CVE-2026-119977: Unauthenticated RCE in WordPress Core — Exploitation Surge During Upgrade Windows

---
title: Suspicious WordPress Upgrade Endpoint Access
description: Detects unauthenticated access attempts to WordPress core upgrade endpoints, which may indicate CVE-2026-119977 probing or exploitation.
references:
  - https://www.wordfence.com/blog/2026/11/attackers-actively-probing-for-upgrade-window-rce-vulnerability-in-wordpress-core/
author: Security Arsenal
date: 2026/11/15
status: experimental
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: apache
  # Adjust for nginx, IIS, or cloud WAF logs as needed
detection:
  selection:
    cs-uri-stem|contains:
      - '/wp-admin/upgrade.php'
      - '/wp-admin/update-core.php'
      - '/wp-admin/update.php'
    sc-status:
      - 200
      - 302
      - 500
  filter:
    # Exclude legitimate admin IPs if you have a static list
    c-ip|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection and not filter
falsepositives:
  - Legitimate administrator updates from corporate IPs (tune filter)
  - Automated update services (verify source IP against known updaters)
level: high
---
title: Web Server Spawning Suspicious Child Process
description: Detects web server processes (Apache, Nginx, PHP-FPM) spawning command shells or scripting interpreters, indicative of RCE exploitation leading to webshell or reverse shell deployment.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/11/15
status: experimental
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
  # Also deploy Windows variant if WordPress runs on IIS
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/php-fpm'
      - '/php'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/netcat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate plugin or theme functionality (rare; investigate immediately)
  - Backup or maintenance scripts run by admins (whitelist specific scripts by path)
level: critical
---
title: WordPress Configuration File Accessed by Web Process
description: Detects web server or PHP processes accessing sensitive WordPress configuration files, which often occurs post-exploitation to harvest database credentials.
references:
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/11/15
status: experimental
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_access
  product: linux
detection:
  selection:
    TargetFilename|endswith:
      - '/wp-config.php'
    Image|endswith:
      - '/php'
      - '/php-fpm'
      - '/apache2'
      - '/nginx'
  filter:
    # Exclude legitimate WordPress bootstrap if needed, though direct file access is suspicious
    CurrentDirectory|contains: '/wp-admin/'
  condition: selection and not filter
falsepositives:
  - WordPress core updates (very rare for direct file access)
  - Security plugins performing integrity checks (verify plugin behavior)
level: high

// Hunt 1: Suspicious WordPress Upgrade Endpoint Requests
// Ingests from CommonSecurityLog (CEF) or W3CIISLog
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL contains "wp-admin/upgrade.php" or RequestURL contains "wp-admin/update-core.php"
| where SourceIP !startswith "10." and SourceIP !startswith "192.168."
| summarize Attempts=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, RequestURL, RequestMethod
| where Attempts > 3
| order by Attempts desc

// Hunt 2: Web Server Spawning Suspicious Processes (Linux Syslog or Windows SecurityEvent)
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName in ("apache2", "httpd", "nginx", "php-fpm", "php")
| where SyslogMessage contains "sh" or SyslogMessage contains "bash" or SyslogMessage contains "curl" or SyslogMessage contains "wget"
| where SyslogMessage contains "wp-content/uploads" or SyslogMessage contains "tmp"
| summarize by Computer, ProcessName, SyslogMessage, TimeGenerated
| order by TimeGenerated desc

// Hunt 3: File Access to wp-config.php (via Defender for Endpoint or Sysmon)
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FileName == "wp-config.php"
| where InitiatingProcessFileName in ("php.exe", "php", "w3wp.exe", "httpd", "apache2", "nginx")
| where InitiatingProcessCommandLine !contains "wp-admin"
| summarize by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, TimeGenerated
| order by TimeGenerated desc

-- Hunt for recently modified PHP files in WordPress uploads (common webshell location)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs="/**/wp-content/uploads/**/*.php")
WHERE Mtime > timestamp(secs=now() - 86400)  // Last 24 hours
ORDER BY Mtime DESC

-- Hunt for suspicious processes spawned by web server users
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Username =~ "www-data|apache|nginx|php"
  AND (CommandLine =~ "bash|sh|curl|wget|nc|python|perl"
       OR Exe =~ "/tmp/|/var/tmp/|/dev/shm/")
ORDER BY CreateTime DESC

-- Hunt for network connections from web server processes (C2 or data exfil)
SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, State
FROM netstat()
WHERE Name =~ "apache|nginx|php"
  AND State == "ESTABLISHED"
  AND RemoteAddr !~ "10\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3[0-1])\\."
ORDER BY Pid

#!/bin/bash
# CVE-2026-119977 Remediation & Verification Script
# Run as root or with sudo

set -euo pipefail

WP_PATH="/var/www/html"  # Adjust to your WordPress root
LOG_FILE="/var/log/wp-cve-2026-119977-remediation.log"

echo "[$(date)] Starting CVE-2026-119977 remediation checks" | tee -a "$LOG_FILE"

