WordPress Core get_page_template() unauthenticated path traversal to local PHP file inclusion

#!/usr/bin/env bash
# check_cve_2026_87902.sh — Detect CVE-2026-87902 exposure
# Usage: bash check_cve_2026_87902.sh /path/to/wordpress
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

WP_ROOT="${1:-}"
if [[ -z "$WP_ROOT" || ! -d "$WP_ROOT" ]]; then
  echo "UNKNOWN — Usage: $0 /path/to/wordpress"
  exit 2
fi

VERSION_FILE="$WP_ROOT/wp-includes/version.php"
if [[ ! -f "$VERSION_FILE" ]]; then
  echo "UNKNOWN — $VERSION_FILE not found; is this a WordPress installation?"
  exit 2
fi

# Extract WordPress version
WP_VERSION=$(grep -oP "\\\$wp_version\s*=\s*'\K[^']+" "$VERSION_FILE" 2>/dev/null || true)
if [[ -z "$WP_VERSION" ]]; then
  echo "UNKNOWN — could not parse WordPress version from $VERSION_FILE"
  exit 2
fi

echo "[*] WordPress version detected: $WP_VERSION"

# Known fixed versions per branch (security backports)
declare -A FIXED_VERSIONS=(
  ["7.1"]=2 ["7.0"]=6 ["6.9"]=9 ["6.8"]=10 ["6.7"]=9 ["6.6"]=9
  ["6.5"]=12 ["6.4"]=12 ["6.3"]=12 ["6.2"]=13 ["6.1"]=14 ["6.0"]=16
  ["5.9"]=18 ["5.8"]=17 ["5.7"]=19 ["5.6"]=21 ["5.5"]=22 ["5.4"]=23
  ["5.3"]=25 ["5.2"]=28 ["5.1"]=26 ["5.0"]=29 ["4.9"]=33 ["4.8"]=32
  ["4.7"]=37
)

# Parse major.minor and patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$WP_VERSION"
PATCH=${PATCH:-0}
BRANCH="$MAJOR.$MINOR"

# Check if version is >= 7.2 (future, assumed patched)
if (( MAJOR > 7 )) || (( MAJOR == 7 && MINOR >= 2 )); then
  echo "PATCHED — WordPress $WP_VERSION is beyond the affected range."
  exit 0
fi

# Check if version is < 4.7 (not affected per advisory — vuln introduced in 4.7)
if (( MAJOR < 4 )) || (( MAJOR == 4 && MINOR < 7 )); then
  echo "PATCHED — WordPress $WP_VERSION predates the vulnerable code (introduced in 4.7)."
  exit 0
fi

# Look up the fixed patch level for this branch
FIXED_PATCH="${FIXED_VERSIONS[$BRANCH]:-}"
if [[ -z "$FIXED_PATCH" ]]; then
  echo "UNKNOWN — branch $BRANCH not in known-fixed table; verify manually."
  exit 2
fi

VULN=false
if (( PATCH < FIXED_PATCH )); then
  VULN=true
fi

# --- Additional context: check RCE preconditions ---
RCE_RISK=""

# Check for page-* theme directories
THEME_DIR="$WP_ROOT/wp-content/themes"
PAGE_DIR_FOUND=false
if [[ -d "$THEME_DIR" ]]; then
  while IFS= read -r -d '' tdir; do
    theme_name=$(basename "$tdir")
    for subdir in "$tdir"/page-*/; do
      if [[ -d "$subdir" ]]; then
        PAGE_DIR_FOUND=true
        RCE_RISK="${RCE_RISK}  [!] Theme '$theme_name' has directory '$(basename "$subdir")/'\n"
      fi
    done
  done < <(find "$THEME_DIR" -maxdepth 1 -mindepth 1 -type d -print0 2>/dev/null)
fi

# Check register_argc_argv
ARGV_ON=false
ARGV_VAL=$(php -r 'echo ini_get("register_argc_argv");' 2>/dev/null || echo "unknown")
if [[ "$ARGV_VAL" == "1" || "$ARGV_VAL" == "On" || "$ARGV_VAL" == "on" ]]; then
  ARGV_ON=true
fi

# Check for pearcmd.php
PEAR_FOUND=false
for p in /usr/local/lib/php/pearcmd.php /usr/share/php/pearcmd.php /usr/lib/php/pearcmd.php; do
  if [[ -r "$p" ]]; then
    PEAR_FOUND=true
    PEAR_PATH="$p"
    break
  fi
done

if $VULN; then
  echo "VULNERABLE — WordPress $WP_VERSION is below fixed version $BRANCH.$FIXED_PATCH for CVE-2026-87902."
  echo ""
  echo "[*] RCE precondition check:"
  if $PAGE_DIR_FOUND; then
    echo -e "$RCE_RISK"
  else
    echo "  [OK] No page-* theme directories found (RCE theme condition NOT met)."
  fi
  if $ARGV_ON; then
    echo "  [!] register_argc_argv is ON — RCE PHP condition met."
  else
    echo "  [OK] register_argc_argv is OFF — RCE PHP condition not met."
  fi
  if $PEAR_FOUND; then
    echo "  [!] pearcmd.php found at $PEAR_PATH — RCE gadget present."
  else
    echo "  [OK] pearcmd.php not found in common paths — RCE gadget absent."
  fi
  if $PAGE_DIR_FOUND && $ARGV_ON && $PEAR_FOUND; then
    echo ""
    echo "  >>> ALL THREE RCE CONDITIONS MET — FULL RCE IS POSSIBLE <<<"
  elif $PAGE_DIR_FOUND || $ARGV_ON || $PEAR_FOUND; then
    echo ""
    echo "  >>> PARTIAL RCE conditions met — LFI is still exploitable. Patch urgently. <<<"
  else
    echo ""
    echo "  >>> RCE conditions not met, but LFI is still exploitable. Patch required. <<<"
  fi
  exit 1
else
  echo "PATCHED — WordPress $WP_VERSION is at or above the fixed version ($BRANCH.$FIXED_PATCH) for CVE-2026-87902."
  exit 0
fi