CVE-2026-114630: Critical CVSS 9.1 WordPress Vulnerability — Detection, Hardening, and Remediation Guide

---
title: Webshell PHP File Dropped in WordPress Content Directory
id: 4b2e7c91-8d3f-4a55-b6e2-9f1a2c3d4e5f
status: experimental
description: Detects creation of PHP files inside the WordPress wp-content tree (uploads, themes, plugins), a canonical indicator of webshell deployment following exploitation of WordPress vulnerabilities such as CVE-2026-114630.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-114630
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/wp-content/uploads/'
      - '/wp-content/themes/'
      - '/wp-content/plugins/'
      - '/wp-content/mu-plugins/'
      - '/wp-content/upgrade/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.php7'
      - '.phar'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate theme or plugin installation/update by an administrator
  - Deployment pipelines pushing theme code (exclude CI/CD service accounts/hosts)
level: high
---
title: Web Server Process Spawning Shell or Command Interpreter
id: 8c1d4e62-3f7a-4b90-a2c1-6d5e4f3a2b1c
status: experimental
description: Detects the web server or PHP-FPM worker process spawning interactive shells or command interpreters, indicating post-exploitation command execution via a webshell or RCE against WordPress (e.g., CVE-2026-114630).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-114630
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/php-fpm'
      - '/php-cgi'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Backup/maintenance cron jobs invoking curl or wget (tune by ParentImage and scheduled task correlation)
  - Legitimate WordPress plugins that shell out (rare; validate per-plugin)
level: critical
---
title: Suspicious Inbound Requests to WordPress AJAX and REST Endpoints
id: 2e9f5b18-7c4d-4e81-9a3b-1c6d8e2f4a5b
status: experimental
description: Detects POST requests to WordPress admin-ajax.php or REST API routes carrying strings associated with command execution or file upload abuse, consistent with exploitation attempts against WordPress RCE-class vulnerabilities such as CVE-2026-114630.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-114630
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/wp-admin/admin-ajax.php'
      - '/wp-json/'
      - '/xmlrpc.php'
  selection_method:
    cs-method: 'POST'
  selection_payload:
    cs-uri-query|contains:
      - 'cmd='
      - 'exec='
      - 'system('
      - 'shell_exec'
      - 'passthru'
      - 'base64_decode'
      - 'eval('
      - '../'
      - 'php://input'
      - 'data://'
  condition: selection_uri and selection_method and selection_payload
falsepositives:
  - Security scanners and WAF testing (allowlist scanner source IPs)
  - Legitimate plugins with file management features (rare on URI query; validate)
level: high

// Hunt 1: Webshell drops — PHP files written into WordPress content directories
// Requires file events from Defender for Endpoint or Sysmon-equivalent ingestion
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("wp-content\\uploads", "wp-content\\themes", "wp-content\\plugins",
                            "/wp-content/uploads/", "/wp-content/themes/", "/wp-content/plugins/")
| where FileName endswith ".php" or FileName endswith ".phtml" or FileName endswith ".phar"
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, InitiatingProcessAccountName
| sort by TimeGenerated desc;

// Hunt 2: Web server worker spawning command interpreters (post-exploitation)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("apache2", "httpd", "nginx", "php-fpm", "php-cgi", "w3wp.exe")
| where FileName in~ ("sh", "bash", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat",
                      "cmd.exe", "powershell.exe", "pwsh.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine,
          AccountName, InitiatingProcessCommandLine
| sort by TimeGenerated desc;

// Hunt 3: Exploit probes against WordPress AJAX/REST endpoints from web/WAF logs
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("/wp-admin/admin-ajax.php", "/wp-json/", "/xmlrpc.php")
| where RequestMethod == "POST"
| where RequestURL has_any ("cmd=", "exec=", "system(", "shell_exec", "base64_decode", "eval(", "../", "php://input", "data://")
    or AdditionalExtensions has_any ("shell_exec", "base64_decode", "eval(")
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, RequestURL, DestinationHostName
| order by RequestCount desc;

// Hunt 4: Anomalous outbound connections FROM the web tier (reverse shells, payload staging)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("apache2", "httpd", "nginx", "php-fpm", "php-cgi")
| where RemoteIPType == "Public"
| where RemotePort in (4444, 5555, 6666, 1337, 8080, 443, 53)  // common C2/staging ports; tune to baseline
| summarize Connections = count(), FirstSeen = min(TimeGenerated) by DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName
| order by FirstSeen desc;

