This morning I’ve started to see exploitation attempts on pwndefend.com (they all failed because like about 80% of sites (based on sampling) this site automatically patched, but also, this site has word fence, is fronted by Cloudflare.

Global Exposure

On the 18th (AM) I did sampling of about 3.5K hosts and found ~20% were not patched. The cyber apocalypse is not seemingly here today! (let alone the fact that if every WordPress site was popped, the world would probably not end)

The DFIR Lab

I’ve built a small docker based lab to test/dev exploits and show what to look for from an IR/DFIR pov.

You can see here that the site is set to update automatically (I’m just seeing in this case why that hasn’t occurred, for this we don’t want it to!)

This is occurring because of how the docker image we have made is constructed and the fact we keep resetting it. (which should not be a typical way people would deploy this!)

when we see exploitation what do we see?

Artifacts in WordPress, new users, new plugins

Now this is in the lab, in the real world you might see TA’s doing something differently.

There are a few routes:

1. use SQLi to dump the admin hashes, crack the hashes and then log in as admin! Upload a webshell.
2. use the no crack method to create create a new user (admin) then upload a webshell

Once a TA has admin access they can install new plugins, they can edit existing php files to install webshells etc.

Real World Logs

From this site we can see real world activity here:

62.113.210.14 - - [19/Jul/2026:00:06:22 +0100] "GET / HTTP/1.1" 200 21804 "-" "Mozilla/5.0"
62.113.210.14 - - [19/Jul/2026:00:06:22 +0100] "GET /wp-json/ HTTP/1.1" 200 228033 "-" "Mozilla/5.0"
62.113.210.14 - - [19/Jul/2026:00:06:23 +0100] "GET /wp-json/batch/v1 HTTP/1.1" 403 22109 "-" "Mozilla/5.0"
62.113.210.14 - - [19/Jul/2026:00:06:24 +0100] "GET /?rest_route=/batch/v1 HTTP/1.1" 403 17375 "-" "Mozilla/5.0"
62.113.210.14 - - [19/Jul/2026:00:06:25 +0100] "GET / HTTP/1.1" 200 21802 "-" "wp2shell"
62.113.210.14 - - [19/Jul/2026:00:06:30 +0100] "GET /?rest_route=/ HTTP/1.1" 200 223298 "-" "wp2shell"

and here from an IP in Russia:

91.202.233.27 - - [18/Jul/2026:23:02:11 +0100] "GET /wp-json/ HTTP/1.1" 403 11824 "-" "Mozilla/5.0"
91.202.233.27 - - [18/Jul/2026:23:02:12 +0100] "GET /?rest_route=/ HTTP/1.1" 403 11779 "-" "Mozilla/5.0"
91.202.233.27 - - [18/Jul/2026:23:02:12 +0100] "GET / HTTP/1.1" 403 11779 "-" "Mozilla/5.0"

These were from the apache2 access.log

Lab View

Here’s a PDF with a view from exploiting this in the lab:

Summary

A TA with the nocrack exploit can gain root access, however the server has to be: vulnerable (e.g. not patched or running specific versions of WordPress), not protected by a WAF (and the TA not able to bypass the WAF). The cyber apocalypse does not appear to have arrived, but as always lots of work has been done by industry/community to reduce the impact.

As always, the lessons here should be:

• Defence in Depth

and not magic bullets!