# WordPress patches RCE chain, PoC public

Published: 2026-07-20 · Severity: high · Sectors: technology
Canonical: https://vorant.io/reports/6c585812-3651-507a-a94a-7a9311e739d4/wordpress-patches-rce-chain-poc-public

> Multiple WordPress vulnerabilities, combinable for unauthenticated remote code execution, have a public proof-of-concept and are fixed in version 7.0.2.

ANSSI's CERT-FR issued an advisory covering multiple vulnerabilities in WordPress core affecting versions 6.8.x prior to 6.8.6, 6.9.x prior to 6.9.5, 7.1.x prior to 7.1 beta2, and 7.x prior to 7.0.2. The flaws include a SQL injection issue and a security-restriction bypass; the vendor confirms that on 6.9.x and later, combined exploitation of these two vulnerabilities allows an unauthenticated attacker to achieve remote code execution.

CERT-FR notes that a public proof-of-concept exists for this exploit chain, increasing the likelihood of opportunistic exploitation given WordPress's widespread use across websites of all sectors. Administrators are advised to apply the vendor's July 17, 2026 security release (WordPress 7.0.2) as referenced in the official WordPress bulletin without delay.

## Mentioned in this report

- Vulnerabilities: CVE-2026-60137 (KEV), CVE-2026-63030 (KEV)

## Detection guidance (public sample)

### Web Server Process Spawning Command Shell (Possible WordPress RCE)

ATT&CK: T1190

Detects a web server or PHP worker process (Apache, Nginx, PHP-FPM, IIS) spawning a shell/interpreter, consistent with successful exploitation of an unauthenticated RCE chain in a web application such as WordPress. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Spawning Command Shell
description: Detects httpd/nginx/php-fpm/w3wp worker processes spawning a command
  interpreter or scripting engine, a strong indicator of successful remote code execution
  against a web application (e.g. the WordPress SQLi + restriction-bypass RCE chain).
  Web servers do not normally spawn interactive shells as part of legitimate request
  handling.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \httpd.exe
    - \nginx.exe
    - \php-cgi.exe
    - \php-fpm.exe
    - \w3wp.exe
    - \apache2
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \sh
    - \bash
    - \wget
    - \curl
  filter_known_admin:
    CommandLine|contains:
    - logrotate
    - healthcheck
  condition: selection and not filter_known_admin
falsepositives:
- Legitimate CGI scripts or admin health-check scripts that shell out from the web
  server process
- Custom web application code that intentionally invokes system utilities (should
  be reviewed and allow-listed)
level: high
id: af49de9d-80cd-5878-a6a4-00857d6d5efb
status: experimental
author: Vorant
```

### PHP Web Shell File Dropped in WordPress Uploads or Content Directory

ATT&CK: T1505.003

Detects creation of a new PHP script inside WordPress writable directories (uploads, plugins, themes) following exploitation, a common step to establish a persistent web shell after a WordPress RCE chain is exploited. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PHP File Created in WordPress Uploads or Content Directory
description: Detects creation of .php files inside wp-content/uploads or other normally
  non-executable WordPress content directories. This directory should only ever contain
  media/static assets, so new PHP files here are a strong indicator of a web shell
  dropped via a successful RCE exploit chain (e.g. the WordPress SQLi + restriction-bypass
  chain).
tags:
- attack.persistence
- attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains: /wp-content/uploads/
    TargetFilename|endswith:
    - .php
    - .phtml
    - .php5
  filter_plugin_install:
    TargetFilename|contains: /wp-content/uploads/wc-logs/
  condition: selection and not filter_plugin_install
falsepositives:
- Legitimate plugins that store PHP cache or template files under uploads (rare and
  should be baselined)
- Site migration tools that copy PHP files into uploads temporarily
level: high
id: 4d8b06e2-64d0-5223-87e8-a3acc4df5df8
status: experimental
author: Vorant
```

### PHP Process Executing Reconnaissance or Download Commands Post-Exploitation

ATT&CK: T1190

Detects a PHP interpreter (typical of a dropped web shell) directly executing recon or download utilities, indicating post-exploitation activity following an unauthenticated RCE against a CMS such as WordPress. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PHP Interpreter Executing System Recon or Download Utilities
description: Detects php or php-fpm processes launching system recon commands (whoami,
  id, uname) or download utilities (curl, wget) as child processes. This pattern is
  typical of a web shell executing attacker-supplied commands after successful exploitation
  of a web application RCE chain such as the WordPress SQLi + restriction-bypass vulnerability.
tags:
- attack.discovery
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /php
    - /php-fpm
    - /php-cgi
    Image|endswith:
    - /whoami
    - /id
    - /uname
    - /curl
    - /wget
  filter_cron_maintenance:
    CommandLine|contains: /etc/cron
  condition: selection and not filter_cron_maintenance
falsepositives:
- Custom PHP application code that legitimately shells out to system utilities for
  diagnostics
- Monitoring or health-check scripts implemented in PHP that call uname/whoami
level: medium
id: 2aa4197b-486e-5712-8384-8e104f22e563
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0904

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6c585812-3651-507a-a94a-7a9311e739d4/wordpress-patches-rce-chain-poc-public.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup