Forminator Uploaded PHP File Written to WordPress Uploads - STRICT
SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown
Detects a web or PHP runtime writing an executable PHP file into a WordPress uploads directory, a strong post-upload indicator for CVE-2026-15748. Correlate with a later HTTP access or PHP execution event. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Détecte l’écriture par le serveur web ou PHP d’un fichier exécutable dans uploads WordPress. Corréler avec un accès HTTP ou une exécution PHP ultérieure. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
title: Forminator Uploaded PHP File Written to WordPress Uploads - STRICT
id: b4d3d2bf-4c3a-4fb1-a4c7-7ed48bf99f3d
status: experimental
description: |
Detects a web or PHP runtime writing an executable PHP file into a WordPress uploads directory, a strong post-upload indicator for CVE-2026-15748. Correlate with a later HTTP access or PHP execution event. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Détecte l’écriture par le serveur web ou PHP d’un fichier exécutable dans uploads WordPress. Corréler avec un accès HTTP ou une exécution PHP ultérieure. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-15748
- https://www.ionix.io/threat-center/cve-2026-15748/
- https://github.com/HORKimhab/CVE-2026-15826-CVE-2026-15748
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-08-19
logsource:
product: linux
category: file_event
detection:
selection_writer:
Image|endswith: [php, php-fpm, php-fpm8.1, php-fpm8.2, php-fpm8.3, apache2, httpd, nginx]
selection_upload_path:
TargetFilename|contains: '/wp-content/uploads/'
selection_executable:
TargetFilename|endswith: [.php, .phtml, .php5, .phar]
condition: selection_writer and selection_upload_path and selection_executable
fields: [UtcTime, Computer, User, Image, TargetFilename, CreationUtcTime, ProcessId]
falsepositives: [Authorized PHP maintenance scripts stored in uploads, Security testing in a dedicated lab]
level: high
tags: [attack.execution, attack.persistence, attack.t1505.003, cve.2026-15748]