WordPress patches RCE chain, PoC public
Multiple WordPress vulnerabilities, combinable for unauthenticated remote code execution, have a public proof-of-concept and are fixed in version 7.0.2.
ANSSI's CERT-FR issued an advisory covering multiple vulnerabilities in WordPress core affecting versions 6.8.x prior to 6.8.6, 6.9.x prior to 6.9.5, 7.1.x prior to 7.1 beta2, and 7.x prior to 7.0.2. The flaws include a SQL injection issue and a security-restriction bypass; the vendor confirms that on 6.9.x and later, combined exploitation of these two vulnerabilities allows an unauthenticated attacker to achieve remote code execution.
CERT-FR notes that a public proof-of-concept exists for this exploit chain, increasing the likelihood of opportunistic exploitation given WordPress's widespread use across websites of all sectors. Administrators are advised to apply the vendor's July 17, 2026 security release (WordPress 7.0.2) as referenced in the official WordPress bulletin without delay.
Mentioned in this report
Detection guidance
Web Server Process Spawning Command Shell (Possible WordPress RCE)
Detects a web server or PHP worker process (Apache, Nginx, PHP-FPM, IIS) spawning a shell/interpreter, consistent with successful exploitation of an unauthenticated RCE chain in a web application such as WordPress. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Command Shell
description: Detects httpd/nginx/php-fpm/w3wp worker processes spawning a command
interpreter or scripting engine, a strong indicator of successful remote code execution
against a web application (e.g. the WordPress SQLi + restriction-bypass RCE chain).
Web servers do not normally spawn interactive shells as part of legitimate request
handling.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \httpd.exe
- \nginx.exe
- \php-cgi.exe
- \php-fpm.exe
- \w3wp.exe
- \apache2
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \sh
- \bash
- \wget
- \curl
filter_known_admin:
CommandLine|contains:
- logrotate
- healthcheck
condition: selection and not filter_known_admin
falsepositives:
- Legitimate CGI scripts or admin health-check scripts that shell out from the web
server process
- Custom web application code that intentionally invokes system utilities (should
be reviewed and allow-listed)
level: high
id: af49de9d-80cd-5878-a6a4-00857d6d5efb
status: experimental
author: Vorant
PHP Web Shell File Dropped in WordPress Uploads or Content Directory
Detects creation of a new PHP script inside WordPress writable directories (uploads, plugins, themes) following exploitation, a common step to establish a persistent web shell after a WordPress RCE chain is exploited. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP File Created in WordPress Uploads or Content Directory
description: Detects creation of .php files inside wp-content/uploads or other normally
non-executable WordPress content directories. This directory should only ever contain
media/static assets, so new PHP files here are a strong indicator of a web shell
dropped via a successful RCE exploit chain (e.g. the WordPress SQLi + restriction-bypass
chain).
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains: /wp-content/uploads/
TargetFilename|endswith:
- .php
- .phtml
- .php5
filter_plugin_install:
TargetFilename|contains: /wp-content/uploads/wc-logs/
condition: selection and not filter_plugin_install
falsepositives:
- Legitimate plugins that store PHP cache or template files under uploads (rare and
should be baselined)
- Site migration tools that copy PHP files into uploads temporarily
level: high
id: 4d8b06e2-64d0-5223-87e8-a3acc4df5df8
status: experimental
author: Vorant
PHP Process Executing Reconnaissance or Download Commands Post-Exploitation
Detects a PHP interpreter (typical of a dropped web shell) directly executing recon or download utilities, indicating post-exploitation activity following an unauthenticated RCE against a CMS such as WordPress. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP Interpreter Executing System Recon or Download Utilities
description: Detects php or php-fpm processes launching system recon commands (whoami,
id, uname) or download utilities (curl, wget) as child processes. This pattern is
typical of a web shell executing attacker-supplied commands after successful exploitation
of a web application RCE chain such as the WordPress SQLi + restriction-bypass vulnerability.
tags:
- attack.discovery
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /php
- /php-fpm
- /php-cgi
Image|endswith:
- /whoami
- /id
- /uname
- /curl
- /wget
filter_cron_maintenance:
CommandLine|contains: /etc/cron
condition: selection and not filter_cron_maintenance
falsepositives:
- Custom PHP application code that legitimately shells out to system utilities for
diagnostics
- Monitoring or health-check scripts implemented in PHP that call uname/whoami
level: medium
id: 2aa4197b-486e-5712-8384-8e104f22e563
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0904
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free