Secure Copy Content Protection and Content Locking unauthenticated SQL injection via sccp_id

#!/usr/bin/env bash
# check-cve-2021-24931.sh
# Detects whether the Secure Copy Content Protection and Content Locking plugin
# is vulnerable to CVE-2021-24931 based on installed version.
#
# Usage: bash check-cve-2021-24931.sh /path/to/wordpress
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN (not installed / unreadable / cannot determine)

set -u

TARGET_VERSION="2.8.2"
WP_ROOT="${1:-}"
PLUGIN_DIR_REL="wp-content/plugins/secure-copy-content-protection"

if [[ -z "$WP_ROOT" ]]; then
  echo "UNKNOWN - usage: $0 /path/to/wordpress"
  exit 2
fi

PLUGIN_DIR="$WP_ROOT/$PLUGIN_DIR_REL"

if [[ ! -d "$PLUGIN_DIR" ]]; then
  echo "UNKNOWN - plugin directory not found: $PLUGIN_DIR"
  exit 2
fi

# Find the plugin header file by looking for the plugin name or a Version header.
PLUGIN_FILE=""
while IFS= read -r -d '' file; do
  if grep -qi "Plugin Name:.*Secure Copy Content Protection" "$file" 2>/dev/null; then
    PLUGIN_FILE="$file"
    break
  fi
done < <(find "$PLUGIN_DIR" -maxdepth 2 -type f -name '*.php' -print0 2>/dev/null)

if [[ -z "$PLUGIN_FILE" ]]; then
  # Fallback: grab the first PHP file with a Version header.
  while IFS= read -r -d '' file; do
    if grep -qi '^\s*Version:' "$file" 2>/dev/null; then
      PLUGIN_FILE="$file"
      break
    fi
  done < <(find "$PLUGIN_DIR" -maxdepth 2 -type f -name '*.php' -print0 2>/dev/null)
fi

if [[ -z "$PLUGIN_FILE" || ! -r "$PLUGIN_FILE" ]]; then
  echo "UNKNOWN - could not locate readable plugin header file"
  exit 2
fi

INSTALLED_VERSION=$(awk -F': *' 'BEGIN{IGNORECASE=1} /^\s*Version:/ {print $2; exit}' "$PLUGIN_FILE" | tr -d '\r')

if [[ -z "$INSTALLED_VERSION" ]]; then
  echo "UNKNOWN - could not parse version from $PLUGIN_FILE"
  exit 2
fi

version_lt() {
  # returns 0 if $1 < $2
  [[ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" && "$1" != "$2" ]]
}

if version_lt "$INSTALLED_VERSION" "$TARGET_VERSION"; then
  echo "VULNERABLE - installed version $INSTALLED_VERSION is older than fixed version $TARGET_VERSION"
  exit 1
fi

if [[ "$INSTALLED_VERSION" == "$TARGET_VERSION" || "$(printf '%s\n%s\n' "$INSTALLED_VERSION" "$TARGET_VERSION" | sort -V | tail -n1)" == "$INSTALLED_VERSION" ]]; then
  echo "PATCHED - installed version $INSTALLED_VERSION is at or above fixed version $TARGET_VERSION"
  exit 0
fi

echo "UNKNOWN - installed version $INSTALLED_VERSION could not be compared reliably"
exit 2