The Grid WordPress Plugin Unauthenticated Code Injection / RCE

#!/usr/bin/env bash
# check_the_grid.sh — CVE-2026-94169 checker for The Grid WordPress plugin
# Usage: bash check_the_grid.sh <wordpress_site_url>
# Exit codes: 0 = VULNERABLE, 1 = PATCHED, 2 = UNKNOWN (plugin not detected)

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <wordpress_site_url>"
  echo "Example: $0 https://example.com"
  exit 2
fi

TARGET="${1%/}"
PLUGIN_PATH="/wp-content/plugins/the-grid"
README_URL="${TARGET}${PLUGIN_PATH}/readme.txt"
STYLE_URL="${TARGET}${PLUGIN_PATH}/frontend/css/the-grid.css"
FIXED_VERSION="2.8.2"

echo "[*] Checking for The Grid plugin at: ${TARGET}"
echo ""

# Try readme.txt first (most plugins expose this)
HTTP_CODE=$(curl -s -o /tmp/tg_readme.txt -w "%{http_code}" -L --max-time 10 "${README_URL}" 2>/dev/null || echo "000")

if [ "$HTTP_CODE" = "200" ]; then
  # Extract stable tag / version from readme.txt
  VERSION=$(grep -i '^Stable tag:' /tmp/tg_readme.txt 2>/dev/null | head -1 | sed 's/[Ss]table [Tt]ag:[[:space:]]*//' | tr -d '[:space:]')
  if [ -n "$VERSION" ]; then
    echo "[+] The Grid plugin DETECTED — version: ${VERSION}"
    # Compare versions
    if printf '%s\n' "$FIXED_VERSION" "$VERSION" | sort -V | head -1 | grep -q "^${FIXED_VERSION}$"; then
      # FIXED_VERSION sorts first or equal, meaning VERSION >= FIXED_VERSION
      if [ "$VERSION" = "$FIXED_VERSION" ] || [ "$(printf '%s\n' "$FIXED_VERSION" "$VERSION" | sort -V | tail -1)" = "$VERSION" ]; then
        echo "[PATCHED] Version ${VERSION} >= ${FIXED_VERSION}. CVE-2026-94169 is fixed."
        rm -f /tmp/tg_readme.txt
        exit 1
      fi
    fi
    echo "[VULNERABLE] Version ${VERSION} < ${FIXED_VERSION}. CVE-2026-94169 applies!"
    echo "    -> Update to The Grid >= 2.8.2 immediately."
    rm -f /tmp/tg_readme.txt
    exit 0
  fi
fi

# Fallback: check if plugin directory is accessible
DIR_CODE=$(curl -s -o /dev/null -w "%{http_code}" -L --max-time 10 "${TARGET}${PLUGIN_PATH}/" 2>/dev/null || echo "000")
CSS_CODE=$(curl -s -o /dev/null -w "%{http_code}" -L --max-time 10 "${STYLE_URL}" 2>/dev/null || echo "000")

if [ "$DIR_CODE" = "200" ] || [ "$DIR_CODE" = "403" ] || [ "$CSS_CODE" = "200" ]; then
  echo "[!] The Grid plugin appears to be INSTALLED (directory/assets detected)"
  echo "    but version could not be determined from readme.txt."
  echo "[UNKNOWN] Manually verify: wp plugin list --path=/path/to/wp | grep the-grid"
  rm -f /tmp/tg_readme.txt
  exit 2
fi

echo "[-] The Grid plugin NOT DETECTED on ${TARGET}"
echo "[UNKNOWN] Plugin does not appear to be installed."
rm -f /tmp/tg_readme.txt
exit 2