Automattic - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/automattic/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 20 Jul 2026 11:41:12 +0000PHP File Creation in WordPress Plugin Directoryhttps://feed.craftedsignal.io/briefs/2026-07-php-file-creation-wordpress-plugin/Mon, 20 Jul 2026 11:41:12 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-php-file-creation-wordpress-plugin/Attackers commonly establish persistence on compromised Linux WordPress web servers by creating malicious PHP files, often web shells, within the WordPress plugin directory, enabling remote access and command execution following initial compromise of a public-facing application.Threat actors frequently target WordPress installations on Linux web servers to establish persistence through the creation of malicious PHP files, typically web shells. This technique involves an initial compromise, often via a vulnerable public-facing application, followed by the upload or creation of a PHP file within the /wp-content/plugins/ directory. Once deployed, these web shells can be accessed remotely via a web browser, allowing attackers to execute arbitrary commands, exfiltrate data, or further compromise the server and potentially the broader network. This activity is a critical indicator of post-exploitation, even if the initial access vector is unknown, and monitoring such file creations helps detect malicious activity aimed at maintaining long-term unauthorized access.

Attack Chain

  1. An attacker gains initial access to a vulnerable WordPress server, often exploiting a known vulnerability in a plugin, theme, or WordPress core (e.g., CVE-2024-1234, if applicable).
  2. The attacker uses their initial access to upload or create a malicious PHP file, often a web shell, within the /wp-content/plugins/ directory of the WordPress installation.
  3. The malicious PHP file is typically disguised with a name resembling a legitimate plugin file or a common utility script to evade detection.
  4. The attacker accesses the newly created web shell via a web browser, sending specially crafted HTTP requests to invoke its functionality.
  5. The web shell executes the attacker's commands on the underlying Linux operating system.
  6. Through the web shell, the attacker performs actions such as data exfiltration, privilege escalation, or lateral movement within the network.
  7. The web shell serves as a persistent backdoor, allowing the attacker to regain access to the compromised server at will.

Impact

Successful establishment of a PHP web shell in the WordPress plugin directory grants attackers remote code execution capabilities on the compromised Linux server. This can lead to severe consequences including, but not limited to, unauthorized access to sensitive data stored on the server, defacement of the website, use of the server for hosting malicious content (e.g., phishing pages, malware distribution), use as a C2 node, or further compromise of the internal network through lateral movement. The number of potential victims is vast, as WordPress powers a significant portion of the internet's websites, making it a frequent target for financially motivated cybercriminals and state-sponsored groups.

Recommendation

  • Deploy the Sigma rule "Detect PHP File Creation in WordPress Plugin Directory" to your SIEM and tune for your environment.
  • Ensure file_event logging for Linux endpoints is enabled, specifically monitoring file creation and modification events, to activate the rule above.
  • Regularly patch WordPress core, plugins, and themes to mitigate vulnerabilities that could lead to initial access and web shell deployment.
  • Implement file integrity monitoring (FIM) for critical WordPress directories like /wp-content/plugins/ to detect unauthorized file changes.
]]>lowadvisorypersistenceinitial-accessexecutionweb-shellwordpresslinuxendpointthreat-detectionvulnerability