WordPress Core Unauthenticated RCE: 63,000 Attack Attempts in 24 Hours — Detection, Hardening & Remediation Guide

#!/bin/bash
# Identify WordPress installations and check versions
# Run on web servers or via configuration management

WEB_ROOTS=("/var/www/html" "/var/www" "/srv/www" "/home/*/public_html")

for root in "${WEB_ROOTS[@]}"; do
    if [ -d "$root" ]; then
        find "$root" -name "wp-includes" -type d 2>/dev/null | while read wpdir; do
            version_file="$wpdir/version.php"
            if [ -f "$version_file" ]; then
                version=$(grep -oP "\$wp_version = '\K[^']+" "$version_file")
                echo "WordPress found: $wpdir | Version: $version"
                
                # Check if version is vulnerable (4.7 through 7.1.3)
                if [[ "$version" =~ ^[4-7]\. ]]; then
                    major=$(echo "$version" | cut -d. -f1)
                    minor=$(echo "$version" | cut -d. -f2)
                    patch=$(echo "$version" | cut -d. -f3)
                    
                    if [ "$major" -lt 7 ] || { [ "$major" -eq 7 ] && [ "$minor" -le 1 ] && [ "${patch:-0}" -le 3 ]; }; then
                        echo "  ⚠️  VULNERABLE — PATCH IMMEDIATELY"
                    else
                        echo "  ✅ Patched version"
                    fi
                fi
            fi
        done
    fi
done

---
title: WordPress Core RCE Exploitation — Suspicious HTTP POST Patterns
id: 8f3a2c91-4b7d-4e5a-9c1f-2d6e8a3b5f7c
status: experimental
description: Detects suspicious HTTP POST requests to WordPress Core files consistent with unauthenticated RCE exploitation attempts.
references:
  - https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html
author: Security Arsenal
date: 2026/10/08
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: apache
detection:
  selection:
    http_method: 'POST'
    uri_path|contains:
      - '/wp-admin/'
      - '/wp-includes/'
      - '/wp-content/uploads/'
      - '/xmlrpc.php'
      - '/wp-json/'
    http_status:
      - 200
      - 302
      - 500
  filter_known_good:
    uri_path|contains:
      - '/wp-admin/admin-ajax.php'
      - '/wp-admin/post.php'
  condition: selection and not filter_known_good
falsepositives:
  - Legitimate WordPress admin activity
  - Content publishing workflows
level: high
---
title: WordPress RCE Post-Exploitation — Web Shell Upload
id: 3d7f9e2a-6c4b-4a1d-8f5e-1b3c7d9e2f4a
status: experimental
description: Detects creation of PHP files in WordPress uploads directory, a common post-exploitation behavior following RCE.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/08
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/wp-content/uploads/'
      - '/wp-content/plugins/'
      - '/wp-content/themes/'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php3'
      - '.php4'
      - '.php5'
      - '.php7'
  filter_images:
    TargetFilename|contains:
      - '.jpg'
      - '.png'
      - '.gif'
  condition: selection and not filter_images
falsepositives:
  - Legitimate plugin or theme installation via WordPress admin
level: critical
---
title: Web Server Spawning Suspicious Child Processes
id: 5e1a8c3f-9b2d-4f7a-8c6e-3d5b9a1f7e2c
status: experimental
description: Detects web server processes (Apache, Nginx, PHP-FPM) spawning command shells or scripting interpreters, indicative of successful RCE exploitation.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/08
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
      - '/nginx'
      - '/php-fpm'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/netcat'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate backup scripts or maintenance tasks (rare on production web servers)
level: critical

// Hunt for suspicious POST requests to WordPress Core endpoints
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceProduct contains "Apache" or DeviceProduct contains "Nginx"
| where RequestMethod == "POST"
| where RequestURL has_any ("/wp-admin/", "/wp-includes/", "/xmlrpc.php", "/wp-json/")
| where not(RequestURL has "admin-ajax.php")  // Filter common legitimate endpoint
| extend SourceIP_Type = iff(ipv4_is_private(SourceIP), "Private", "Public")
| summarize RequestCount = count(), UniqueURIs = dcount(RequestURL) by SourceIP, SourceIP_Type, RequestURL, bin(TimeGenerated, 1h)
| where RequestCount > 10 or UniqueURIs > 3  // Threshold for scanning behavior
| sort by RequestCount desc

