Critical Avada WordPress Theme Flaw Enables Unauthenticated Zero-Click RCE — Detection, Hunting, and Remediation Guide

---
title: PHP File Created in WordPress Uploads Directory
id: 3f8a1c74-9b2d-4e6a-a1c3-5d7e9f0b2a4c
status: experimental
description: Detects creation of PHP files in WordPress uploads directories, a hallmark of web shell deployment following exploitation of WordPress theme/plugin vulnerabilities such as the Avada unauthenticated RCE chain.
references:
  - https://www.bleepingcomputer.com/news/security/critical-avada-wordpress-theme-flaw-enables-zero-click-rce/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/09
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/wp-content/uploads/'
      - '/wp-content/themes/'
      - '/wp-content/plugins/'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php5'
      - '.php7'
  filter_plugin_installs:
    TargetFilename|contains:
      - '/wp-content/plugins/'
    TargetFilename|endswith: '.php'
  condition: selection and not filter_plugin_installs
falsepositives:
  - Legitimate plugin or theme installations/updates writing PHP files under wp-content/plugins and wp-content/themes — uploads directory hits are almost never legitimate
level: high
---
title: Web Server or PHP-FPM Spawning Shell or Interpreter
id: 8c2e5b61-4d7a-4f39-b8e2-6a1d3c5f7b9e
status: experimental
description: Detects web server or PHP-FPM worker processes spawning interactive shells or script interpreters, consistent with post-exploitation activity after PHP code execution on a WordPress host (e.g., via the Avada theme vulnerability chain).
references:
  - https://www.bleepingcomputer.com/news/security/critical-avada-wordpress-theme-flaw-enables-zero-click-rce/
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/01/09
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/lsphp'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Backup plugins, cache plugins, or server management panels that legitimately invoke curl/wget or shell utilities — baseline per-host and exclude known tooling by full CommandLine
level: critical
---
title: HTTP Request to PHP File Under WordPress Uploads
id: 5d9f3a28-7e1b-4c56-9d34-8b2e4a6c1f7d
status: experimental
description: Detects inbound web requests for PHP files beneath wp-content/uploads, indicating attempted access to an uploaded web shell on a WordPress site. Uploads directories should never serve executable PHP.
references:
  - https://www.bleepingcomputer.com/news/security/critical-avada-wordpress-theme-flaw-enables-zero-click-rce/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/09
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: '/wp-content/uploads/'
    cs-uri-stem|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
  condition: selection
falsepositives:
  - Misconfigured plugins that store PHP in uploads (rare); investigate any hit rather than tuning broadly
level: high

// Hunt: PHP files created in wp-content/uploads or web server spawning shells (Linux hosts via Syslog/auditd ingestion into Sentinel)
let Lookback = 14d;
let SuspiciousChildren = dynamic(["/bin/sh","/bin/bash","/bin/dash","/usr/bin/python3","/usr/bin/perl","/usr/bin/curl","/usr/bin/wget","/bin/nc"]);
let WebParents = dynamic(["apache2","httpd","nginx","php-fpm","lsphp"]);
Syslog
| where TimeGenerated >= Lookback
| where ProcessName in~ (WebParents) or SyslogMessage has_any ("php-fpm", "apache2", "nginx")
| where SyslogMessage has_any (SuspiciousChildren)
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;
// Hunt: Web access log requests for PHP under uploads (via CommonSecurityLog / W3C IIS or nginx CEF ingestion)
CommonSecurityLog
| where TimeGenerated >= Lookback
| where RequestURL has "/wp-content/uploads/" and (RequestURL endswith ".php" or RequestURL endswith ".phtml" or RequestURL endswith ".phar")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count(), Sources=make_set(SourceIP, 10) by RequestURL, DestinationHostName
| order by Hits desc;
// Hunt: MDE-onboarded Linux web servers — shell/interpreter spawned by web server processes
DeviceProcessEvents
| where TimeGenerated >= Lookback
| where InitiatingProcessFileName has_any ("apache2","httpd","nginx","php-fpm","lsphp")
| where FileName in~ ("sh","bash","dash","python3","perl","curl","wget","nc","ncat","socat")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc

-- Security Arsenal: Hunt for web shells and post-exploitation artifacts on WordPress/Avada hosts
-- 1) PHP files beneath uploads (should be near-zero on a healthy site)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='/var/www/*/wp-content/uploads/**/*.php')
ORDER BY Ctime DESC

-- 2) PHP files modified in the last 14 days anywhere under wp-content (catches injected theme/plugin files)
SELECT FullPath, Size, Mtime
FROM glob(globs='/var/www/*/wp-content/**/*.php')
WHERE Mtime > (now() - 14 * 24 * 3600)
ORDER BY Mtime DESC

-- 3) Web server / PHP-FPM processes with shell or interpreter children (run-time check)
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)sh|bash|dash|python|perl|nc$|ncat|socat'
   OR CommandLine =~ '(?i)base64|/dev/tcp|eval\(|assert\(|preg_replace.*/e'

-- 4) Outbound connections from web server processes (C2 / reverse shell check)
SELECT Pid, Name, Status, LocalAddress, LocalPort, RemoteAddress, RemotePort
FROM netstat()
WHERE Name =~ '(?i)apache2|httpd|nginx|php-fpm|lsphp|sh|bash'
  AND Status =~ 'ESTAB'
  AND RemotePort !~ '^(80|443)$'

#!/bin/bash
# Security Arsenal - Avada/WordPress RCE triage & hardening script (run as root on the web host)
# 1) Identify Avada installs and report theme version from style.css headers
echo "=== Avada installations detected ==="
find /var/www /srv/www /home -type f -path "*/wp-content/themes/Avada/style.css" 2>/dev/null | while read -r f; do
  v=$(grep -m1 -i "^Version:" "$f" | awk '{print $2}')
  echo "$f  -> Version: ${v:-UNKNOWN}"
done

# 2) Hunt for PHP files in uploads (prime web shell indicator after this exploit)
echo "=== PHP files under wp-content/uploads (investigate ALL hits) ==="
find /var/www /srv/www /home -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -path "*/wp-content/uploads/*" 2>/dev/null -exec ls -la {} \;

# 3) Recently modified PHP anywhere in wp-content (last 14 days)
echo "=== PHP files modified in last 14 days under wp-content ==="
find /var/www /srv/www /home -type f -name "*.php" -path "*/wp-content/*" -mtime -14 2>/dev/null -exec ls -la {} \; | head -100

# 4) Check for rogue admin users created recently (requires WP-CLI per site)
# for d in /var/www/*/; do (cd "$d" && wp user list --role=administrator --allow-root --fields=user_login,user_registered,user_email 2>/dev/null); done

# 5) Harden: block PHP execution in uploads via Apache .htaccess (drop into each uploads dir)
echo "=== Writing PHP-execution block to uploads directories ==="
find /var/www /srv/www /home -type d -path "*/wp-content/uploads" 2>/dev/null | while read -r d; do
  cat > "$d/.htaccess" <<'EOF'
<FilesMatch "\.(php|phtml|phar|php5|php7)$">
  Require all denied
</FilesMatch>
EOF
  echo "Hardened: $d/.htaccess"
done
# nginx equivalent (add to server block, then reload):
# location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ { deny all; }

# 6) Verify the web server is not running as a privileged user & list listening services for pivot review
echo "=== Web server process context ==="
ps -eo user,comm | grep -Ei 'apache2|httpd|nginx|php-fpm' | sort -u