-- CVE-2026-114630 WordPress compromise sweep:
-- 1) Recently written PHP files under wp-content (potential webshells)
-- 2) Web server processes spawning shells/interpreters (post-exploitation)

LET webroots = (
  SELECT FullPath AS Root
  FROM glob(globs=['/var/www/*/wp-content', '/var/www/html/wp-content',
                   '/srv/www/*/wp-content', '/home/*/public_html/wp-content'])
)

LET suspicious_php =
  SELECT FullPath, Size, Mtime, Btime
  FROM glob(globs=[r'/var/www/**/wp-content/**/*.php',
                   r'/srv/www/**/wp-content/**/*.php',
                   r'/home/*/public_html/wp-content/**/*.php'],
            accessor='file')
  WHERE Mtime > now() - 604800        -- written in last 7 days
    AND FullPath =~ '/uploads/'       -- uploads tree should rarely contain PHP

LET shell_children =
  SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
  FROM pslist()
  WHERE Name =~ '^(sh|bash|dash|zsh|python|python3|perl|nc|ncat)$'

SELECT 'webshell_candidate' AS FindingType, FullPath AS Detail1,
       Size AS Detail2, Mtime AS Timestamp
FROM suspicious_php
UNION ALL
SELECT 'shell_process' AS FindingType, Exe AS Detail1,
       CommandLine AS Detail2, CreateTime AS Timestamp
FROM shell_children

#!/usr/bin/env bash
# CVE-2026-114630 WordPress remediation & verification helper
# Usage: sudo bash wp_remediate.sh /var/www/mysite
set -euo pipefail

WP_ROOT="${1:-/var/www/html}"
echo "[+] Target WordPress root: ${WP_ROOT}"

# 1) Inventory: report current WordPress core version
echo "[+] Current WordPress core version:"
sudo -u www-data wp core version --path="${WP_ROOT}" --allow-root 2>/dev/null \
  || wp core version --path="${WP_ROOT}" --allow-root

# 2) Check for available core updates (review BEFORE applying in production)
echo "[+] Checking for core updates..."
wp core check-update --path="${WP_ROOT}" --allow-root || true

# 3) Apply core update to the latest patched release
echo "[+] Applying WordPress core update..."
wp core update --path="${WP_ROOT}" --allow-root
wp core update-db --path="${WP_ROOT}" --allow-root
echo "[+] Post-update version:"
wp core version --path="${WP_ROOT}" --allow-root

# 4) Update all plugins and themes (CVE surface frequently lives in bundled code)
echo "[+] Updating plugins and themes..."
wp plugin update --all --path="${WP_ROOT}" --allow-root || true
wp theme update --all --path="${WP_ROOT}" --allow-root || true

# 5) Block PHP execution in uploads via .htaccess (Apache) — webshell mitigation
cat > "${WP_ROOT}/wp-content/uploads/.htaccess" <<'EOF'
# Deny PHP execution in uploads — Security Arsenal hardening
<FilesMatch "\.(php|phtml|php3|php4|php5|php7|phar)$">
  Require all denied
</FilesMatch>
EOF
echo "[+] PHP execution blocked in uploads (.htaccess written)."

# 6) Disable xmlrpc.php via WordPress filter drop-in
cat > "${WP_ROOT}/wp-content/mu-plugins-disable-xmlrpc.php" <<'EOF'
<?php
// Security Arsenal hardening: disable XML-RPC
add_filter('xmlrpc_enabled', '__return_false');
EOF
mkdir -p "${WP_ROOT}/wp-content/mu-plugins"
mv "${WP_ROOT}/wp-content/mu-plugins-disable-xmlrpc.php" \
  "${WP_ROOT}/wp-content/mu-plugins/disable-xmlrpc.php"
echo "[+] XML-RPC disabled via mu-plugin."

# 7) Audit for rogue administrator accounts
echo "[+] Administrator accounts (verify each is expected):"
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered \
  --path="${WP_ROOT}" --allow-root

# 8) Sweep for recently modified PHP files under wp-content (webshell triage)
echo "[+] PHP files modified in wp-content within the last 7 days:"
find "${WP_ROOT}/wp-content" -type f -name '*.php' -mtime -7 -ls || true

echo "[+] Done. Review output, then confirm patched version against the NVD entry:"
echo "    https://nvd.nist.gov/vuln/detail/CVE-2026-114630"