remove-wp-toolkit.sh

#!/bin/bash
# /root/remove-wp-toolkit.sh

printf "Removing cPanel WordPress Toolkit infection from customer sites\n"

if [[ $EUID -ne 0 ]]; then
   printf "[Error] This script must be run as root.\n"
   exit 1
fi

consent=0
consent_message="[Modification skipped. Run again with option \"--consent\" you accept this modification."

if [[ -n "$1" ]] && [[ $1 == "--consent" ]]; then
    printf "[Warning] Consent to modify has been specified.\n"
    consent=1
fi



printf "\n\n\nScanning user home folders...\n"

for user_home_root in $(find /home/ -maxdepth 1 -type d ! -path /home/ | sort); do
    user_name=$(basename "${user_home_root}")
    printf "\nScanning user ${user_name} at path \"${user_home_root}\":\n"

    if [ -d "${user_home_root}/.wp-toolkit/" ]; then
        printf " - Removed \"/.wp-toolkit/\"\n"

        if [ $consent -ge 1 ]; then
            rm -rf "${user_home_root}/.wp-toolkit/"
        else
            echo $consent_message
        fi
    fi

    if [ -f "${user_home_root}/.wp-toolkit-identifier" ]; then
        printf " - Removed \"/.wp-toolkit-identifier\"\n"

        if [ $consent -ge 1 ]; then
            rm -f "${user_home_root}/.wp-toolkit-identifier"
        else
            echo $consent_message
        fi
    fi

    if [ -d "${user_home_root}/wordpress-backups/" ]; then
        printf " - Removed \"/wordpress-backups/\"\n"

        if [ $consent -ge 1 ]; then
            rm -rf "${user_home_root}/wordpress-backups/"
        else
            echo $consent_message
        fi
    fi
done



printf "\n\n\nScanning WordPress installations in user sites...\n"

for site_htdocs_root in $(cat /etc/userdatadomains | cut -d"=" -f9 | sort); do
    if [ ! -f "${site_htdocs_root}/wp-config.php" ]; then
        continue; # If this file is present then we likely don't have a WordPress installation
    fi

    printf "\nScanning site at path \"${site_htdocs_root}\":\n"

    if grep -q "define('WP_AUTO_UPDATE_CORE', 'minor');// This setting is required to make sure that WordPress updates can be properly managed in WordPress Toolkit. Remove this line if this WordPress website is not managed by WordPress Toolkit anymore." "${site_htdocs_root}/wp-config.php"; then
        printf " - Cleaned \"/wp-config.php\"\n"

        if [ $consent -ge 1 ]; then
            sed -e "${site_htdocs_root}/wp-config.php" -i "s|define('WP_AUTO_UPDATE_CORE', 'minor');// This setting is required to make sure that WordPress updates can be properly managed in WordPress Toolkit. Remove this line if this WordPress website is not managed by WordPress Toolkit anymore.||g"
        else
            echo $consent_message
        fi
    fi

    if [ -d "${site_htdocs_root}/wp-content/maintenance/" ]; then
        printf " - Removed \"/wp-content/maintenance/\"\n"

        if [ $consent -ge 1 ]; then
            rm -rf "${site_htdocs_root}/wp-content/maintenance/"
        else
            echo $consent_message
        fi
    fi

    if [ -f "${site_htdocs_root}/wp-content/maintenance.php" ]; then
        printf " - Removed \"/wp-content/maintenance.php\"\n"

        if [ $consent -ge 1 ]; then
            rm -rf "${site_htdocs_root}/wp-content/maintenance.php"
        else
            echo $consent_message
        fi
    fi
done



exit 0