CVE-2026-119977: WordPress Core TOCTOU Race Condition Under Active Exploitation — Detection and Remediation Guide

---
title: Web Server Process Spawning Shell or System Utilities
title_note: WordPress post-exploitation behavior
description: Detects web server or PHP-FPM worker processes spawning interactive shells or system utilities, consistent with post-exploitation activity following arbitrary code execution via CVE-2026-119977 on WordPress hosts.
author: Security Arsenal
date: 2026/11/15
status: experimental
references:
  - https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html
  - https://attack.mitre.org/techniques/T1059/004/
tags:
  - attack.execution
  - attack.t1059.004
  - cve.2026.119977
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/php-fpm'
      - '/php8.1-fpm'
      - '/php8.2-fpm'
      - '/php8.3-fpm'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate backup or maintenance scripts invoked by the web application (rare; validate per-environment)
  - Health-check plugins executing system commands
level: high
---
title: PHP File Written to WordPress Uploads or Temporary Directories
description: Detects creation of PHP files inside wp-content/uploads or WordPress temporary upgrade directories, consistent with web shell deployment following exploitation of the WordPress Core upgrade race condition (CVE-2026-119977). The uploads directory should not contain executable PHP.
author: Security Arsenal
date: 2026/11/15
status: experimental
references:
  - https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html
  - https://attack.mitre.org/techniques/T1505/003/
tags:
  - attack.persistence
  - attack.t1505.003
  - cve.2026.119977
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/wp-content/uploads/'
      - '/wp-content/upgrade/'
      - '/wp-content/mu-plugins/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php5'
      - '.php7'
  condition: selection_path and selection_ext
falsepositives:
  - Rare plugins that legitimately write PHP to mu-plugins during installation; verify against change records
  - mu-plugins writes during sanctioned plugin deployment
level: high
---
title: WordPress Core File Modified Outside Declared Maintenance Window
description: Detects modification of WordPress Core PHP files in wp-includes or wp-admin directories. During CVE-2026-119977 exploitation, attacker-controlled files are installed as part of a poisoned upgrade and will appear as core file modifications. Correlate with change tickets and scheduled update windows.
author: Security Arsenal
date: 2026/11/15
status: experimental
references:
  - https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html
  - https://attack.mitre.org/techniques/T1565/001/
tags:
  - attack.impact
  - attack.t1565.001
  - cve.2026.119977
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/wp-includes/'
      - '/wp-admin/'
    TargetFilename|endswith: '.php'
  filter_legit_core:
    TargetFilename|contains:
      - '/wp-admin/includes/update-core.php'
  condition: selection and not filter_legit_core
falsepositives:
  - Legitimate WordPress upgrades — suppress or alert-low during declared maintenance windows, alert-high otherwise
  - Managed hosting provider automated updates
level: medium

// Hunt for web server processes spawning shells/utilities and suspicious file writes
// Ingest Linux auditd/Syslog via CEF or AMA into Sentinel; also covers Defender for Endpoint on Linux.
let webParents = dynamic(["apache2", "httpd", "nginx", "php-fpm", "php8.1-fpm", "php8.2-fpm", "php8.3-fpm"]);
let suspiciousChildren = dynamic(["sh", "bash", "dash", "zsh", "curl", "wget", "nc", "ncat", "python", "python3", "perl"]);
union isfuzzy=true
    (Syslog
    | where TimeGenerated > ago(7d)
    | where Facility =~ "auth" or SyslogMessage has_any ("execve", "syscall")
    | where SyslogMessage has_any (webParents) and SyslogMessage has_any (suspiciousChildren)
    | project TimeGenerated, Computer, ProcessName, SyslogMessage),
    (DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName has_any (webParents)
    | where FileName has_any (suspiciousChildren)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName),
    (CommonSecurityLog
    | where TimeGenerated > ago(7d)
    | where DeviceVendor =~ "WordPress" or Message has "wp-content/uploads"
    | where Message has_any (".php", "update-core", "auto_update")
    | project TimeGenerated, SourceIP, DestinationHostName, RequestURL, RequestMethod, Message)
| sort by TimeGenerated desc

-- Artifact: WordPress_PostExploit_Hunt
-- Hunts for executable PHP in uploads, recently modified core files, and web-server-spawned shells.

