#!/usr/bin/env python3
"""
Scanner for CVE-2026-82970 – WP Cookie Notice Arbitrary File Upload.
Detects vulnerable WordPress sites by checking for the plugin and REST endpoint.
"""

import argparse
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

REST_ENDPOINT = "/wp-json/wplp-react-gdpr/v1/upload-logo"
PLUGIN_README = "/wp-content/plugins/gdpr-cookie-consent/readme.txt"

def check_plugin_readme(base):
    try:
        r = requests.get(f"{base}{PLUGIN_README}", timeout=8, verify=False)
        if r.status_code == 200:
            text = r.text.lower()
            if "gdpr" in text or "cookie consent" in text:
                return True
    except:
        pass
    return False

def check_rest_endpoint(base):
    try:
        r = requests.get(f"{base}{REST_ENDPOINT}", timeout=8, verify=False)
        # 405/200/403 indicates route exists; 404 means not present
        return r.status_code != 404
    except:
        return False

def scan(target):
    base = target.rstrip('/')
    print(f"[*] {base}")
    plugin = check_plugin_readme(base)
    endpoint = check_rest_endpoint(base)

    if plugin:
        print("    [+] Plugin detected (readme.txt found)")
    else:
        print("    [-] Plugin readme not found")

    if endpoint:
        print(f"    [+] REST endpoint reachable: {REST_ENDPOINT}")
    else:
        print("    [-] REST endpoint not found")
        return False

    if plugin or endpoint:
        print("    [*] Target is likely vulnerable to CVE-2026-82970")
        return True
    else:
        print("    [*] Target does not appear vulnerable")
        return False

def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("targets", help="File with one URL per line")
    args = parser.parse_args()

    with open(args.targets) as f:
        targets = [line.strip() for line in f if line.strip()]

    for t in targets:
        scan(t)

if __name__ == "__main__":
    main()