CVE-2026-84434, CVE-2026-89274, CVE-2026-92229: Three Critical WordPress Plugin Vulnerabilities (CVSS up to 9.8) — Detection and Remediation Guide

---
title: Web Server Process Spawning Shell or Script Interpreter (Webshell Execution)
id: 4f8c2e91-7a3b-4d5e-9c16-2b7a9f3e0d41
status: experimental
description: Detects Apache, nginx, or PHP-FPM spawning command shells or script interpreters — a strong indicator of webshell execution following exploitation of arbitrary file upload flaws such as CVE-2026-84434 (Gravity Forms).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84434
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/05/20
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - 'php-fpm'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/php'
      - '/nc'
      - '/ncat'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - WordPress cron jobs invoking WP-CLI or PHP via the web server context
  - Legitimate plugin update routines
level: high
---
title: PHP File Written to WordPress Uploads Directory
id: 9b1d4e72-3c6a-4f8b-a2d5-8e0c7f1a6b93
status: experimental
description: Detects creation of PHP files inside wp-content/uploads, including Gravity Forms and Forminator upload paths. Executable code has no legitimate reason to be written here; this is a primary artifact of arbitrary file upload exploitation (CVE-2026-84434, CVE-2026-92229).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84434
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/05/20
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/wp-content/uploads/'
      - '/wp-content/uploads/gravity_forms/'
      - '/wp-content/uploads/forminator/'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.php7'
      - '.phar'
      - '.pht'
falsepositives:
  - Rare plugin functionality writing template files; validate source process
level: critical
---
title: HTTP Request to PHP File in WordPress Uploads Directory
id: 2c7a9f13-5e8d-4b61-9a34-6d0e2c8f5b17
status: experimental
description: Detects inbound HTTP requests for PHP/PHTML files under wp-content/uploads in web server access logs — indicating an attacker accessing an uploaded webshell after exploiting an arbitrary file upload vulnerability such as CVE-2026-84434.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84434
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/05/20
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    c-uri|contains: '/wp-content/uploads/'
  selection_ext:
    c-uri|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.php7'
      - '.phar'
      - '.pht'
  condition: selection_uri and selection_ext
falsepositives:
  - Highly unusual; some legacy themes serve dynamic image resizers from uploads — baseline and exclude by exact path if present
level: critical

// Hunt 1: HTTP requests to executable PHP in WordPress uploads directories
// Tables: CommonSecurityLog (CEF/WAF) or Syslog-ingested Apache/nginx logs
union isfuzzy=true
    (CommonSecurityLog
     | where RequestURL contains "/wp-content/uploads/"
     | where RequestURL has_any (".php", ".phtml", ".php5", ".php7", ".phar", ".pht")
     | project TimeGenerated, SourceIP, RequestURL, RequestMethod, HttpUserAgent, DeviceProduct),
    (Syslog
     | where SyslogMessage contains "/wp-content/uploads/"
     | where SyslogMessage has_any (".php", ".phtml", ".phar", ".pht")
     | extend RequestLine = extract(@"(?:GET|POST|PUT)\s+([^\s]+)", 1, SyslogMessage)
     | where isnotempty(RequestLine)
     | project TimeGenerated, Computer, HostIP, RequestLine, SyslogMessage)
| order by TimeGenerated desc;

// Hunt 2: Web server processes spawning shells/interpreters (webshell activity)
// Requires Defender for Endpoint on Linux web servers
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("apache2", "httpd", "nginx", "php-fpm")
| where FileName has_any ("sh", "bash", "dash", "zsh", "python", "python3", "perl", "nc", "ncat", "curl", "wget")
| where ProcessCommandLine !has_any ("wp-cron", "wp-cli") // baseline legitimate WP cron
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, InitiatingProcessCommandLine
| order by TimeGenerated desc;

// Hunt 3: Unauthenticated POSTs to Gravity Forms endpoints preceding compromise
// High-volume POSTs to form endpoints from single sources may indicate exploitation attempts
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestMethod == "POST"
| where RequestURL has_any ("gravityforms", "gf_page", "/?gf_token", "forminator", "wprm")
| summarize Requests = count(), DistinctURLs = dcount(RequestURL) by SourceIP, bin(TimeGenerated, 1h)
| where Requests > 50
| order by Requests desc;

-- Hunt: Webshell artifacts in WordPress upload directories
-- Searches for executable PHP and recently modified files in plugin upload paths
SELECT FullPath, Size, Mtime, Ctime,
       read_file(filename=FullPath, length=512) AS FileHeader
FROM glob(globs=[
    '/var/www/**/wp-content/uploads/**/*.php',
    '/var/www/**/wp-content/uploads/**/*.phtml',
    '/var/www/**/wp-content/uploads/**/*.phar',
    '/var/www/**/wp-content/uploads/**/*.pht',
    '/var/www/**/wp-content/uploads/**/*.php5',
    '/var/www/**/wp-content/uploads/**/*.php7',
    '/srv/www/**/wp-content/uploads/**/*.php',
    '/usr/share/nginx/**/wp-content/uploads/**/*.php',
    '/home/**/public_html/wp-content/uploads/**/*.php'
])
WHERE NOT IsDir
ORDER BY Mtime DESC;