// Detect web server processes spawning shells or interpreters (Linux via Syslog/CEF)
Syslog
| where TimeGenerated > ago(24h)
| where ProcessName in ("apache2", "httpd", "nginx", "php-fpm")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "python", "perl", "nc ", "netcat", "curl", "wget")
| extend ParsedMessage = parse SyslogMessage with * "cmd=" CommandLine ";" *
| project TimeGenerated, Computer, ProcessName, CommandLine, SourceIP = HostIP
| sort by TimeGenerated desc

// Hunt for PHP file creation in WordPress directories (requires MDE on Linux)
DeviceFileEvents
| where TimeGenerated > ago(24h)
| where FolderPath has_any ("/wp-content/uploads/", "/wp-content/plugins/", "/wp-content/themes/")
| where FileName endswith ".php" or FileName endswith ".phtml"
| extend IsSuspicious = iff(
    InitiatingProcessFileName in~ ("apache2", "httpd", "nginx", "php-fpm"), 
    "High - Created by web server", 
    "Medium"
  )
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, IsSuspicious
| sort by TimeGenerated desc

-- Hunt for PHP web shells in WordPress directories
SELECT 
    FullPath,
    Size,
    Mtime AS ModifiedTime,
    Ctime AS CreatedTime,
    Mode AS Permissions
FROM glob(globs='/var/www/**/wp-content/uploads/**/*.php')
WHERE Size < 100000  -- Web shells are typically small
ORDER BY ModifiedTime DESC

-- Hunt for suspicious processes spawned by web server
SELECT 
    Pid,
    Ppid,
    Name,
    Exe,
    CommandLine,
    Username,
    CreateTime
FROM pslist()
WHERE 
    (Name =~ 'apache|nginx|php-fpm' OR Exe =~ 'apache|nginx|php-fpm')
    AND Ppid > 0
    AND (
        CommandLine =~ '/bin/(sh|bash|dash)' 
        OR CommandLine =~ 'python|perl|nc|netcat|curl.*http|wget.*http'
    )
ORDER BY CreateTime DESC

-- Hunt for network connections from web server processes (potential C2 or exfiltration)
SELECT 
    Pid,
    Name,
    Status,
    LocalAddr,
    LocalPort,
    RemoteAddr,
    RemotePort,
    CommandLine
FROM netstat()
WHERE 
    (Name =~ 'apache|nginx|php-fpm' OR CommandLine =~ 'apache|nginx|php-fpm')
    AND Status =~ 'ESTABLISHED'
    AND NOT RemoteAddr =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|127\.)'  -- Exclude private IPs
ORDER BY RemoteAddr

#!/bin/bash
# Verify WordPress version after patching

WP_PATH="/var/www/html"  # Adjust to your WordPress root

if [ -f "$WP_PATH/wp-includes/version.php" ]; then
    version=$(grep -oP "\$wp_version = '\K[^']+" "$WP_PATH/wp-includes/version.php")
    echo "Current WordPress version: $version"
    
    # Check if patched (7.1.4 or later)
    if [[ "$version" =~ ^7\. ]] || [[ "$version" =~ ^[8-9]\. ]]; then
        major=$(echo "$version" | cut -d. -f1)
        minor=$(echo "$version" | cut -d. -f2)
        patch=$(echo "$version" | cut -d. -f3)
        
        if [ "$major" -gt 7 ] || { [ "$major" -eq 7 ] && { [ "$minor" -gt 1 ] || { [ "$minor" -eq 1 ] && [ "${patch:-0}" -ge 4 ]; }; }; }; then
            echo "✅ PATCHED — Version is 7.1.4 or later"
        else
            echo "❌ VULNERABLE — Patch not applied correctly"
        fi
    else
        echo "❌ VULNERABLE — Version is still in the affected range"
    fi
else
    echo "ERROR: WordPress not found at $WP_PATH"
fi

define( 'WP_AUTO_UPDATE_CORE', true );

# Apache .htaccess example
<Files xmlrpc.php>
    Order Deny,Allow
    Deny from all
    Allow from 203.0.113.0/24  # Replace with your IP range
</Files>

# Set ownership and permissions
chown -R www-data:www-data /var/www/html
find /var/www/html -type d -exec chmod 755 {} \;
find /var/www/html -type f -exec chmod 644 {} \;

# Make wp-config.php read-only
chmod 440 /var/www/html/wp-config.php