WordPress Core Unauthenticated PHP File Loading Flaw Fixed in 7.1.2: Detection and Remediation Guide

---
title: Web or PHP Worker Spawning Shell on Windows
description: Detects IIS, Apache, Nginx, or PHP CGI processes launching command interpreters after possible WordPress PHP execution.
references:
  - https://thehackernews.com/2026/09/wordpress-issues-patch-for-critical.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/23
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - 'w3wp.exe'
      - 'httpd.exe'
      - 'nginx.exe'
      - 'php-cgi.exe'
      - 'php.exe'
  selection_child:
    Image|contains:
      - 'cmd.exe'
      - 'powershell.exe'
      - 'pwsh.exe'
      - 'wscript.exe'
      - 'cscript.exe'
      - 'mshta.exe'
      - 'rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare admin maintenance launched through a web control panel
  - Legitimate plugin installers that shell out during updates
level: high
---
title: Linux PHP or Web Server Process Executing Suspicious Command Line
description: Detects common Linux web or PHP worker names associated with shell invocation, encoded commands, or download-and-execute patterns after PHP execution.
references:
  - https://thehackernews.com/2026/09/wordpress-issues-patch-for-critical.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/23
status: experimental
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|contains:
      - 'sh'
      - 'bash'
      - 'dash'
      - 'python'
      - 'perl'
      - 'curl'
      - 'wget'
      - 'busybox'
  selection_cli:
    CommandLine|contains:
      - ' -c '
      - 'base64 -d'
      - 'curl '
      - 'wget '
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
      - 'chmod +x'
  selection_parent:
    ParentImage|contains:
      - 'php-fpm'
      - 'php'
      - 'httpd'
      - 'apache2'
      - 'nginx'
  condition: selection_img and selection_cli and selection_parent
falsepositives:
  - Composer, WP-CLI, deployment hooks, and backup jobs if executed through the web user
  - Container health checks that run curl from the same namespace
level: high
---
title: PHP File Request Outside WordPress Theme Roots
description: Detects web requests combining traversal or encoded traversal with a PHP file request outside expected WordPress theme locations.
references:
  - https://thehackernews.com/2026/09/wordpress-issues-patch-for-critical.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/23
status: experimental
logsource:
  category: webserver
  product: apache
  detection: null
detection:
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '%2e%2e'
      - '..\\'
  selection_php:
    cs-uri-query|contains:
      - '.php'
  selection_scope:
    cs-uri-query|contains:
      - 'wp-content/themes'
      - '/tmp/'
      - '/var/tmp/'
      - 'wp-content/uploads'
      - 'wp-content/cache'
  condition: selection_traversal and selection_php and selection_scope
falsepositives:
  - Broken theme or plugin code using relative includes
  - Security scanners and QA traffic
level: medium

let web = dynamic(['w3wp.exe','httpd.exe','nginx.exe','apache2','php-fpm','php-cgi.exe','php.exe']);
let shells = dynamic(['cmd.exe','powershell.exe','pwsh.exe','sh','bash','dash','python','perl','curl','wget','mshta.exe','rundll32.exe']);
union isfuzzy=true
(
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName has_any (web) or InitiatingProcessCommandLine has_any (web)
| where FileName has_any (shells) or ProcessCommandLine has_any (shells)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, FolderPath
),
(
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor in~ ('Apache','nginx','Microsoft','WordPress') or ApplicationProtocol in~ ('http','https')
| where RequestURL has_any ('../','..%2f','%2e%2e') and RequestURL has '.php'
| where RequestURL has_any ('wp-content/uploads','wp-content/cache','/tmp/','/var/tmp/','wp-content/themes')
| project TimeGenerated, SourceIP, DestinationIP, RequestMethod, RequestURL, ResponseCode, DeviceName, DeviceVendor
)
| order by TimeGenerated desc

-- Hunt for web or PHP workers with suspicious child command lines and PHP files outside theme roots
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(php-fpm|php-cgi|php|httpd|apache|nginx|w3wp)'
   OR CommandLine =~ '(?i)(cmd.exe|powershell|pwsh|/bin/sh|/bin/bash|base64 -d|curl |wget |/tmp/|/var/tmp/|/dev/shm/)'

-- Review recently created PHP files in locations that should rarely execute code
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  '/var/www/**/wp-content/uploads/*.php',
  '/var/www/**/wp-content/cache/*.php',
  '/var/www/**/wp-content/backup*/**/*.php',
  '/tmp/*.php',
  '/var/tmp/*.php',
  'C:/inetpub/**/wp-content/uploads/*.php',
  'C:/inetpub/**/wp-content/cache/*.php'
])
ORDER BY Mtime DESC

#!/usr/bin/env bash
# Security Arsenal - WordPress PHP file-loading verification and hardening check
# Run as root or with sudo on the web host. Default is report-only; set APPLY=1 to run WP-CLI update.
set -u
APPLY="${APPLY:-0}"
WP_ROOT="${WP_ROOT:-/var/www/html}"
LOGROOT="${LOGROOT:-/var/log}"

printf '%s
' '[1] WordPress core version and update status'
if command -v wp >/dev/null 2>&1; then
  sudo -u www-data wp --path="$WP_ROOT" core version || true
  sudo -u www-data wp --path="$WP_ROOT" core check-update || true
  sudo -u www-data wp --path="$WP_ROOT" core verify-checksums || true
  if [ "$APPLY" = "1" ]; then
    sudo -u www-data wp --path="$WP_ROOT" core update || true
    sudo -u www-data wp --path="$WP_ROOT" core update-db || true
  fi
else
  grep -H "^\$wp_version" "$WP_ROOT/wp-includes/version.php" 2>/dev/null || true
fi

printf '%s
' '[2] PHP files in writable or non-theme locations'
find "$WP_ROOT/wp-content/uploads" "$WP_ROOT/wp-content/cache" /tmp /var/tmp -type f -name '*.php' -printf '%TY-%Tm-%Td %TH:%TM %u %g %p\n' 2>/dev/null | sort -r | head -200

printf '%s
' '[3] Web logs with traversal plus PHP request markers in the last 24h'
find "$LOGROOT" -type f \( -name '*access*log*' -o -name '*nginx*log*' -o -name '*apache*log*' \) -mtime -1 -print0 2>/dev/null | xargs -0 grep -Ein '([.][.]/|%2e%2e|[.][.]%2f).*[.]php|[.]php.*([.][.]/|%2e%2e|[.][.]%2f)' 2>/dev/null | head -300

printf '%s
' '[4] PHP hardening snapshot'
for ini in /etc/php/*/fpm/php.ini /etc/php/*/apache2/php.ini /etc/php/*/cli/php.ini /etc/php.ini; do
  [ -f "$ini" ] && grep -Hn '^(allow_url_include|allow_url_fopen|expose_php|disable_functions|open_basedir|cgi.fix_pathinfo|file_uploads|upload_tmp_dir)' "$ini" 2>/dev/null
 done

printf '%s
' '[5] Web server PHP execution blocks to review'
grep -RIn 'wp-content/(uploads|cache)|location ~ [.]php|php_flag engine|SetHandler|AddHandler' /etc/nginx /etc/apache2 /etc/httpd 2>/dev/null | head -200

printf '%s
' '[6] Suspicious web-user processes and listeners'
ps -eo user,comm,args | grep -Ei 'www-data|apache|nginx|php-fpm' | grep -Ei 'sh|bash|curl|wget|python|perl|base64|/tmp|/dev/shm' | head -200
ss -lntup 2>/dev/null | head -200