WordPress Core Authenticated (Author+) RCE via Imagick/Ghostscript PostScript File Upload

#!/usr/bin/env bash
# check_cve_2026_65640.sh — Detect CVE-2026-65640 exposure
# Usage: bash check_cve_2026_65640.sh /path/to/wordpress
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

WP_ROOT="${1:-/var/www/html}"
VERSION_FILE="$WP_ROOT/wp-includes/version.php"
VULNERABLE=0
IMAGICK=0
GHOSTSCRIPT=0

# --- Check WordPress version ---
if [[ ! -f "$VERSION_FILE" ]]; then
  echo "UNKNOWN — Cannot find $VERSION_FILE. Is this a WordPress installation?"
  exit 2
fi

WP_VERSION=$(grep -oP "\\\$wp_version\s*=\s*'\K[^']+" "$VERSION_FILE" 2>/dev/null || true)
if [[ -z "$WP_VERSION" ]]; then
  echo "UNKNOWN — Could not parse WordPress version from $VERSION_FILE"
  exit 2
fi
echo "[*] WordPress version: $WP_VERSION"

# Known patched versions (major.minor.patch)
declare -A PATCHED_VERSIONS=(
  ["7.0"]=4  ["6.9"]=7  ["6.8"]=8  ["6.7"]=7
  ["6.6"]=9  ["6.5"]=12 ["6.4"]=10 ["6.3"]=10
  ["6.2"]=10 ["6.1"]=12 ["6.0"]=14 ["5.9"]=14
  ["5.8"]=14 ["5.7"]=14 ["5.6"]=16 ["5.5"]=18
  ["5.4"]=18 ["5.3"]=20 ["5.2"]=23 ["5.1"]=21
  ["5.0"]=22 ["4.9"]=27 ["4.8"]=26 ["4.7"]=35
)

MAJOR_MINOR=$(echo "$WP_VERSION" | grep -oP '^\d+\.\d+')
PATCH=$(echo "$WP_VERSION" | grep -oP '\d+$')

if [[ -n "${PATCHED_VERSIONS[$MAJOR_MINOR]+x}" ]]; then
  NEEDED="${PATCHED_VERSIONS[$MAJOR_MINOR]}"
  if (( PATCH < NEEDED )); then
    echo "[!] WordPress $WP_VERSION is BELOW patched version $MAJOR_MINOR.$NEEDED"
    VULNERABLE=1
  else
    echo "[+] WordPress $WP_VERSION is at or above patched version $MAJOR_MINOR.$NEEDED"
  fi
else
  # Version newer than 7.0 or older than 4.7
  if [[ $(echo -e "7.0.4\n$WP_VERSION" | sort -V | head -1) == "7.0.4" ]]; then
    echo "[+] WordPress $WP_VERSION is newer than 7.0.4"
  else
    echo "[!] WordPress $WP_VERSION may be outside supported patch range"
    VULNERABLE=1
  fi
fi

# --- Check Imagick ---
if php -m 2>/dev/null | grep -qi imagick; then
  echo "[!] PHP Imagick extension is LOADED"
  IMAGICK=1
else
  echo "[+] PHP Imagick extension is NOT loaded (GD likely in use)"
fi

# --- Check Ghostscript ---
if command -v gs &>/dev/null; then
  GS_VER=$(gs --version 2>/dev/null || echo "unknown")
  echo "[!] Ghostscript is INSTALLED (version: $GS_VER)"
  GHOSTSCRIPT=1
else
  echo "[+] Ghostscript is NOT installed"
fi

# --- Verdict ---
echo ""
if (( VULNERABLE == 1 && IMAGICK == 1 && GHOSTSCRIPT == 1 )); then
  echo "VULNERABLE — WordPress $WP_VERSION with Imagick + Ghostscript. All CVE-2026-65640 prerequisites met."
  exit 1
elif (( VULNERABLE == 1 )); then
  if (( IMAGICK == 0 || GHOSTSCRIPT == 0 )); then
    echo "PATCHED (effectively) — WordPress $WP_VERSION is unpatched but missing Imagick and/or Ghostscript. Not currently exploitable."
    exit 0
  fi
else
  echo "PATCHED — WordPress $WP_VERSION is at or above the fixed version."
  exit 0
fi