CVE-2026-15989, CVE-2026-75957, CVE-2026-92966: Three Critical WordPress Plugin Flaws (CVSS up to 9.8) — Detection and Remediation Guide

---
title: Webshell Dropped in WordPress Writable Directory
id: 3f7a2c91-8b44-4e2d-9a61-cve2026a15989
status: experimental
description: Detects creation of PHP files in WordPress uploads, cache, or other writable directories by the web server process - a hallmark of post-exploitation following WordPress plugin compromise such as CVE-2026-15989.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-15989
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/wp-content/uploads/'
      - '/wp-content/cache/'
      - '/wp-content/upgrade/'
      - '/wp-includes/images/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php5'
      - '.php7'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate plugin or media-management functionality writing PHP index files (typically index.php only - exclude exact-match index.php writes if noisy)
level: high
---
title: Web Server Process Spawning Shell or Command Interpreter
id: 8d1e5b62-4c37-4f9a-b2d8-cve2026b75957
status: experimental
description: Detects Apache, Nginx, or PHP-FPM spawning a shell or common post-exploitation tooling - consistent with webshell activity after exploitation of critical WordPress plugin flaws such as CVE-2026-15989, CVE-2026-75957, or CVE-2026-92966.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-15989
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Some legitimate WordPress plugins invoke shell commands (image processing, backups) - baseline per host and whitelist known plugin behavior
level: high
---
title: Suspicious WordPress User Registration with Role Parameter
id: 51c9d4a7-2e68-4b1f-9c73-cve2026c92966
status: experimental
description: Detects HTTP POST requests to WordPress endpoints containing a client-submitted role parameter - the exploitation primitive of CVE-2026-15989, where Super Forms passes the role key to wp_insert_user(). Apply against web server access logs ingested as proxy/firewall logs.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-15989
  - https://attack.mitre.org/techniques/T1136/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.persistence
  - attack.t1136.001
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_body:
    cs-uri-query|contains:
      - 'role=administrator'
      - 'role%5B%5D=administrator'
      - 'role=editor'
  selection_uri:
    cs-uri-stem|contains:
      - '/wp-admin/admin-ajax.php'
      - '/wp-json/'
      - 'super-forms'
      - 'super_forms'
  condition: selection_method and selection_body and selection_uri
falsepositives:
  - Legitimate admin-ajax operations from authenticated administrators - correlate with source IP reputation and authenticated session absence
level: high

// Hunt 1: Exploitation attempts - role parameter abuse against WordPress plugin endpoints (CVE-2026-15989)
let lookback = 14d;
union isfuzzy=true
    (CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where RequestMethod == "POST"
    | where RequestURL has_any ("admin-ajax.php", "wp-json", "super-forms", "latepoint", "ultimate-multisite", "wp-signup.php", "wp-login.php")
    | where RequestURL has_any ("role=administrator", "role%5B%5D=administrator", "role=editor")
    | project TimeGenerated, SourceIP, RequestURL, RequestMethod, DeviceAction, SourceHostName),
    (Syslog
    | where TimeGenerated > ago(lookback)
    | where SyslogMessage has "POST"
    | where SyslogMessage has_any ("admin-ajax.php", "wp-json", "super-forms", "latepoint", "ultimate-multisite")
    | where SyslogMessage has_any ("role=administrator", "role=editor")
    | project TimeGenerated, HostIP, SyslogMessage, Computer);
// Hunt 2: Post-exploitation - web server user spawning shells/tools on Linux WordPress hosts
SecurityEvent
| where TimeGenerated > ago(14d)
| where EventID == 4688
| where ParentProcessName has_any ("php-fpm", "apache2", "httpd", "nginx")
| where NewProcessName has_any ("\\sh", "\\bash", "\\curl", "\\wget", "\\nc", "\\python", "\\perl")
| project TimeGenerated, Computer, ParentProcessName, NewProcessName, CommandLine, Account
| order by TimeGenerated desc;
// Hunt 3: Rogue admin account creation - review WordPress user creation events if audit logging (e.g., WP activity log plugin) forwards to Syslog
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("user_register", "wp_insert_user", "added user", "new user")
| where SyslogMessage has_any ("administrator", "role")
| project TimeGenerated, Computer, SyslogMessage
| order by TimeGenerated desc;

-- Hunt: Webshell artifacts and post-exploitation processes on WordPress hosts
-- Artifact 1 logic: Recently modified PHP files in writable WordPress directories
SELECT FullPath, Mtime, Size, Mode
FROM glob(globs=['/var/www/**/wp-content/uploads/**/*.php',
                 '/var/www/**/wp-content/cache/**/*.php',
                 '/var/www/**/wp-content/upgrade/**/*.php',
                 '/srv/www/**/wp-content/uploads/**/*.php'])
WHERE NOT FullPath =~ 'index.php$'
ORDER BY Mtime DESC

-- Artifact 2 logic: Processes spawned by the web server stack
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Username =~ 'www-data|apache|nginx'
  AND Name =~ 'sh|bash|dash|curl|wget|nc|ncat|python|perl'

#!/bin/bash
# CVE-2026-15989 / CVE-2026-75957 / CVE-2026-92966 - WordPress plugin inventory and triage
# Run as root or with sudo on each WordPress host.

WP_ROOTS="/var/www /srv/www /home"

echo "=== [1] Locate vulnerable plugin installations and versions ==="
for root in $WP_ROOTS; do
  find "$root" -type d \( -name "super-forms" -o -name "ultimate-multisite" -o -name "latepoint" \) 2>/dev/null
  find "$root" -type f -path "*/super-forms/super-forms.php" 2>/dev/null | while read f; do
    echo "--- $f"; grep -m1 "Version:" "$f"
  done
  find "$root" -type f -path "*/latepoint/latepoint.php" 2>/dev/null | while read f; do
    echo "--- $f"; grep -m1 "Version:" "$f"
  done
done
# Any Super Forms version <= 6.3.316 is VULNERABLE to CVE-2026-15989

echo "=== [2] Hunt for PHP webshells in writable directories ==="
find /var/www /srv/www -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) \
  -path "*/wp-content/uploads/*" 2>/dev/null | grep -v "/index.php$"

echo "=== [3] Flag recently modified PHP files (last 14 days) in wp-content ==="
find /var/www /srv/www -type f -name "*.php" -path "*/wp-content/*" -mtime -14 2>/dev/null

echo "=== [4] Audit WordPress administrator accounts (requires wp-cli) ==="
for root in $WP_ROOTS; do
  find "$root" -name "wp-config.php" 2>/dev/null | while read cfg; do
    dir=$(dirname "$cfg")
    echo "--- Site: $dir"
    sudo -u www-data wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --path="$dir" 2>/dev/null
  done
done
# Investigate any administrator account you do not recognize or with a recent registration date.

echo "=== [5] Check web server child processes for shells ==="
ps auxf | grep -E "(apache2|httpd|nginx|php-fpm)" -A2 | grep -E "(sh|bash|curl|wget|nc |python|perl)"

echo "=== Done. Correlate findings with web access logs for POSTs containing 'role=administrator'. ==="