WPForms PayPal Commerce Webhook Forgery via Missing Signature Verification

#!/usr/bin/env bash
# CVE-2026-4986 checker — WPForms PayPal webhook forgery
# Usage: bash check_cve_2026_4986.sh <wordpress_url>
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

TARGET="${1:-}"
if [ -z "$TARGET" ]; then
  echo "Usage: $0 <wordpress_url>"
  exit 2
fi

# Strip trailing slash
TARGET="${TARGET%/}"

# Try both plugin slugs (lite and pro)
VERSION=""
for SLUG in wpforms-lite wpforms; do
  RESPONSE=$(curl -sf "${TARGET}/wp-content/plugins/${SLUG}/readme.txt" 2>/dev/null || true)
  if [ -n "$RESPONSE" ]; then
    VERSION=$(echo "$RESPONSE" | grep -i '^Stable tag:' | head -1 | sed 's/[Ss]table [Tt]ag:[[:space:]]*//' | tr -d '[:space:]')
    break
  fi
done

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — Could not detect WPForms version at ${TARGET}"
  echo "The plugin may not be installed, or readme.txt is not publicly accessible."
  exit 2
fi

echo "Detected WPForms version: ${VERSION}"

# Version comparison: vulnerable if < 1.10.0.5
# Split version into components
IFS='.' read -ra PARTS <<< "$VERSION"
MAJOR=${PARTS[0]:-0}
MINOR=${PARTS[1]:-0}
PATCH=${PARTS[2]:-0}
SUB=${PARTS[3]:-0}

# PayPal Commerce introduced in 1.10.0 — versions before 1.10.0 are not affected
if [ "$MAJOR" -lt 1 ] || ([ "$MAJOR" -eq 1 ] && [ "$MINOR" -lt 10 ]); then
  echo "PATCHED — Version ${VERSION} predates PayPal Commerce feature (introduced in 1.10.0). Not affected by CVE-2026-4986."
  exit 0
fi

# Vulnerable: 1.10.0.1 through 1.10.0.4
if [ "$MAJOR" -eq 1 ] && [ "$MINOR" -eq 10 ] && [ "$PATCH" -eq 0 ] && [ "$SUB" -lt 5 ]; then
  echo "VULNERABLE — WPForms ${VERSION} is affected by CVE-2026-4986 (PayPal webhook forgery). Update to 1.10.0.5+."
  exit 1
fi

echo "PATCHED — WPForms ${VERSION} is >= 1.10.0.5. CVE-2026-4986 is fixed."
exit 0