WP Maps Pro unauthenticated administrator account creation via temporary access AJAX handler

#!/usr/bin/env bash
# check_wp_maps_pro.sh
# Detects whether WP Maps Pro (wp-google-map-gold) is vulnerable to CVE-2026-8732.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

if [ "$#" -ne 1 ]; then
  echo "Usage: $0 /path/to/wordpress"
  echo "UNKNOWN"
  exit 2
fi

WP_ROOT="$1"
PLUGIN_DIR="$WP_ROOT/wp-content/plugins/wp-google-map-gold"

if [ ! -d "$PLUGIN_DIR" ]; then
  echo "UNKNOWN - plugin directory not found: $PLUGIN_DIR"
  echo "UNKNOWN"
  exit 2
fi

find_main_php() {
  local dir="$1"
  local f
  while IFS= read -r -d '' f; do
    if grep -Eiq '^[[:space:]]*Plugin Name:[[:space:]]*WP Maps Pro' "$f" 2>/dev/null; then
      echo "$f"
      return 0
    fi
  done < <(find "$dir" -maxdepth 2 -type f -name '*.php' -print0 2>/dev/null)

  # Fallbacks for common filenames
  for f in "$dir/wp-google-map-gold.php" "$dir/wp-google-map-pro.php" "$dir/index.php"; do
    if [ -f "$f" ]; then
      echo "$f"
      return 0
    fi
  done

  # Last resort: first PHP file
  find "$dir" -maxdepth 2 -type f -name '*.php' 2>/dev/null | head -n 1
}

version_lte() {
  # returns 0 if $1 <= $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

MAIN_PHP="$(find_main_php "$PLUGIN_DIR")"
VERSION=""
if [ -n "$MAIN_PHP" ] && [ -f "$MAIN_PHP" ]; then
  VERSION="$(grep -Eim1 '^[[:space:]]*Version:[[:space:]]*' "$MAIN_PHP" | sed -E 's/^[[:space:]]*Version:[[:space:]]*//I' | tr -d '\r')"
fi

# Look for the patch condition added by vendor.
HAS_FIX=0
if grep -RqsE "current_user_can\s*\(\s*['\"]manage_options['\"]\s*\)" "$PLUGIN_DIR"; then
  HAS_FIX=1
fi

if [ -n "$VERSION" ]; then
  echo "Detected version: $VERSION"
else
  echo "Detected version: unknown"
fi

echo "Authorization fix present: $HAS_FIX"

if [ "$HAS_FIX" -eq 1 ]; then
  echo "PATCHED"
  exit 0
fi

if [ -n "$VERSION" ]; then
  if version_lte "$VERSION" "6.1.0"; then
    echo "VULNERABLE"
    exit 1
  else
    echo "PATCHED"
    exit 0
  fi
fi

echo "UNKNOWN - could not determine version and fix string not found"
echo "UNKNOWN"
exit 2