CVE-2026-78570: Critical Unauthenticated Privilege Escalation in WordPress Total Donations Plugin — Detection and Remediation Guide

---
title: Total Donations Plugin Exploitation Attempt via admin-ajax.php
description: Detects unauthenticated POST requests to WordPress admin-ajax.php referencing the Total Donations plugin, consistent with CVE-2026-78570 privilege escalation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78570
author: Security Arsenal
date: 2026/02/10
status: experimental
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection_uri:
    cs-uri-stem|endswith: '/wp-admin/admin-ajax.php'
  selection_plugin:
    cs-uri-query|contains:
      - 'total_donations'
      - 'total-donations'
      - 'totaldonations'
  selection_method:
    cs-method: 'POST'
  condition: selection_uri and selection_plugin and selection_method
falsepositives:
  - Legitimate donor interactions with the plugin front-end (review volume and source distribution)
level: high
---
title: PHP File Created in WordPress Uploads Directory
description: Detects creation of PHP files under wp-content/uploads, a common webshell drop location following WordPress administrator compromise via CVE-2026-78570.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78570
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/02/10
status: experimental
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains: '/wp-content/uploads/'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.phar'
  condition: selection
falsepositives:
  - Rare legitimate plugin/theme functionality that writes PHP to uploads (investigate writer process)
level: high
---
title: Web Server Process Spawning Shell or Command Interpreter
description: Detects web server worker processes (apache2, nginx, php-fpm) spawning shells or system utilities, indicating post-exploitation command execution after WordPress compromise.
references:
  - https://attack.mitre.org/techniques/T1059/004/
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78570
author: Security Arsenal
date: 2026/02/10
status: experimental
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/nginx'
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate WordPress plugins invoking system binaries (e.g., image processing, backups) - tune per environment
level: high

let Lookback = 14d;
let ExploitRequests = union isfuzzy=true
    (CommonSecurityLog
    | where TimeGenerated > ago(Lookback)
    | where RequestURL has "/wp-admin/admin-ajax.php"
    | where RequestURL has_any ("total_donations", "total-donations", "totaldonations")
    | extend Source = "CommonSecurityLog"),
    (W3CIISLog
    | where TimeGenerated > ago(Lookback)
    | where csUriStem has "admin-ajax.php"
    | where csUriQuery has_any ("total_donations", "total-donations", "totaldonations")
    | extend Source = "W3CIISLog", SourceIP = cIP, RequestURL = strcat(csUriStem, "?", csUriQuery));
ExploitRequests
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), RequestCount = count(), DistinctURIs = dcount(RequestURL) by SourceIP, Source
| sort by RequestCount desc
| extend Severity = iff(RequestCount > 20, "Likely automated exploitation", "Investigate");

let Lookback = 14d;
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessName in~ ("apache2", "nginx", "php-fpm", "php", "php-cgi")
| where RemotePort in (80, 443, 8080, 4444, 1337)
| where RemoteIPType == "Public"
| summarize Connections = count(), DistinctRemoteIPs = dcount(RemoteIP), RemoteIPs = make_set(RemoteIP, 20) by DeviceName, InitiatingProcessName, bin(TimeGenerated, 1h)
| where DistinctRemoteIPs > 3 or Connections > 50
| sort by Connections desc;

-- Hunt for PHP webshells in WordPress uploads directories and recently modified plugin files
LET upload_paths = SELECT FullPath, Mtime, Size
FROM glob(globs='/var/www/**/wp-content/uploads/**/*.php', accessor='file')
WHERE Mtime > (now() - 1209600)

LET plugin_changes = SELECT FullPath, Mtime, Size
FROM glob(globs='/var/www/**/wp-content/plugins/**/*.php', accessor='file')
WHERE Mtime > (now() - 604800)
  AND NOT FullPath =~ 'total-donations'

SELECT FullPath, Mtime, Size, 'PHP in uploads directory' AS Finding
FROM upload_paths
UNION ALL
SELECT FullPath, Mtime, Size, 'Recently modified plugin file' AS Finding
FROM plugin_changes
ORDER BY Mtime DESC

-- Correlate web server processes with active outbound network connections
LET webprocs = SELECT Pid, Name, CommandLine, Username
FROM pslist()
WHERE Name =~ 'apache2|nginx|php-fpm|php'

SELECT Pid, Name, CommandLine, Username,
       netstat(Pid=Pid) AS Connections
FROM webprocs

#!/bin/bash
# CVE-2026-78570 - Total Donations plugin verification and remediation
# Run as root or with sudo on the WordPress host

WP_PATHS=$(find /var/www /srv/www /home -maxdepth 4 -name "wp-config.php" 2>/dev/null | xargs -I{} dirname {})

echo "=== [1] Checking for Total Donations plugin installs ==="
for WP in $WP_PATHS; do
  PLUGIN_DIR="$WP/wp-content/plugins/total-donations"
  if [ -d "$PLUGIN_DIR" ]; then
    echo "[!] FOUND plugin directory: $PLUGIN_DIR"
    if [ -f "$PLUGIN_DIR/readme.txt" ]; then
      grep -i "Stable tag" "$PLUGIN_DIR/readme.txt"
    fi
    echo "[!] DEACTIVATING and REMOVING vulnerable plugin..."
    mv "$PLUGIN_DIR" "${PLUGIN_DIR}.QUARANTINED_$(date +%Y%m%d)"
  else
    echo "[OK] No Total Donations plugin in $WP"
  fi
done

echo "=== [2] Auditing administrator accounts (requires wp-cli) ==="
for WP in $WP_PATHS; do
  if command -v wp >/dev/null 2>&1; then
    echo "--- $WP ---"
    sudo -u www-data wp user list --role=administrator --fields=user_login,user_email,user_registered --path="$WP" --allow-root 2>/dev/null
  fi
done

echo "=== [3] Checking default_role and registration options ==="
for WP in $WP_PATHS; do
  if command -v wp >/dev/null 2>&1; then
    sudo -u www-data wp option get default_role --path="$WP" --allow-root 2>/dev/null
    sudo -u www-data wp option get users_can_register --path="$WP" --allow-root 2>/dev/null
  fi
done

echo "=== [4] Hunting PHP files in uploads (last 30 days) ==="
find /var/www /srv/www /home -path "*/wp-content/uploads/*" -name "*.php" -mtime -30 2>/dev/null

echo "=== [5] Grepping access logs for exploitation attempts ==="
grep -E "admin-ajax.php.*(total[_-]donations|totaldonations)" /var/log/apache2/access.log* /var/log/nginx/access.log* 2>/dev/null | tail -50

echo "=== Complete. Review flagged accounts, quarantined plugins, and log hits before returning to service. ==="