Rogue WordPress admin account installs plugin shortly after creation (wp2shell RCE)

Emiliano Mema@Nosalva

•updated Jul 22, 2026•4•0•13

This rule detects potentially malicious activity on WordPress servers by correlating the creation of a new administrator account via the REST API with subsequent plugin installation activity and the creation of PHP files within the plugin directory within a one-hour window. This sequence is characteristic of an adversary establishing persistence or backdooring a WordPress site after gaining unauthorized access.