CVE-2026-4703: Critical PHP Object Injection in WS Form LITE for WordPress — Detection and Remediation Guide

---
title: WS Form LITE PHP Object Injection Attempt via Serialized Payload in Request Body
id: 3f8a1c24-7b92-4e5d-9a31-2c6d8e4f5b7a
status: experimental
description: Detects HTTP requests to WordPress WS Form submission endpoints containing PHP serialized object syntax, indicative of CVE-2026-4703 exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-4703
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: apache
  service: accesslog
detection:
  selection_uri:
    cs-uri-stem|contains:
      - 'admin-ajax.php'
      - '/wp-json/ws-form'
  selection_body:
    cs-body|contains:
      - 'O:%22'
      - 'a:%7B'
      - 'O:+'
      - 'unserialize'
  condition: selection_uri and selection_body
falsepositives:
  - Legitimate plugin data submission containing serialized arrays (rare in request URIs; more common in bodies — tune per WAF logging)
level: high
---
title: Web Server Spawning Shell or System Commands (Post-Exploitation)
id: 9c2e7b15-4d83-4f1a-b8c6-5e3a9d2f1c48
status: experimental
description: Detects the web server worker process (www-data/apache/nginx) spawning command interpreters, consistent with post-exploitation after PHP Object Injection RCE on a WordPress host.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-4703
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/php-fpm'
      - '/nginx'
  selection_user:
    User|contains:
      - 'www-data'
      - 'apache'
      - 'nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python'
      - '/perl'
      - '/nc'
  condition: selection_parent and (selection_user or 1 of selection_parent) and selection_child
falsepositives:
  - Rare legitimate PHP exec() usage by site code (e.g., image processing pipelines) — whitelist known-good script paths
level: critical
---
title: Webshell Dropped in WordPress Content Directories
id: 5d1f9a38-6c47-4b2e-a3d9-8f2c4e6b1a95
status: experimental
description: Detects creation of PHP files in WordPress uploads or content directories, a common persistence step following plugin exploitation such as CVE-2026-4703.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-4703
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/wp-content/uploads/'
      - '/wp-content/cache/'
      - '/wp-content/upgrade/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php5'
      - '.php7'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate plugin/theme updates write PHP files under wp-content — scope to uploads/cache directories where PHP should never legitimately appear
level: high

// Hunt for CVE-2026-4703 exploitation: serialized PHP payloads in requests to WS Form endpoints
// Assumes web/WAF logs ingested via CommonSecurityLog (CEF) or a custom web access log table
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("admin-ajax.php", "/wp-json/ws-form", "ws-form")
| where RequestMethod == "POST"
| extend HasSerializedObject =
    (AdditionalExtensions has "O:" or AdditionalExtensions has "unserialize"
     or RequestURL has "O:%22" or RequestURL has "a:%7B")
| where HasSerializedObject or AdditionalExtensions has "wsform"
| project TimeGenerated, SourceIP, RequestURL, RequestMethod, AdditionalExtensions,
          DeviceAction, DestinationHostName
| summarize Requests = count(), DistinctURIs = dcount(RequestURL) by SourceIP, bin(TimeGenerated, 1h)
| where Requests > 3
| order by TimeGenerated desc

-- Hunt for post-exploitation artifacts on a WordPress host after suspected CVE-2026-4703 abuse
-- Looks for PHP files recently written to uploads (webshells) and shells spawned by the web server user
LET webshells = SELECT FullPath, Size, Mtime, Ctime
FROM glob(glob='/var/www/**/wp-content/uploads/**/*.php')
WHERE Mtime > (now() - 86400 * 7)

SELECT 'WebshellCandidate' AS Artifact, FullPath, Mtime, Size
FROM webshells
UNION ALL
SELECT 'WebUserProcess' AS Artifact,
       CommandLine AS FullPath,
       CreateTime AS Mtime,
       Pid AS Size
FROM pslist()
WHERE Username =~ 'www-data|apache|nginx'
  AND CommandLine =~ '(bash|sh -c|curl |wget |nc |python|perl)'

#!/bin/bash
# CVE-2026-4703 verification and remediation script for WordPress hosts
# Run on the web server (or via SSH/Ansible across your WordPress fleet)

WP_PATH="${1:-/var/www/html}"
VULN_MAX="1.10.80"

echo "=== [1] Locate WS Form LITE installations ==="
find "$WP_PATH" -type d -name "ws-form*" 2>/dev/null

echo "=== [2] Check installed version via readme header ==="
for f in $(find "$WP_PATH" -type f -path "*ws-form*/ws-form.php" 2>/dev/null); do
  ver=$(grep -i "Version:" "$f" | head -1 | awk '{print $2}')
  echo "Found: $f -> version $ver"
done

echo "=== [3] Update via WP-CLI (preferred) ==="
# sudo -u www-data wp plugin update ws-form --path="$WP_PATH"
# If auto-update cannot reach the repository, manually deploy the patched release.

echo "=== [4] Emergency mitigation: deactivate if patch unavailable ==="
# sudo -u www-data wp plugin deactivate ws-form --path="$WP_PATH"

echo "=== [5] Hunt: serialized-object payloads in access logs (last 7 days) ==="
find /var/log -name "access*log*" -mtime -7 2>/dev/null | while read -r log; do
  zgrep -Ei "admin-ajax.php|wp-json/ws-form" "$log" 2>/dev/null \
    | grep -Ei "O:%22|O:\\+|unserialize|a:%7B" \
    && echo "  ^^ SUSPICIOUS in $log"
done

echo "=== [6] Hunt: PHP files in uploads dir (potential webshells, last 7 days) ==="
find "$WP_PATH/wp-content/uploads" -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -mtime -7 2>/dev/null

echo "=== [7] Hunt: shells/tools spawned by web user in process history / auditd ==="
ausearch -u www-data -i 2>/dev/null | grep -Ei "bash|sh |curl|wget|nc |python" | tail -20

echo "=== Done. Investigate any hits from steps 5-7 before declaring the host clean. ==="