All-in-One WP Migration and Backup Unauthenticated Second-Order SQL Injection via Archive Restore

#!/usr/bin/env bash
# check_cve_2026_19949.sh — Detect CVE-2026-19949 in All-in-One WP Migration
# Usage: bash check_cve_2026_19949.sh /path/to/wordpress
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

WP_ROOT="${1:-/var/www/html}"
PLUGIN_FILE="${WP_ROOT}/wp-content/plugins/all-in-one-wp-migration/all-in-one-wp-migration.php"
SAFE_VERSION="7.110"

if [[ ! -f "$PLUGIN_FILE" ]]; then
  echo "UNKNOWN — All-in-One WP Migration plugin not found at ${PLUGIN_FILE}"
  # Also check mu-plugins for IOCs while we're here
  MU_DIR="${WP_ROOT}/wp-content/mu-plugins"
  if [[ -d "$MU_DIR" ]] && find "$MU_DIR" -name '*.php' -newer "$WP_ROOT/wp-config.php" -print -quit 2>/dev/null | grep -q .; then
    echo "WARNING — Suspicious recent PHP files found in mu-plugins directory"
  fi
  exit 2
fi

# Extract version from plugin header
INSTALLED_VERSION=$(grep -i '^[[:space:]]*\*[[:space:]]*Version:' "$PLUGIN_FILE" | head -1 | sed 's/.*Version:[[:space:]]*//' | tr -d '[:space:]')

if [[ -z "$INSTALLED_VERSION" ]]; then
  echo "UNKNOWN — Could not parse version from ${PLUGIN_FILE}"
  exit 2
fi

# Version comparison function
version_gte() {
  printf '%s\n%s' "$1" "$2" | sort -V | head -1 | grep -qx "$2"
}

echo "Installed version: ${INSTALLED_VERSION}"
echo "Safe version: >= ${SAFE_VERSION}"

if version_gte "$INSTALLED_VERSION" "$SAFE_VERSION"; then
  echo "PATCHED — All-in-One WP Migration ${INSTALLED_VERSION} is >= ${SAFE_VERSION}"
  exit 0
else
  echo "VULNERABLE — All-in-One WP Migration ${INSTALLED_VERSION} is affected by CVE-2026-19949"
  # Check for IOCs: trackbacks with suspicious content
  WP_CONFIG="${WP_ROOT}/wp-config.php"
  if [[ -f "$WP_CONFIG" ]]; then
    DB_NAME=$(grep "DB_NAME" "$WP_CONFIG" | cut -d "'" -f4 2>/dev/null || true)
    DB_PREFIX=$(grep "table_prefix" "$WP_CONFIG" | cut -d "'" -f2 2>/dev/null || true)
    if [[ -n "$DB_NAME" && -n "$DB_PREFIX" ]]; then
      echo "TIP: Check for planted payloads with:"
      echo "  mysql -e \"SELECT comment_ID, comment_content FROM ${DB_NAME}.${DB_PREFIX}comments WHERE comment_type='trackback' AND (comment_content LIKE '%ai1wm_secret_key%' OR comment_content LIKE '%UNION%SELECT%' OR comment_author LIKE '%\\\\\\\\%');\" "
    fi
  fi
  # Check for post-exploitation IOCs in mu-plugins
  MU_DIR="${WP_ROOT}/wp-content/mu-plugins"
  if [[ -d "$MU_DIR" ]]; then
    SUSPICIOUS=$(find "$MU_DIR" -name '*.php' -newer "$PLUGIN_FILE" 2>/dev/null | head -5)
    if [[ -n "$SUSPICIOUS" ]]; then
      echo "WARNING — Suspicious PHP files in mu-plugins (possible post-exploitation):"
      echo "$SUSPICIOUS"
    fi
  fi
  exit 1
fi