WordPress patches RCE chain, PoC public
Multiple WordPress vulnerabilities, combinable for unauthenticated remote code execution, have a public proof-of-concept and are fixed in version 7.0.2.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-60137 and CVE-2026-63030 as exploited in the wild.
ANSSI's CERT-FR issued an advisory covering multiple vulnerabilities in WordPress core affecting versions 6.8.x prior to 6.8.6, 6.9.x prior to 6.9.5, 7.1.x prior to 7.1 beta2, and 7.x prior to 7.0.2. The flaws include a SQL injection issue and a security-restriction bypass; the vendor confirms that on 6.9.x and later, combined exploitation of these two vulnerabilities allows an unauthenticated attacker to achieve remote code execution.
CERT-FR notes that a public proof-of-concept exists for this exploit chain, increasing the likelihood of opportunistic exploitation given WordPress's widespread use across websites of all sectors. Administrators are advised to apply the vendor's July 17, 2026 security release (WordPress 7.0.2) as referenced in the official WordPress bulletin without delay.
Mentioned in this report
Detection guidance
Web Server Process Spawning Command Shell (Possible WordPress RCE)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web server or PHP worker process (Apache, Nginx, PHP-FPM, IIS) spawning a shell/interpreter, consistent with successful exploitation of an unauthenticated RCE chain in a web application such as WordPress. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Command Shell
description: Detects httpd/nginx/php-fpm/w3wp worker processes spawning a command
interpreter or scripting engine, a strong indicator of successful remote code execution
against a web application (e.g. the WordPress SQLi + restriction-bypass RCE chain).
Web servers do not normally spawn interactive shells as part of legitimate request
handling.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \httpd.exe
- \nginx.exe
- \php-cgi.exe
- \php-fpm.exe
- \w3wp.exe
- \apache2
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \sh
- \bash
- \wget
- \curl
filter_known_admin:
CommandLine|contains:
- logrotate
- healthcheck
condition: selection and not filter_known_admin
falsepositives:
- Legitimate CGI scripts or admin health-check scripts that shell out from the web
server process
- Custom web application code that intentionally invokes system utilities (should
be reviewed and allow-listed)
level: high
id: af49de9d-80cd-5878-a6a4-00857d6d5efb
status: experimental
author: Vorant
PHP Web Shell File Dropped in WordPress Uploads or Content Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of a new PHP script inside WordPress writable directories (uploads, plugins, themes) following exploitation, a common step to establish a persistent web shell after a WordPress RCE chain is exploited. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP File Created in WordPress Uploads or Content Directory
description: Detects creation of .php files inside wp-content/uploads or other normally
non-executable WordPress content directories. This directory should only ever contain
media/static assets, so new PHP files here are a strong indicator of a web shell
dropped via a successful RCE exploit chain (e.g. the WordPress SQLi + restriction-bypass
chain).
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains: /wp-content/uploads/
TargetFilename|endswith:
- .php
- .phtml
- .php5
filter_plugin_install:
TargetFilename|contains: /wp-content/uploads/wc-logs/
condition: selection and not filter_plugin_install
falsepositives:
- Legitimate plugins that store PHP cache or template files under uploads (rare and
should be baselined)
- Site migration tools that copy PHP files into uploads temporarily
level: high
id: 4d8b06e2-64d0-5223-87e8-a3acc4df5df8
status: experimental
author: Vorant
PHP Process Executing Reconnaissance or Download Commands Post-Exploitation
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a PHP interpreter (typical of a dropped web shell) directly executing recon or download utilities, indicating post-exploitation activity following an unauthenticated RCE against a CMS such as WordPress. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP Interpreter Executing System Recon or Download Utilities
description: Detects php or php-fpm processes launching system recon commands (whoami,
id, uname) or download utilities (curl, wget) as child processes. This pattern is
typical of a web shell executing attacker-supplied commands after successful exploitation
of a web application RCE chain such as the WordPress SQLi + restriction-bypass vulnerability.
tags:
- attack.discovery
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /php
- /php-fpm
- /php-cgi
Image|endswith:
- /whoami
- /id
- /uname
- /curl
- /wget
filter_cron_maintenance:
CommandLine|contains: /etc/cron
condition: selection and not filter_cron_maintenance
falsepositives:
- Custom PHP application code that legitimately shells out to system utilities for
diagnostics
- Monitoring or health-check scripts implemented in PHP that call uname/whoami
level: medium
id: 2aa4197b-486e-5712-8384-8e104f22e563
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0904
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs