Error en la base de datos de WordPress: [The MySQL server is running with the --read-only option so it cannot execute this statement]
INSERT INTO `wp_options` (`option_name`, `option_value`, `autoload`) VALUES ('_transient_timeout_imunify_security_rules_4.1.3_1793712819_4888070', '1793735743', 'off') ON DUPLICATE KEY UPDATE `option_name` = VALUES(`option_name`), `option_value` = VALUES(`option_value`), `autoload` = VALUES(`autoload`)

Error en la base de datos de WordPress: [The MySQL server is running with the --read-only option so it cannot execute this statement]
INSERT INTO `wp_options` (`option_name`, `option_value`, `autoload`) VALUES ('_transient_imunify_security_rules_4.1.3_1793712819_4888070', 'a:2:{s:7:\"version\";s:8:\"0.1557.1\";s:5:\"rules\";a:67:{s:41:\"RULE-CAMPAIGN-FAKEPLUGIN-INSTALL-BLOCK-01\";a:12:{s:3:\"cve\";s:36:\"CAMPAIGN-FAKEPLUGIN-INSTALL-BLOCK-01\";s:11:\"description\";s:615:\"Blocks upload of known fake-plugin archives at the WordPress plugin\ninstall endpoint. Seed slugs are confirmed malicious backdoor-dropper\nplugins (wp_org_exists=false, shared payload generator signature) that\ninstall further payloads when activated. Fires on the plugin upload\nstep before the zip is extracted, preventing backdoor deployment via\nstolen or compromised admin credentials. The slug denylist should be\nupdated as new IOC slugs are identified via the malware research\npipeline. This rule covers the HTTP install vector; on-disk detection\nis handled by AiBolit recognizers via the malware-team pipeline.\n\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:9;s:4:\"tags\";a:6:{i:0;s:19:\"fake-plugin-install\";i:1;s:15:\"post-compromise\";i:2;s:7:\"dropper\";i:3;s:21:\"php-bkdr-wpplugin-mal\";i:4;s:22:\"admin-credential-abuse\";i:5;s:16:\"wpplugin1-family\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"method\";s:4:\"POST\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:3:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:24:\"~^/wp-admin/update\\.php~\";}i:1;a:3:{s:4:\"name\";s:11:\"ARGS:action\";s:4:\"type\";s:6:\"equals\";s:5:\"value\";s:13:\"upload-plugin\";}i:2;a:3:{s:4:\"name\";s:20:\"FILES:pluginzip:name\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:75:\"~^(platformist-quadendpointer|theme-js-wpcode|framework-triappment)\\.zip$~i\";}}}s:30:\"RULE-CAMPAIGN-IMGCDN-INJECT-01\";a:11:{s:3:\"cve\";s:31:\"CAMPAIGN-2026-W41-IMGCDN-INJECT\";s:11:\"description\";s:44:\"Campaign payload host in request parameters.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:8.8;s:4:\"tags\";a:4:{i:0;s:8:\"campaign\";i:1;s:10:\"stored-xss\";i:2;s:3:\"ioc\";i:3;s:7:\"wp-core\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:4:\"ARGS\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:46:\"~imgcdn1(?:\\.|&#0*46;?|&#x0*2e;?|\\\\u002e)com~i\";}}}s:29:\"RULE-CAMPAIGN-IMGCDN-LOGIN-01\";a:11:{s:3:\"cve\";s:36:\"CAMPAIGN-2026-W41-IMGCDN-MAGIC-LOGIN\";s:11:\"description\";s:34:\"Campaign backdoor login parameter.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:8.1;s:4:\"tags\";a:4:{i:0;s:8:\"campaign\";i:1;s:25:\"post-compromise-signature\";i:2;s:3:\"ioc\";i:3;s:7:\"wp-core\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:2:{s:4:\"name\";s:17:\"ARGS:/^_wplogin$/\";s:4:\"type\";s:6:\"exists\";}}}s:27:\"RULE-CAMPAIGN-IMGCDN-PKG-01\";a:11:{s:3:\"cve\";s:32:\"CAMPAIGN-2026-W41-IMGCDN-PACKAGE\";s:11:\"description\";s:43:\"Campaign plugin in uploaded plugin archive.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:8.8;s:4:\"tags\";a:4:{i:0;s:8:\"campaign\";i:1;s:16:\"malicious-plugin\";i:2;s:3:\"ioc\";i:3;s:7:\"wp-core\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:23:\"FILES:pluginzip:content\";s:4:\"type\";s:8:\"contains\";s:5:\"value\";s:20:\"wp-smart-thumbnails/\";}}}s:27:\"RULE-CAMPAIGN-IMGCDN-PKG-02\";a:11:{s:3:\"cve\";s:32:\"CAMPAIGN-2026-W41-IMGCDN-PACKAGE\";s:11:\"description\";s:53:\"Campaign plugin slug in uploaded plugin archive name.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:8.8;s:4:\"tags\";a:4:{i:0;s:8:\"campaign\";i:1;s:16:\"malicious-plugin\";i:2;s:3:\"ioc\";i:3;s:7:\"wp-core\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:20:\"FILES:pluginzip:name\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:22:\"~wp-smart-thumbnails~i\";}}}s:41:\"RULE-CAMPAIGN-IMGCDN1-DELIVERY-MONITOR-01\";a:11:{s:3:\"cve\";s:34:\"CAMPAIGN-2026-W41-IMGCDN1-DELIVERY\";s:11:\"description\";s:219:\"Observes request parameters referencing the campaign loader host imgcdn1.com (delivered as <script src=https://imgcdn1.com/fz/x.js> in woosb_ids[..][qty] and in Ninja Forms nf_ajax_submit fields), on any plugin version.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:1;s:4:\"tags\";a:4:{i:0;s:7:\"monitor\";i:1;s:12:\"campaign-ioc\";i:2;s:16:\"delivery-attempt\";i:3;s:21:\"infection-unconfirmed\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:4:\"ARGS\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:15:\"~imgcdn1\\.com~i\";}}}s:45:\"RULE-CAMPAIGN-IMGCDN1-HIDDEN-ADMIN-MONITOR-01\";a:12:{s:3:\"cve\";s:38:\"CAMPAIGN-2026-W41-IMGCDN1-HIDDEN-ADMIN\";s:11:\"description\";s:217:\"Observes administrator creation with an @wordpress.org email, the address pattern the x.js payload uses for its hidden admins (user-new.php form or REST /wp/v2/users JSON). The exact creation request is not published.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:1;s:4:\"tags\";a:4:{i:0;s:7:\"monitor\";i:1;s:12:\"campaign-ioc\";i:2;s:25:\"post-compromise-signature\";i:3;s:21:\"infection-unconfirmed\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"method\";s:4:\"POST\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:10:\"ARGS:email\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:22:\"~@wordpress\\.org\\s*$~i\";}i:1;a:3:{s:4:\"name\";s:15:\"ARGS:/^roles?$/\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:18:\"~^administrator$~i\";}}}s:45:\"RULE-CAMPAIGN-IMGCDN1-IMPLANT-ARGS-MONITOR-01\";a:11:{s:3:\"cve\";s:33:\"CAMPAIGN-2026-W41-IMGCDN1-IMPLANT\";s:11:\"description\";s:168:\"Observes request parameters naming the fake plugin wp-smart-thumbnails, such as bulk activation (checked[]) or plugin= in a POST body, which the URI monitor cannot see.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:1;s:4:\"tags\";a:4:{i:0;s:7:\"monitor\";i:1;s:12:\"campaign-ioc\";i:2;s:25:\"post-compromise-signature\";i:3;s:21:\"infection-unconfirmed\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:4:\"ARGS\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:22:\"~wp-smart-thumbnails~i\";}}}s:44:\"RULE-CAMPAIGN-IMGCDN1-IMPLANT-URI-MONITOR-01\";a:11:{s:3:\"cve\";s:33:\"CAMPAIGN-2026-W41-IMGCDN1-IMPLANT\";s:11:\"description\";s:377:\"Observes URIs naming the campaign\'s fake plugin wp-smart-thumbnails (implant paths, plugins.php activation links, REST plugin routes) or its MU-plugin files class-wp-query-<8 hex>.php / class-wp-token-validate.php. Direct requests to an existing implant file reach WordPress only if that file bootstraps it; probes for absent files are routed through index.php and are visible.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:1;s:4:\"tags\";a:4:{i:0;s:7:\"monitor\";i:1;s:12:\"campaign-ioc\";i:2;s:25:\"post-compromise-signature\";i:3;s:21:\"infection-unconfirmed\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:85:\"~wp-smart-thumbnails|/mu-plugins/class-wp-(?:query-[0-9a-f]{8}|token-validate)\\.php~i\";}}}s:44:\"RULE-CAMPAIGN-IMGCDN1-MAGIC-LOGIN-MONITOR-01\";a:11:{s:3:\"cve\";s:40:\"CAMPAIGN-2026-W41-IMGCDN1-BACKDOOR-LOGIN\";s:11:\"description\";s:493:\"Observes the implant\'s magic-login parameter _wplogin=<token> (tokens kept in option fz_emer_login_tokens) on any path and method. The backdoor reads it on init, so it works on any front-end URL, not only wp-login.php; ModSec 77117086 saw 21,495 of 23,718 hits on / over 60 days. _wplogin is not a WordPress core parameter. Where the blocking RULE-CAMPAIGN-IMGCDN-LOGIN-01 is active it registers first and records the incident itself; this monitor keeps the signal where that rule is disabled.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:1;s:4:\"tags\";a:4:{i:0;s:7:\"monitor\";i:1;s:12:\"campaign-ioc\";i:2;s:25:\"post-compromise-signature\";i:3;s:21:\"infection-unconfirmed\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:2:{s:4:\"name\";s:17:\"ARGS:/^_wplogin$/\";s:4:\"type\";s:6:\"exists\";}}}s:36:\"RULE-CAMPAIGN-SC-REST-CMD-CHANNEL-01\";a:11:{s:3:\"cve\";s:29:\"CAMPAIGN-2026-W37-SC-REST-CMD\";s:11:\"description\";s:1049:\"Detects the SC framework REST command channel. SC v2.8.1 registers an\nunauthenticated REST route at /wp-json/<slug>/v1/cmd with Ed25519 request signing,\ncarrying fifteen commands including exec, install_plugin, create_user and inject_js.