wp2shell Attack Chain: Detecting WordPress Plugin Drops and Command Execution

Security Arsenal is tracking the active exploitation of the "wp2shell" attack chain, a critical threat targeting WordPress environments. Recently detailed by Elastic Security Labs, this campaign demonstrates how adversaries are leveraging pre-authentication vulnerabilities in WordPress plugins to achieve Remote Code Execution (RCE). The attack progression is rapid: from an initial plugin drop to the establishment of a persistent web shell. For defenders, this represents a severe risk. The ubiquity of WordPress makes it a prime target, and the wp2shell chain bypasses standard authentication, allowing attackers to compromise servers simply by finding a vulnerable plugin. Immediate action is required to identify signs of compromise and patch vulnerable entry points.

Technical Analysis

The wp2shell attack chain focuses on the exploitation of vulnerable WordPress plugins to introduce arbitrary code execution capabilities on the host server.

• Affected Products: WordPress installations running unpatched or third-party plugins susceptible to file upload or object injection vulnerabilities.
• Platform: Linux web servers (Apache/Nginx with PHP).
• Attack Vector: Pre-authentication RCE. The attacker does not require valid credentials to exploit the flaw.
• Mechanism: The attacker sends a crafted request to the vulnerable plugin endpoint. This request triggers the upload or installation of a malicious component (often a "plugin drop") that contains a web shell. Once the file is on the disk, the web server (e.g., www-data user context via Apache or Nginx) executes the PHP code, spawning a shell (e.g., /bin/bash, /bin/sh). This effectively hands the attacker full control over the host, allowing for lateral movement, data exfiltration, or ransomware deployment.
• Exploitation Status: Confirmed active exploitation in the wild. Proof-of-concept (PoC) code is circulating, making this a high-priority threat for SOC teams.

Detection & Response

Defending against wp2shell requires visibility into process lineage and file system anomalies. A standard web server should rarely, if ever, spawn a system shell directly. Similarly, the creation of PHP files in upload directories is a critical red flag.

SIGMA Rules

The following Sigma rules target the core behaviors of the wp2shell chain: the anomalous spawning of a shell by a web server process and the creation of executable PHP scripts in non-standard directories.

---
title: WordPress Web Shell Execution via Web Server
id: 8a1b2c3d-4e5f-6789-0123-456789abcdef
status: experimental
description: Detects web server processes (Apache/Nginx/PHP) spawning system shells, a strong indicator of wp2shell or web shell activity.
references:
  - https://www.elastic.co/security-labs/wp2shell-wordpress-rce-detection-elastic-defend
author: Security Arsenal
date: 2026/04/22
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
      - 'apache2'
      - 'nginx'
      - 'httpd'
      - 'php-fpm'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/zsh'
      - '/perl'
  condition: selection
falsepositives:
  - Legitimate administrative scripts executed via web interface (rare)
level: high
---
title: WordPress Uploads Directory PHP File Creation
id: b2c3d4e5-6f78-9012-3456-7890abcdef12
status: experimental
description: Detects creation of PHP files in the WordPress uploads directory, a common tactic for malicious plugin drops.
references:
  - https://www.elastic.co/security-labs/wp2shell-wordpress-rce-detection-elastic-defend
author: Security Arsenal
date: 2026/04/22
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/wp-content/uploads/'
    TargetFilename|endswith:
      - '.php'
  condition: selection
falsepositives:
  - Plugins that legitimately require PHP execution in uploads (very rare)
level: high

KQL (Microsoft Sentinel / Defender)

Use this KQL query to hunt for suspicious parent-child process relationships in your environment. This query looks for web server processes spawning shells or scripting interpreters.

// Hunt for web server processes spawning shells or scripts
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("apache2", "nginx", "httpd", "php-fpm")
| where FileName in~ ("sh", "bash", "zsh", "perl", "python", "php")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by Timestamp desc

Velociraptor VQL

This Velociraptor VQL artifact hunts for PHP files created within the last 7 days in the wp-content/uploads directory and identifies processes where a web server parent has spawned a shell.

-- Hunt for suspicious PHP files in WordPress uploads directories
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='/*/wp-content/uploads/**/*.php')
WHERE Mtime > now() - 7 * 86400
-- Hunt for suspicious parent-child process relationships (Webserver -> Shell)
SELECT Pid, Ppid, Name, Exe, CommandLine
FROM pslist()
WHERE Pid in (
    SELECT Pid FROM pslist()
    WHERE Name =~ 'apache|nginx|php-fpm'
) AND Name =~ 'sh|bash|perl|python'

Remediation Script

This Bash script assists in the identification of potentially malicious PHP files in upload directories. Note that manual verification is required before deletion to prevent service disruption.

#!/bin/bash

# wp2shell Artifact Scanner
# Scans for recently created PHP files in wp-content/uploads

echo "Scanning for recently modified PHP files in wp-content/uploads (last 7 days)..."

# Find PHP files in uploads modified in the last 7 days
find /var/www/html -path "*/wp-content/uploads/*.php" -mtime -7 -ls

echo ""
echo "Action Item: Review the files listed above."
echo "If a file is confirmed malicious, remove it and audit the specific plugin that allowed the upload."

# Check for web server processes currently running shells (Snapshot check)
echo ""
echo "Checking for web server processes running shells..."
ps aux | grep -E '(apache|nginx|php-fpm)' | grep -E 'sh|bash|perl' | grep -v grep

Remediation

To effectively remediate and protect against the wp2shell attack chain, perform the following steps immediately:

1. Patch and Update: Audit all installed WordPress plugins. Update to the latest version immediately. If a plugin is no longer maintained or has known unpatched vulnerabilities, remove it entirely.
2. IOA Review: Review the results of the detection scripts above. Any confirmed web shells must be deleted, and the underlying vulnerability (the specific plugin) must be addressed immediately.
3. File Permissions: Harden the wp-content/uploads/ directory. Ensure that the web server user (e.g., www-data) does not have execute permissions on files within this directory. Configuration should generally be:
   • Directories: 755
   • Files: 644
   • Specifically, prevent .php execution in the uploads directory via web server configuration (e.g., .htaccess in Apache or location blocks in Nginx).
4. WAF Configuration: Implement Web Application Firewall (WAF) rules to block known exploit patterns associated with vulnerable plugins and common web shell upload requests.
5. Vendor Advisory: Refer to the specific plugin vendor's advisory for the exact patched version. For general guidance, monitor the Elastic Security Labs release for additional IOCs.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub