Fedora 43 WordPress 6.9.7 Security Update: Remediating Authenticated RCE, XSS, and Privilege Escalation (FEDORA-2026-61704c09ea)

---
title: Web Server or PHP-FPM Spawning Shell (WordPress RCE Post-Exploitation)
id: 3f8c1a92-7b4e-4d21-9c63-8a1f2e5b7d90
status: experimental
description: Detects common web server or PHP-FPM worker processes spawning interactive shells or script interpreters, a strong indicator of post-exploitation following a web application RCE such as the authenticated code execution flaw patched in WordPress 6.9.7 (FEDORA-2026-61704c09ea).
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-43-wordpress-2026-61704c09ea
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.persistence
  - attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/httpd'
      - '/apache2'
      - '/nginx'
      - '/php-fpm'
      - '/php-cgi'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate WordPress plugins invoking system tools (rare; validate the plugin and path)
  - Health-check or backup scripts executed by the hosting stack
level: high
---
title: PHP File Written to WordPress Uploads Directory (Web Shell Deployment)
id: 9d2e6b41-5c83-4f17-a2d4-6e9b3c1f8a25
status: experimental
description: Detects creation of PHP files inside WordPress uploads directories by web server processes. Uploads directories should contain media, not executable code — this is a canonical web shell deployment pattern following CMS code execution, relevant to the authenticated RCE fixed in WordPress 6.9.7.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-43-wordpress-2026-61704c09ea
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/wp-content/uploads/'
      - '/wp-content/cache/'
      - '/wp-content/upgrade/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php5'
      - '.php7'
  condition: selection_path and selection_ext
falsepositives:
  - Certain caching or backup plugins legitimately writing PHP index guards (index.php with 'Silence is golden' content — inspect file content)
level: high
---
title: Suspicious WordPress Authentication Activity via XML-RPC or Login Endpoint
id: 5b7a3e68-2f49-4c81-b3d7-1a6e8c4f2093
status: experimental
description: Detects patterns consistent with brute force or credential stuffing against WordPress login and XML-RPC endpoints in web access logs — the precursor step an attacker needs to obtain the authenticated session required to exploit the code execution flaw patched in WordPress 6.9.7.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-43-wordpress-2026-61704c09ea
  - https://attack.mitre.org/techniques/T1110/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1110
logsource:
  category: webserver
detection:
  selection:
    c-uri|contains:
      - '/wp-login.php'
      - '/xmlrpc.php'
    cs-method: 'POST'
    sc-status:
      - 200
      - 403
  condition: selection
falsepositives:
  - Legitimate user logins — apply rate/threshold aggregation (e.g., >10 POSTs per source IP per 5 minutes) in your SIEM correlation layer rather than alerting on single events
level: medium

// WordPress post-exploitation hunt: web server spawning interpreters/shells (Syslog from Fedora hosts)
let WebParents = dynamic(["httpd", "apache2", "nginx", "php-fpm", "php-cgi"]);
let ShellChildren = dynamic(["bash", "sh", "dash", "python", "python3", "perl", "nc", "ncat", "socat", "curl", "wget"]);
let ShellSpawn =
Syslog
| where TimeGenerated > ago(7d)
| where Facility == "auth" or SyslogMessage has_any ("php-fpm", "httpd", "nginx")
| where SyslogMessage has_any (ShellChildren)
| extend Parsed = extract_all(@"(\/usr\/sbin\/\w+|\/bin\/\w+|\/usr\/bin\/\w+)", SyslogMessage)
| project TimeGenerated, Computer, SyslogMessage
| summarize count() by Computer, bin(TimeGenerated, 5m);
// Second lens: PHP files appearing in uploads (file integrity / auditd via CommonSecurityLog or Syslog)
let PhpInUploads =
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has "wp-content/uploads" and SyslogMessage has_any (".php", ".phtml", ".phar")
| project TimeGenerated, Computer, ProcessName, SyslogMessage;
// Third lens: authentication pressure on wp-login / xmlrpc (CEF web logs)
let AuthPressure =
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has_any ("wp-login.php", "xmlrpc.php") and RequestMethod == "POST"
| summarize Hits = count() by SourceIP, RequestURL, bin(TimeGenerated, 5m)
| where Hits > 10;
ShellSpawn
| union PhpInUploads
| union (AuthPressure | project TimeGenerated, Computer = SourceIP, SyslogMessage = strcat("Login pressure: ", Hits, " POSTs to ", RequestURL))
| order by TimeGenerated desc

-- WordPress RCE triage: PHP files recently written under web content dirs AND web-stack shell children
-- Part 1: Suspicious PHP artifacts in uploads/cache (potential web shells)
LET shell_files = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  '/var/www/html/**/wp-content/uploads/*.php',
  '/var/www/html/**/wp-content/uploads/*.phtml',
  '/var/www/html/**/wp-content/cache/*.php',
  '/usr/share/wordpress/**/wp-content/uploads/*.php'
])
WHERE Mtime > now() - 604800

-- Part 2: Web server / PHP-FPM processes with shell or interpreter children
LET shell_children = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)^(bash|sh|dash|python3?|perl|nc|ncat|socat)$'
  AND Ppid IN (
    SELECT Pid FROM pslist()
    WHERE Name =~ '(?i)(httpd|apache2|nginx|php-fpm)'
  )

SELECT 'shell_file' AS Finding, FullPath AS Detail, Mtime AS EventTime FROM shell_files
UNION ALL
SELECT 'shell_child' AS Finding,
       format('PID %v (%v) cmd: %v user: %v', args=[Pid, Name, CommandLine, Username]) AS Detail,
       CreateTime AS EventTime
FROM shell_children

#!/usr/bin/env bash
# FEDORA-2026-61704c09ea - WordPress 6.9.7 patch & verify script
set -euo pipefail

echo "=== [1/4] Current wordpress package version ==="
rpm -q wordpress || { echo "wordpress RPM not installed on this host."; exit 0; }

echo "=== [2/4] Applying Fedora security update (FEDORA-2026-61704c09ea) ==="
dnf -y upgrade wordpress --advisory FEDORA-2026-61704c09ea

echo "=== [3/4] Verifying fixed version (expect 6.9.7 or newer) ==="
INSTALLED=$(rpm -q --queryformat '%{VERSION}' wordpress)
echo "Installed wordpress version: ${INSTALLED}"
if [[ "${INSTALLED}" < "6.9.7" ]]; then
  echo "[!] WARNING: Version is still below 6.9.7 — do not consider this host remediated."
  exit 1
fi

echo "=== [4/4] Post-patch web-shell sweep (PHP in uploads, recent modifications) ==="
for DOCROOT in /var/www/html /usr/share/wordpress; do
  [ -d "${DOCROOT}" ] || continue
  echo "-- Scanning ${DOCROOT} --"
  find "${DOCROOT}" -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \) \
    -path '*wp-content/uploads/*' -mtime -14 -printf '%T+ %p\n' 2>/dev/null || true
  find "${DOCROOT}" -type f -name '*.php' -mtime -3 -printf '%T+ %p\n' 2>/dev/null | head -50 || true
done

echo "=== Restarting web stack to clear any in-memory payloads ==="
systemctl try-restart httpd php-fpm 2>/dev/null || systemctl try-restart nginx php-fpm 2>/dev/null || true

echo "Done. Investigate any PHP files listed above under uploads/ before assuming the host is clean."