HTTP request to dropped PHP web shell in Elementor forms uploads path

Arnold Chan@slaz

•updated Sep 4, 2026•0•0•2

This rule detects inbound HTTP requests directed at known file paths associated with malicious PHP web shells commonly dropped within the Elementor plugin directory of WordPress installations, including attempts to pass parameters to the web shell for command execution.