Kirki Freeform Page Builder Unauthenticated Privilege Escalation via Password Reset Hijacking

#!/usr/bin/env bash
# CVE-2026-8206 Checker — Kirki WordPress Plugin Privilege Escalation
# Usage: bash check_cve_2026_8206.sh <wordpress_path_or_url>
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

TARGET="${1:-}"
if [ -z "$TARGET" ]; then
  echo "Usage: $0 <wordpress_path_or_url>"
  echo "  Local:  $0 /var/www/html/wordpress"
  echo "  Remote: $0 https://example.com"
  exit 2
fi

# --- Local file-based check ---
if [[ ! "$TARGET" =~ ^https?:// ]]; then
  PLUGIN_DIR="$TARGET/wp-content/plugins/kirki"
  
  if [ ! -d "$PLUGIN_DIR" ]; then
    echo "[UNKNOWN] Kirki plugin not found at $PLUGIN_DIR"
    exit 2
  fi
  
  # Check version from readme.txt or kirki.php
  VERSION=""
  if [ -f "$PLUGIN_DIR/readme.txt" ]; then
    VERSION=$(grep -i 'Stable tag:' "$PLUGIN_DIR/readme.txt" | head -1 | sed 's/.*: *//;s/[[:space:]]*$//')
  fi
  if [ -z "$VERSION" ] && [ -f "$PLUGIN_DIR/kirki.php" ]; then
    VERSION=$(grep -i 'Version:' "$PLUGIN_DIR/kirki.php" | head -1 | sed 's/.*: *//;s/[[:space:]]*$//')
  fi
  
  if [ -z "$VERSION" ]; then
    echo "[UNKNOWN] Could not determine Kirki version"
    exit 2
  fi
  
  echo "Detected Kirki version: $VERSION"
  
  # Parse major.minor.patch
  IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"
  PATCH=${PATCH:-0}
  
  if [ "$MAJOR" -lt 6 ] 2>/dev/null; then
    echo "[PATCHED] Version $VERSION is below 6.0.0 (not affected)"
    exit 0
  elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 0 ] && [ "$PATCH" -le 6 ] 2>/dev/null; then
    echo "[VULNERABLE] Kirki $VERSION is affected by CVE-2026-8206"
    echo "  Upgrade to 6.0.7 or later immediately."
    
    # Additional check: verify vulnerable code pattern
    HANDLER="$PLUGIN_DIR/ComponentLibrary/controller/CompLibFormHandler.php"
    if [ -f "$HANDLER" ]; then
      if grep -q 'user_email' "$HANDLER" && grep -q 'email.*!==.*user_email' "$HANDLER"; then
        echo "  NOTE: Patch code pattern detected in source — may be a backport. Verify manually."
      else
        echo "  CONFIRMED: Vulnerable code pattern present (no email validation in handler)."
      fi
    fi
    exit 1
  else
    echo "[PATCHED] Kirki $VERSION is 6.0.7 or later (fixed)"
    exit 0
  fi
fi

# --- Remote endpoint check ---
URL="${TARGET%/}"
echo "Checking $URL remotely..."

# Check if plugin is present via readme.txt
HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' --max-time 10 "$URL/wp-content/plugins/kirki/readme.txt" 2>/dev/null || echo "000")
if [ "$HTTP_CODE" = "000" ] || [ "$HTTP_CODE" = "404" ]; then
  echo "[UNKNOWN] Kirki plugin not detected at $URL (readme.txt returned $HTTP_CODE)"
  exit 2
fi

# Try to extract version from readme.txt
VERSION=$(curl -s --max-time 10 "$URL/wp-content/plugins/kirki/readme.txt" 2>/dev/null | grep -i 'Stable tag:' | head -1 | sed 's/.*: *//;s/[[:space:]]*$//')
if [ -z "$VERSION" ]; then
  echo "[UNKNOWN] Could not extract Kirki version from readme.txt"
  exit 2
fi

echo "Detected Kirki version: $VERSION"
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"
PATCH=${PATCH:-0}

if [ "$MAJOR" -lt 6 ] 2>/dev/null; then
  echo "[PATCHED] Version $VERSION is below 6.0.0 (not affected)"
  exit 0
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 0 ] && [ "$PATCH" -le 6 ] 2>/dev/null; then
  echo "[VULNERABLE] Kirki $VERSION at $URL is affected by CVE-2026-8206"
  echo "  Upgrade to 6.0.7 or later immediately."
  
  # Check if endpoint is reachable (do NOT send exploit payload)
  EP_CODE=$(curl -s -o /dev/null -w '%{http_code}' --max-time 10 "$URL/wp-json/kirki/v1/kirki-forgot-password" 2>/dev/null || echo "000")
  if [ "$EP_CODE" != "404" ] && [ "$EP_CODE" != "000" ]; then
    echo "  WARNING: Vulnerable REST endpoint is reachable (HTTP $EP_CODE). Exploit is trivial."
  fi
  exit 1
else
  echo "[PATCHED] Kirki $VERSION is 6.0.7 or later (fixed)"
  exit 0
fi