[[ fm.text ]] Click here

High confidence WordPress registration abuse creating admin account - STRICT

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown

Detects WordPress registration abuse that attempts or completes hidden administrator creation. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity. Détecte l'abus de registration WordPress qui tente ou réussit a creer un compte administrateur cache. La regle combine les marqueurs de role, les mots de registration, les champs de creation de compte et la reponse succes sur admin-ajax.php. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.

title: High confidence WordPress registration abuse creating admin account - STRICT
id: 1492a6ed-70f4-4b1b-9f8f-202614920002
status: experimental
description: |
  Detects WordPress registration abuse that attempts or completes hidden administrator creation. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  Détecte l'abus de registration WordPress qui tente ou réussit a creer un compte administrateur cache. La regle combine les marqueurs de role, les mots de registration, les champs de creation de compte et la reponse succes sur admin-ajax.php. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
references:
  - https://www.techradar.com/pro/security/hackers-exploiting-wordpress-membership-plugin-bug-to-create-admin-accounts
  - https://www.techradar.com/pro/security/update-immediately-60-000-wordpress-websites-at-risk-after-experts-discover-flaw-that-allows-hackers-to-create-hidden-admin-accounts

author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-06-27

tags:
  - attack.initial-access
  - attack.persistence
  - attack.t1190
  - attack.t1136
  - cve.2026-1492

logsource:
  category: webserver
  definition: >
    Web server or WAF access logs with request body inspection. Fields expected: UriPath,
    QueryString, RequestBody, HttpMethod, StatusCode and UserAgent.

detection:
  selection_post:
    HttpMethod: POST

  selection_wordpress_ajax:
    UriPath|contains:
      - '/wp-admin/admin-ajax.php'
      - '/wp-json/'

  selection_role_admin:
    RequestBody|contains:
      - 'administrator'
      - 'role=administrator'
      - 'role=admin'
      - 'role":"administrator'
      - 'wp_capabilities'
      - 'user_role=administrator'

  selection_action_markers:
    RequestBody|contains:
      - 'action=register'
      - 'action=user_registration'
      - 'action=ur_register'
      - 'action=ur_action'
      - 'user-registration'
      - 'user_registration'

  selection_account_fields:
    RequestBody|contains:
      - 'user_login='
      - 'user_email='
      - 'user_pass='
      - 'display_name='
      - 'user_role='
      - 'wp_capabilities'
      - 'role='

  selection_success:
    StatusCode:
      - 200
      - 201
      - 302

  # selection_action_markers is required (not OR'd with registration_words) because the CVE exploit
  # routes through the plugin's own AJAX action handlers (ur_register, ur_action). Generic
  # registration vocabulary words are removed from the condition anchor - an attacker who
  # avoids plugin-specific action names cannot exploit this vulnerability path.
  condition: selection_post and selection_wordpress_ajax and selection_role_admin and selection_action_markers and selection_account_fields and selection_success

fields:
  - UriPath
  - QueryString
  - RequestBody
  - HttpMethod
  - StatusCode
  - UserAgent

falsepositives:
  - Internal staging tests
  - Explicit plugin validation
  - Admin training workflows

level: high

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

8ee6d470-232b-4ffb-a1af-9cd3d676e49e

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion