CVE-2026-119077: Critical PHP Object Injection in ELEX WordPress HelpDesk Plugin — Unauthenticated RCE Detection and Remediation Guide

---
title: Web Server Process Spawning Suspicious Child Processes
description: Detects PHP-FPM, Apache, or Nginx worker processes spawning shells, downloaders, or reconnaissance commands — a high-fidelity indicator of successful PHP Object Injection / webshell execution on WordPress hosts, consistent with post-exploitation of CVE-2026-119077.
id: 3c8a1f92-6d4e-4b7a-9c21-5f0e2d8a4b63
status: experimental
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-119077
  - https://attack.mitre.org/techniques/T1505/003/
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/base64'
      - '/id'
      - '/whoami'
      - '/uname'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate WordPress plugins invoking system commands (e.g. image processing) — validate against known plugin behavior before tuning
level: high
---
title: Webshell or PHP File Written to WordPress Uploads Directory
description: Detects creation of PHP files in wp-content/uploads or other web-accessible directories — a common post-exploitation artifact following PHP Object Injection RCE such as CVE-2026-119077, where gadget chains are used to drop a webshell for persistent access.
id: 8f2b7d41-1a5c-4e9f-b3d6-7c0a9e2f5d18
status: experimental
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-119077
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/wp-content/uploads/'
      - '/wp-content/cache/'
      - '/wp-content/upgrade/'
      - '/wp-content/mu-plugins/'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.php7'
      - '.phar'
  condition: selection
falsepositives:
  - Legitimate plugin/theme updates writing PHP files — correlate with wp-admin administrative sessions and known maintenance windows
level: high
---
title: Suspicious URL-Encoded Form Payload Targeting wsdesk Ticket Handler
description: Detects HTTP requests containing the wsdesk form parameter with suspicious serialized-object markers (O:, base64 blobs, or PHP magic-method indicators) in the ticket_label field, indicative of CVE-2026-119077 exploitation attempts captured in web/proxy telemetry.
id: 5e1c9a08-3f7d-4b2c-a6e4-9d1f8c3b7a52
status: experimental
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-119077
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-query|contains:
      - 'ticket_label'
      - 'wsdesk'
  selection_serialized:
    cs-uri-query|contains:
      - '%3AO%3A'
      - 'O%3A%2B'
      - 'a%3A'
      - 'O:'
  condition: all of selection_*
falsepositives:
  - Legitimate ticket submissions with unusual label content — unlikely but possible; pair with response-code and volume analysis
level: high

// Hunt: web server processes executing shells or downloaders on WordPress hosts
// Onboard Syslog/CEF from Linux web servers into Sentinel for coverage
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName has_any ("php-fpm", "apache2", "httpd", "nginx")
    or SyslogMessage has_any ("php-fpm", "apache2", "httpd", "nginx")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl ", "wget ", "python", "nc -", "base64 -d")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

// Hunt: inbound requests carrying wsdesk form payloads with serialized-object markers
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("wsdesk", "ticket_label")
| where RequestURL has_any ("%3AO%3A", "O%3A", "O:", "a%3A")
| summarize RequestCount = count(), DistinctSources = dcount(SourceIP) by SourceIP, RequestURL, RequestMethod, bin(TimeGenerated, 1h)
| order by RequestCount desc;

// Hunt: new or modified admin accounts / suspicious PHP under uploads (via file integrity or EDR telemetry on web tier)
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("wp-content/uploads", "wp-content/mu-plugins", "wp-content/cache")
| where FileName endswith ".php" or FileName endswith ".phtml"
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessAccountName, InitiatingProcessCommandLine
| order by TimeGenerated desc

-- Hunt for webshell artifacts and web-server-spawned processes on a WordPress host
-- Artifact 1: Recently created/modified PHP files in upload & writable content directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/var/www/**/wp-content/uploads/**/*.php',
                 '/var/www/**/wp-content/mu-plugins/**/*.php',
                 '/var/www/**/wp-content/cache/**/*.php'])
WHERE Mtime > now() - 604800
ORDER BY Mtime DESC;

-- Artifact 2: Suspicious child processes of the web server (live execution)
SELECT Pid, Ppid, Name, Exe, Cmdline, Username
FROM pslist()
WHERE Cmdline =~ '/bin/(ba)?sh|curl |wget |nc |base64 -d|python'
  AND Username =~ 'www-data|apache|nginx|nobody';

-- Artifact 3: Web server processes holding unexpected outbound connections (C2 / reverse shell)
SELECT Pid, Name, Status, Address, Port, Raddress, Rport
FROM netstat()
WHERE Name =~ 'php-fpm|apache2|httpd|nginx'
  AND Status =~ 'ESTABLISHED'
  AND Rport NOT IN (80, 443)

#!/bin/bash
# CVE-2026-119077 — ELEX wsdesk plugin: detect, verify version, and quarantine
# Run on the WordPress host (or via your config-management tooling across the fleet)

WP_ROOT="/var/www/html"   # adjust to your document root
PLUGIN_DIR="$WP_ROOT/wp-content/plugins"

# 1) Locate every wsdesk installation across common vhost roots
echo "[*] Searching for ELEX HelpDesk (wsdesk) plugin installs..."
find /var/www -type d -iname "*wsdesk*" -path "*wp-content/plugins*" 2>/dev/null

# 2) Check installed version — anything <= 3.3.9 is vulnerable
for readme in $(find /var/www -type f -iname "readme.txt" -path "*wsdesk*" 2>/dev/null); do
  echo "[*] $readme"
  grep -i "Stable tag" "$readme"
done

# 3) If WP-CLI is available, enumerate precisely
sudo -u www-data wp plugin list --path="$WP_ROOT" --format=table 2>/dev/null | grep -i wsdesk

# 4) EMERGENCY CONTAINMENT: deactivate the plugin until patched
sudo -u www-data wp plugin deactivate wsdesk --path="$WP_ROOT" 2>/dev/null
# Fallback if WP-CLI unavailable — rename the plugin directory to break the load path
# mv "$PLUGIN_DIR/wsdesk" "$PLUGIN_DIR/wsdesk.DISABLED-CVE-2026-119077"

# 5) Hunt for dropped webshells: PHP files under uploads modified in last 14 days
echo "[*] Hunting for recent PHP files in writable directories..."
find "$WP_ROOT/wp-content/uploads" "$WP_ROOT/wp-content/cache" \
  -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) \
  -mtime -14 -ls 2>/dev/null

# 6) Check for rogue admin users (requires WP-CLI + DB access)
sudo -u www-data wp user list --role=administrator --path="$WP_ROOT" --format=table 2>/dev/null

# 7) Review access logs for exploitation attempts targeting the form parameter
echo "[*] Grepping access logs for ticket_label / wsdesk payloads..."
grep -hEi "ticket_label|wsdesk" /var/log/apache2/access*.log /var/log/nginx/access*.log 2>/dev/null \
  | grep -Ei "O:|%3AO%3A|a%3A" | tail -n 50