Mushr00w PHP Web Shell in WordPress Uploads Directory

Arnold Chan@slaz

•updated Sep 4, 2026•0•0•3

Detects the presence of the 'Mushr00w' PHP web shell, typically associated with exploitation of vulnerabilities in WordPress plugins such as Super Forms or Elementor Pro. The rule looks for identifying strings within the file, including specific filenames, HTML title tags, and common PHP file upload function signatures used by this shell.