026**. Recheck current primary advisories and ask the responsible host/administrator before acting. A valid report classifies entered assertions; it never certifies a site, confirms patch deployment, rules out compromise or authorizes a production change.

## Start with a fictional example

1. Extract the kit into a new practice folder. Open the folder containing `README.md`, `scripts/` and `data/`.
2. Open a terminal there: Windows, type `powershell` in File Explorer's address bar; macOS, open Terminal, type `cd `, drag the folder in and press Return; Linux, use the file manager's Open in Terminal.
3. Check Python. Windows: `py -3.12 --version`. macOS/Linux: `python3 --version`. The tested reference is 3.12.14. If missing, ask for help or install from the official Python site; do not install an unrelated `python` package with pip.
4. Run each line separately. Windows: replace the leading `python3` with `py -3.12`.

```sh
python3 scripts/generate_inventory.py --scenario fixed-web-new-notice-unknown --output practice-inventory.json
python3 scripts/triage_inventory.py --inventory practice-inventory.json --output practice-report.json
python3 scripts/triage_inventory.py --inventory practice-inventory.json --format markdown --output practice-report.md
python3 scripts/triage_inventory.py --inventory practice-inventory.json --format ticket --output host-message.txt
python3 scripts/rehearse_backup.py --output-dir practice-rehearsal
python3 -m unittest discover -s tests -v
```

Expected: each command exits **0**. The first report records an upstream minimum for the original two CVEs while the separate new notice remains **unknown**. This is the lesson, not a failure to make the whole site green. `host-message.txt` is an editable draft; nothing is sent. Review its scope before you choose to send it through your provider's official route.

Exit **2** means invalid/missing data, an unsupported argument, an existing output, or a filesystem problem. It is never a vulnerability score. Every output must be a new file or new rehearsal directory. To repeat, choose a new name such as `practice-report-2.json`; the kit has no force, delete or overwrite option. Without `--output`, triage prints the report to the terminal instead of saving it.

## Six public practice scenarios

Use a key below with `--scenario`, or inspect its small JSON file in `data/`:

| Key | What to notice |
|---|---|
| `fixed-web-new-notice-unknown` | The original minima do not settle the 23 October issue. |
| `cli-is-not-web` | A command-line PHP version cannot establish the web-serving runtime. |
| `old-branch-backport-asserted` | Scoped vendor evidence can be recorded, but remains unverified; an old branch also needs lifecycle review. |
| `startup-mitigation-asserted` | Startup-effective upload-progress disabling needs full worker restart for this route. |
| `no-switch-review-asserted` | A reviewed absence of runtime handler switching is a separate scoped assertion. |
| `suspected-compromise` | Escalate indicators; a runtime update is not compromise cleanup. |

The public browser UI must use synthetic presets only. It must not accept real-site exports, arbitrary JSON uploads, credentials or real backup files. Its JavaScript engine performs fixed classification; it cannot open a native terminal or run arbitrary shell code.

## Use a minimal private inventory locally

The offline CLI also accepts `source: "operator-entered"` with `environment: "production"` or `"staging"`. Start from a copy of a synthetic inventory, change those fields, then enter only necessary runtime/evidence facts. Keep the private file outside Git, public web folders and shared drives. Never upload it into the public lab. The kit does not encrypt your local files: your computer's access controls and storage policy apply.

There are no site/domain/account/email/password/customer-data fields. Unknown boolean facts use JSON `null`; never substitute `false` just to finish a form. Record a real backport reference only as a short **public HTTPS advisory URL** without credentials, query or fragment, never a private support ticket, signed URL or token. The URL is syntax-checked, not fetched, trusted or independently verified, and is omitted from the generated report. The host draft asks for necessary proof without copying private input records.

See `SCHEMA.md` for exact fields, enumerations and function contracts. Inputs are capped at 32 KiB and reject duplicate keys, NaN/Infinity, unexpected fields, invalid dates and non-boolean boolean fields. Dates cannot be later than the stated observation; a report from another date explicitly calls for current-advisory review. This is input hygiene, not authenticated evidence.

## Understand the dated classifications

For **CVE-2026-109618 / CVE-2026-109619**, the 21 October upstream minima are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 in their corresponding branches. This is not permanent latest-version advice. Older or unknown branches and version suffixes require vendor evidence; pre-release text never establishes the upstream minimum. A version alone is insufficient: the original report also requires web scope, identified web service, matching environment, evidence date and worker restart assertions. Backports remain `asserted-not-verified` even when every field is complete.

**CVE-2026-115560** is the separate 23 October notice. The four original fixed versions do not establish its resolution. The kit records either startup-effective session-upload-progress disabling plus full worker restart, or scoped reviewed evidence of no runtime serialize-handler switch. Wrong scope, old/missing dates and missing review leave the question open. A hosting statement must cover your actual environment; a CLI check or a registry image is not web deployment proof.

Compromise indicators trigger escalation. `false` or `null` indicators do not mean clean. Backup assertions are distinct from actual backup validation. WordPress/plugin/theme updates, WAF rules and an apparently functioning page do not establish PHP remediation or recovery. No exploit payloads are supplied or required.

## Practice recoverability without a real backup

`rehearse_backup.py` creates only a **new** practice directory containing a marker, two harmless fixture files (a simple HTML page and a fake JSON database), a mock-restored copy and a hash comparison report. It reads those fixed fixture bytes, copies them and compares them. The schema cannot name arbitrary archive members; symlink and path-escape inputs are rejected. No deletion, shell, database server, production directory or live backup is used.

A match teaches that files and database both matter. It does not prove a real backup is recent, clean, consistent, complete or restorable. Actual recovery needs the responsible operator's isolated, tested procedure, outward actions disabled, and qualified compromise assessment when indicated.

## Verify and troubleshoot

```sh
python3 -m unittest discover -s tests -v
```

Optional Node check (not required for the Python path): `node tests/browser-parity.mjs`. Python and JavaScript both compare against the included fictional parity vectors; neither test starts a network or child process. Tests cover branch boundaries, new-notice separation, strict booleans, dates, NaN/duplicates/caps, wrong scope, backports, output preservation and harmless rehearsal path controls.

| Symptom | Recovery |
|---|---|
| Python or script not found | Check installation and open the folder containing README and scripts. |
| Output already exists | Use a new filename or rehearsal directory. No data was overwritten. |
| Inventory rejected | Compare exact fields with SCHEMA.md; use `null` for unknowns and regenerate a fictional example if needed. |
| Status remains unknown | Obtain scoped operator evidence; do not change a fact merely to get a different label. |
| Host says backported | Request the actual product/build/advisory, service, environment, date and worker replacement evidence. Record the assertion privately; this tool does not verify it. |
| Site has suspicious changes | Preserve evidence and escalate to host/security support; this kit does not clean a site. |

`data/advisory.json` contains the snapshot, thresholds and primary URLs selected from the book's primary-source research. No source is fetched by the kit. Read source updates yourself through official channels. Any operator setting change or exposure reduction requires a competent responsible human, impact review and a recovery plan.

Code and explicitly fictional fixtures are MIT-licensed (`LICENSE`). The manuscript, Qentra brand assets and private records are not included in that license or package. Support: support@qentra.tech; send only a kit version and fictional reproduction, never credentials, full logs or customer data.