-- 1) Executable PHP files in wp-content/uploads (web shell indicator)
SELECT FullPath, Mtime, Size
FROM glob(globs='/var/www/**/wp-content/uploads/**/*.php',
          accessor='file')
WHERE Mtime > epoch(seconds=now() - 604800)

-- 2) WordPress core files modified in the last 7 days (checksum drift candidates)
SELECT FullPath, Mtime, Size
FROM glob(globs='/var/www/**/wp-includes/*.php',
          accessor='file')
WHERE Mtime > epoch(seconds=now() - 604800)

-- 3) Web server processes with suspicious child command lines
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'wp-content/uploads.*\.php|/tmp/|/dev/shm/'
   OR (Username =~ 'www-data|apache|nginx' AND Name =~ '^(sh|bash|dash|curl|wget|nc|python3?|perl)$')

#!/bin/bash
# CVE-2026-119977 - WordPress Core verification & hardening script
# Run as root (or via sudo) on the WordPress host.
# Requires wp-cli (https://wp-cli.org/) for checksum verification.

set -euo pipefail

WP_ROOTS=("/var/www/html" "/var/www" "/srv/www")
WP_USER="www-data"   # adjust: apache / nginx / your web user

echo "[+] Locating WordPress installations..."
for root in "${WP_ROOTS[@]}"; do
  [ -d "$root" ] || continue
  find "$root" -maxdepth 4 -name wp-config.php 2>/dev/null
 done | while read -r cfg; do
  site_dir="$(dirname "$cfg")"
  echo "[+] Found WordPress at: $site_dir"

  # 1) Report installed core version — verify it matches the latest patched release from wordpress.org
  sudo -u "$WP_USER" wp core version --path="$site_dir" --allow-root 2>/dev/null || \
    echo "    [!] wp-cli unavailable; check version in $site_dir/wp-includes/version.php"

  # 2) Verify core checksums — ANY mismatch on a patched version is a red flag (possible poisoned upgrade)
  echo "[+] Verifying core checksums..."
  sudo -u "$WP_USER" wp core verify-checksums --path="$site_dir" --allow-root 2>/dev/null || \
    echo "    [!] Checksum verification failed or wp-cli missing — investigate manually"

  # 3) Find PHP files inside uploads (web shell indicator)
  echo "[+] Scanning uploads for executable PHP..."
  find "$site_dir/wp-content/uploads" -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) \
    -mtime -14 -ls 2>/dev/null || true

  # 4) Find recently modified core files
  echo "[+] Recently modified core files (last 7 days):"
  find "$site_dir/wp-includes" "$site_dir/wp-admin" -type f -name "*.php" -mtime -7 -ls 2>/dev/null || true

  # 5) Audit administrator accounts for rogue users
  echo "[+] Enumerating administrator accounts — validate each is expected:"
  sudo -u "$WP_USER" wp user list --role=administrator --fields=user_login,user_email,user_registered \
    --path="$site_dir" --allow-root 2>/dev/null || true
done

# 6) Harden uploads directory: deny PHP execution via .htaccess (Apache)
echo "[+] Writing PHP-execution deny rules to uploads directories..."
for root in "${WP_ROOTS[@]}"; do
  find "$root" -maxdepth 5 -type d -path "*/wp-content/uploads" 2>/dev/null | while read -r updir; do
    ht="$updir/.htaccess"
    if [ ! -f "$ht" ]; then
      printf '<FilesMatch "\\.(php|phtml|phar|php5|php7)$">\n  Require all denied\n</FilesMatch>\n' > "$ht"
      chmod 644 "$ht"
      echo "    [+] Hardened: $ht"
    fi
  done
done

echo "[+] Done. Remediation: update WordPress Core to the latest patched release immediately."
echo "    See: https://wordpress.org/news/ and the CISA KEV entry for CVE-2026-119977."