Forminator Unauthenticated PHP Upload Attempt - STRICT
SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown
Detects a suspicious Forminator upload request carrying an executable filename or PHP content indicator, consistent with CVE-2026-15748 exploitation. Confirm with file creation and subsequent access telemetry. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Détecte une requête d’upload Forminator suspecte contenant un nom exécutable ou du contenu PHP. Confirmer avec la création puis l’accès au fichier. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
title: Forminator Unauthenticated PHP Upload Attempt - STRICT
id: 6a5d9b70-17b2-4c7a-bd9e-0b19f41fdd2e
status: experimental
description: |
Detects a suspicious Forminator upload request carrying an executable filename or PHP content indicator, consistent with CVE-2026-15748 exploitation. Confirm with file creation and subsequent access telemetry. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Détecte une requête d’upload Forminator suspecte contenant un nom exécutable ou du contenu PHP. Confirmer avec la création puis l’accès au fichier. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-15748
- https://www.ionix.io/threat-center/cve-2026-15748/
- https://github.com/HORKimhab/CVE-2026-15826-CVE-2026-15748
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-08-19
logsource:
category: webserver
detection:
selection_endpoint_uri:
Uri|contains: ['/wp-admin/admin-ajax.php', '/wp-json/']
selection_endpoint_url:
Url|contains: ['/wp-admin/admin-ajax.php', '/wp-json/']
selection_forminator_query:
QueryString|contains: [forminator, handle_file_upload]
selection_forminator_body:
RequestBody|contains: [forminator, handle_file_upload]
selection_upload:
RequestBody|contains: [multipart/form-data, 'filename=', 'Content-Disposition']
selection_executable:
RequestBody|contains: ['.php', '.phtml', '.php5', '.phar', '<?php', 'application/x-php']
selection_method:
HttpMethod: POST
condition: (selection_endpoint_uri or selection_endpoint_url) and selection_method and (selection_forminator_query or selection_forminator_body) and selection_upload and selection_executable
fields: [EventTime, SourceIp, HttpMethod, Host, Url, Uri, QueryString, RequestBody, ContentType, UserAgent, StatusCode, RequestId]
falsepositives: [Authorized Forminator maintenance or security testing]
level: medium
tags: [attack.initial-access, attack.t1190, attack.t1505.003, cve.2026-15748]