-- Companion: recently modified files in vulnerable plugin upload dirs (last 30 days)
SELECT FullPath, Size, Mtime
FROM glob(globs=[
    '/var/www/**/wp-content/uploads/gravity_forms/**/*',
    '/var/www/**/wp-content/uploads/forminator/**/*',
    '/var/www/**/wp-content/uploads/**/wp-recipe-maker/**/*'
])
WHERE NOT IsDir
  AND Mtime > now() - 30 * 24 * 3600
ORDER BY Mtime DESC;

#!/bin/bash
# Security Arsenal — CVE-2026-84434 / CVE-2026-89274 / CVE-2026-92229 audit & hardening
# Run on each WordPress host as root or a user with WP-CLI access.

set -u

# ===== CONFIGURE: add your WordPress document roots =====
DOCROOTS=("/var/www/html" "/var/www" "/srv/www" "/home")

REPORT="/root/wp_cve_audit_$(date +%Y%m%d_%H%M%S).log"
exec > >(tee -a "$REPORT") 2>&1

echo "=== WordPress Critical Plugin CVE Audit — $(date) ==="

# --- 1. Locate WordPress installs and enumerate plugin versions ---
for root in "${DOCROOTS[@]}"; do
  find "$root" -maxdepth 4 -name "wp-config.php" 2>/dev/null | while read -r cfg; do
    site_dir=$(dirname "$cfg")
    echo ""
    echo "[+] Found WordPress install: $site_dir"

    if command -v wp >/dev/null 2>&1; then
      for plugin in gravityforms wp-recipe-maker forminator; do
        ver=$(wp plugin get "$plugin" --field=version --path="$site_dir" --allow-root 2>/dev/null)
        if [ -n "$ver" ]; then
          echo "    PLUGIN: $plugin version $ver"
          if [ "$plugin" = "gravityforms" ]; then
            # Flag any version <= 3.1.0.4 (vulnerable per CVE-2026-84434)
            if [ "$(printf '%s\n' "3.1.0.4" "$ver" | sort -V | head -1)" = "$ver" ]; then
              echo "    *** VULNERABLE: gravityforms $ver <= 3.1.0.4 (CVE-2026-84434) — UPDATE IMMEDIATELY ***"
            fi
          fi
        fi
      done
      echo "    (Verify wp-recipe-maker and forminator against vendor changelogs for CVE-2026-89274 / CVE-2026-92229 patched versions)"
    else
      echo "    [!] WP-CLI not found — check versions manually at $site_dir/wp-content/plugins/"
    fi
  done
done

# --- 2. Webshell triage: find executable PHP in uploads directories ---
echo ""
echo "=== Webshell Triage: PHP files under wp-content/uploads ==="
for root in "${DOCROOTS[@]}"; do
  find "$root" -type d -name "uploads" -path "*wp-content*" 2>/dev/null | while read -r up; do
    hits=$(find "$up" -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" -o -name "*.pht" -o -name "*.php[57]" \) 2>/dev/null)
    if [ -n "$hits" ]; then
      echo "*** SUSPICIOUS PHP in $up ***"
      echo "$hits"
      echo "$hits" | while read -r f; do ls -la "$f"; done
    fi
  done
done

# --- 3. Recently modified files in vulnerable plugin upload paths (last 14 days) ---
echo ""
echo "=== Recently modified files in gravity_forms / forminator upload paths ==="
for root in "${DOCROOTS[@]}"; do
  find "$root" -type d \( -name "gravity_forms" -o -name "forminator" \) 2>/dev/null | while read -r d; do
    find "$d" -type f -mtime -14 -exec ls -la {} \; 2>/dev/null
  done
done

# --- 4. Hardening: block PHP execution in uploads (Apache .htaccess) ---
echo ""
echo "=== Applying upload-directory PHP execution hardening (.htaccess) ==="
HTBLOCK='<FilesMatch "\.(php|phtml|php3|php4|php5|php7|phar|pht)$">
  Require all denied
</FilesMatch>'
for root in "${DOCROOTS[@]}"; do
  find "$root" -type d -name "uploads" -path "*wp-content*" 2>/dev/null | while read -r up; do
    if [ ! -f "$up/.htaccess" ]; then
      echo "$HTBLOCK" > "$up/.htaccess"
      echo "    [+] Wrote PHP-block .htaccess to $up"
    else
      if ! grep -qi "FilesMatch" "$up/.htaccess"; then
        printf '\n%s\n' "$HTBLOCK" >> "$up/.htaccess"
        echo "    [+] Appended PHP-block to existing $up/.htaccess"
      else
        echo "    [=] $up/.htaccess already contains FilesMatch rules — verify manually"
      fi
    fi
  done
done

# NOTE for nginx hosts: .htaccess is ignored. Add a location block instead:
#   location ~* ^/wp-content/uploads/.*\.(php|phtml|phar|pht)$ { deny all; }
# then reload nginx: nginx -t && systemctl reload nginx

echo ""
echo "=== Audit complete. Report: $REPORT ==="