#!/bin/bash
# wp-user-audit.sh
# No root/sudo required — run as the normal site user
# Usage: ./wp-user-audit.sh /path/to/wordpress

WP_PATH="${1:-.}"
REPORT="$HOME/wp-user-audit-$(date +%Y%m%d-%H%M%S).txt"

cd "$WP_PATH" || { echo "Can't cd into $WP_PATH — check the path"; exit 1; }

# Sanity check: is this actually a WP install and is wp-cli available?
if ! command -v wp &> /dev/null; then
    echo "wp-cli not found. Ask your host if it's installed, or install it to your home dir without root:"
    echo "  curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar"
    echo "  chmod +x wp-cli.phar && mv wp-cli.phar ~/bin/wp   # ~/bin must be in your PATH"
    exit 1
fi

{
echo "================================================================"
echo "WordPress User Security Audit"
echo "Generated: $(date)"
echo "Path: $(pwd)"
echo "================================================================"

echo ""
echo "### [1] User list via WP-CLI ###"
wp user list --fields=ID,user_login,user_email,user_registered,roles --format=table

echo ""
echo "### [2] Row count comparison (WP-CLI vs raw DB) ###"
echo -n "WP-CLI count: "
wp user list --format=count
echo -n "Raw DB count: "
wp db query "SELECT COUNT(*) FROM wp_users;"

echo ""
echo "### [3] Raw wp_users table dump ###"
wp db query "SELECT ID, user_login, user_email, user_registered, display_name FROM wp_users ORDER BY ID ASC;"

echo ""
echo "### [4] All wp_capabilities entries ###"
wp db query "SELECT user_id, meta_value FROM wp_usermeta WHERE meta_key = 'wp_capabilities';"

echo ""
echo "### [5] Users WP-CLI reports as administrators ###"
wp user list --role=administrator --fields=ID,user_login

echo ""
echo "### [6] Non-standard capability meta_keys ###"
wp db query "SELECT DISTINCT meta_key FROM wp_usermeta WHERE meta_key LIKE '%capabilities';"

echo ""
echo "### [7] Username hex dump (hidden/non-printable chars) ###"
wp db query "SELECT ID, user_login, HEX(user_login) FROM wp_users;"

echo ""
echo "### [8] Application passwords issued ###"
wp db query "SELECT user_id, meta_value FROM wp_usermeta WHERE meta_key = '_application_passwords';"

echo ""
echo "### [9] Most recently created users ###"
wp user list --orderby=registered --order=desc --fields=ID,user_login,user_registered --format=table

echo ""
echo "### [10] Cron events ###"
wp cron event list

echo ""
echo "### [11] Suspicious hooks in theme/plugin/mu-plugin files (readable files only) ###"
grep -rln "pre_get_users\|users_pre_query\|views_users\|manage_users_columns" wp-content/themes wp-content/plugins wp-content/mu-plugins 2>/dev/null

echo ""
echo "### [12] Cron/persistence-related code ###"
grep -rln "add_action('wp_loaded'\|wp_schedule_event" wp-content/mu-plugins wp-content/plugins wp-content/themes 2>/dev/null

echo ""
echo "### [13] mu-plugins directory listing ###"
ls -la wp-content/mu-plugins/ 2>/dev/null || echo "(not readable or doesn't exist)"

echo ""
echo "================================================================"
echo "Audit complete."
echo "================================================================"

} > "$REPORT" 2>&1

echo "Report saved to: $REPORT"