# 1. Check WordPress version
if [ -f "$WP_PATH/wp-includes/version.php" ]; then
    WP_VERSION=$(grep "\$wp_version =" "$WP_PATH/wp-includes/version.php" | cut -d"'" -f2)
    echo "[$(date)] Current WordPress version: $WP_VERSION" | tee -a "$LOG_FILE"
    
    # Compare versions (basic check for 7.1.4+)
    if [[ "$WP_VERSION" < "7.1.4" ]]; then
        echo "[$(date)] CRITICAL: WordPress is vulnerable to CVE-2026-119977. Update immediately." | tee -a "$LOG_FILE"
        echo "[$(date)] Download latest: https://wordpress.org/latest.tar.gz" | tee -a "$LOG_FILE"
        exit 1
    else
        echo "[$(date)] WordPress is patched (7.1.4+)." | tee -a "$LOG_FILE"
    fi
else
    echo "[$(date)] ERROR: WordPress not found at $WP_PATH. Adjust WP_PATH variable." | tee -a "$LOG_FILE"
    exit 1
fi

# 2. Check for suspicious PHP files in uploads (webshells)
echo "[$(date)] Scanning for suspicious PHP files in uploads..." | tee -a "$LOG_FILE"
SUSPICIOUS_FILES=$(find "$WP_PATH/wp-content/uploads" -name "*.php" -type f -mtime -7 2>/dev/null || true)
if [ -n "$SUSPICIOUS_FILES" ]; then
    echo "[$(date)] WARNING: Found recently modified PHP files in uploads (possible webshells):" | tee -a "$LOG_FILE"
    echo "$SUSPICIOUS_FILES" | tee -a "$LOG_FILE"
    echo "[$(date)] Quarantine these files and investigate." | tee -a "$LOG_FILE"
else
    echo "[$(date)] No suspicious PHP files found in uploads." | tee -a "$LOG_FILE"
fi

# 3. Check for unexpected processes running as web user
WEB_USER=$(ps aux | grep -E "apache|nginx|php-fpm" | grep -v grep | awk '{print $1}' | sort -u | head -1)
if [ -n "$WEB_USER" ]; then
    echo "[$(date)] Checking for suspicious processes running as $WEB_USER..." | tee -a "$LOG_FILE"
    SUSPICIOUS_PROCS=$(ps -u "$WEB_USER" -o pid,cmd | grep -E "bash|sh|curl|wget|nc|python|perl" | grep -v grep || true)
    if [ -n "$SUSPICIOUS_PROCS" ]; then
        echo "[$(date)] WARNING: Suspicious processes running as $WEB_USER:" | tee -a "$LOG_FILE"
        echo "$SUSPICIOUS_PROCS" | tee -a "$LOG_FILE"
    else
        echo "[$(date)] No suspicious processes found for $WEB_USER." | tee -a "$LOG_FILE"
    fi
fi

# 4. Harden upgrade endpoint (temporary mitigation until patched)
echo "[$(date)] Applying temporary hardening to wp-admin/upgrade.php..." | tee -a "$LOG_FILE"
HTACCESS="$WP_PATH/wp-admin/.htaccess"
if [ ! -f "$HTACCESS" ]; then
    cat > "$HTACCESS" << 'EOF'
# Temporary mitigation for CVE-2026-119977
# Restrict access to upgrade.php to localhost only (adjust for your admin IPs)
<Files "upgrade.php">
    Order Deny,Allow
    Deny from all
    Allow from 127.0.0.1
    # Allow from YOUR_ADMIN_IP_HERE
</Files>
EOF
    echo "[$(date)] Created $HTACCESS with upgrade.php restrictions. Adjust Allow from rules for your admin IPs." | tee -a "$LOG_FILE"
else
    echo "[$(date)] $HTACCESS already exists. Review manually to ensure upgrade.php is restricted." | tee -a "$LOG_FILE"
fi

# 5. Check file integrity of wp-config.php (should not be writable by web user)
if [ -f "$WP_PATH/wp-config.php" ]; then
    PERMS=$(stat -c "%a" "$WP_PATH/wp-config.php")
    if [ "$PERMS" -gt 644 ]; then
        echo "[$(date)] WARNING: wp-config.php has overly permissive permissions ($PERMS). Setting to 640." | tee -a "$LOG_FILE"
        chmod 640 "$WP_PATH/wp-config.php"
    else
        echo "[$(date)] wp-config.php permissions are acceptable ($PERMS)." | tee -a "$LOG_FILE"
    fi
fi

echo "[$(date)] Remediation checks complete. Review $LOG_FILE for details." | tee -a "$LOG_FILE"
echo "[$(date)] NEXT STEPS:" | tee -a "$LOG_FILE"
echo "  1. If WordPress < 7.1.4, update immediately: https://wordpress.org/download/" | tee -a "$LOG_FILE"
echo "  2. Review web server access logs for requests to /wp-admin/upgrade.php" | tee -a "$LOG_FILE"
echo "  3. Run a full malware scan (e.g., Wordfence, Sucuri)" | tee -a "$LOG_FILE"
echo "  4. Rotate all WordPress admin passwords and database credentials if compromise suspected" | tee -a "$LOG_FILE"