\nSlugs are generated as a plausible multi-word WordPress feature name plus a four-hex\nsuffix. Observed fleet-wide over seven days: cors-handler-b1fd, cors-handler-1a0f,\nheartbeat-controller-22dc, heartbeat-controller-23cb, shortcode-renderer-f1a4,\ncomment-spam-filter-26e6, image-compression-service-f283, http-request-handler-c12d,\ndeferred-script-loader-9703, post-meta-indexer-5959, admin-bar-optimizer-29c3,\nthumbnail-regenerator-dea4, rest-api-cache-6702, login-throttle-service-eee8. Two base\nnames recurring under different hex suffixes is what confirms generation rather than\nhand-picking. The mandatory four-hex tail on a multi-word prefix is the false-positive\nfloor: other /v1/cmd routes seen in the same window (wab, cg, vs-admin, wpcli-bridge,\nwp-update) do not match and are deliberately excluded.\n\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:9;s:4:\"tags\";a:4:{i:0;s:15:\"post-compromise\";i:1;s:8:\"backdoor\";i:2;s:15:\"command-channel\";i:3;s:21:\"core-fs-path-coverage\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:91:\"~(?:^/wp-json|(?:^|&|\\?)rest_route=)/[a-z0-9]+(?:-[a-z0-9]+)+-[0-9a-f]{4}/v1/cmd([/?&]|$)~i\";}}}s:37:\"RULE-CAMPAIGN-SC-ROGUE-ADMIN-LOGIN-01\";a:12:{s:3:\"cve\";s:32:\"CAMPAIGN-2026-W37-SC-ROGUE-ADMIN\";s:11:\"description\";s:848:\"Detects login attempts using the SC framework\'s generated administrator\naccounts. The framework creates hidden admin users and the operator then authenticates\nwith them normally, so the credential is valid and nothing upstream objects. Observed\nshapes: administrator_<6 hex>, adm_<10 hex>, admin_<10 hex>, backup_<10 digits>,\nindependently documented across ten incident cases by the DEFA case series and\nconfirmed in production at 34,767 wp-login POSTs across 4,199 domains in three days.\nPasswords accompanying them are per-site 24-hex-character strings rather than\ndictionary guesses, which distinguishes this from ordinary brute-force traffic. No\nlegitimate WordPress installation generates usernames of this shape, and the existing\nModSec rule 77433257 does not cover them - it matches usr_<6-10 hex>, a different\nmalware family\'s convention.\n\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:8.5;s:4:\"tags\";a:4:{i:0;s:15:\"post-compromise\";i:1;s:11:\"rogue-admin\";i:2;s:16:\"credential-abuse\";i:3;s:19:\"core-param-coverage\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"method\";s:4:\"POST\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:25:\"~/wp-login\\.php([?#]|$)~i\";}i:1;a:3:{s:4:\"name\";s:8:\"ARGS:log\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:86:\"~^(?:administrator_[0-9a-f]{6}|adm_[0-9a-f]{10}|admin_[0-9a-f]{10}|backup_[0-9]{10})$~\";}}}s:30:\"RULE-CAMPAIGN-SC-SW-CLEANUP-01\";a:12:{s:3:\"cve\";s:22:\"CAMPAIGN-SC-SW-CLEANUP\";s:11:\"description\";s:150:\"A service worker from the SC malware campaign is registered in an administrator\'s browser. It survives server-side cleanup and can re-infect the site.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:9;s:4:\"tags\";a:2:{i:0;s:14:\"client-payload\";i:1;s:14:\"service-worker\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:16:\"imunify-security\";s:8:\"versions\";s:7:\">=4.1.2\";s:11:\"ajax_action\";s:32:\"imunify_security_payload_carrier\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:22:\"client_payload_carrier\";s:4:\"type\";s:13:\"probabilistic\";s:5:\"value\";s:1:\"0\";}}s:7:\"payload\";a:9:{s:7:\"actions\";a:1:{s:6:\"reload\";a:2:{s:7:\"enabled\";b:1;s:6:\"prompt\";a:2:{s:5:\"admin\";s:4:\"none\";s:5:\"login\";s:4:\"none\";}}}s:8:\"contexts\";a:2:{i:0;s:5:\"admin\";i:1;s:5:\"login\";}s:7:\"enabled\";b:1;s:7:\"enforce\";b:1;s:2:\"id\";s:10:\"sw-cleanup\";s:6:\"limits\";a:1:{s:16:\"verdict_ttl_days\";i:7;}s:5:\"match\";a:2:{s:16:\"required_signals\";i:1;s:16:\"script_url_regex\";a:2:{i:0;s:33:\"[?&]sc_[0-9a-fA-F]{6}=1(?:[&#]|$)\";i:1;s:33:\"^[^?#]*/\\?p=[0-9]{8,12}(?:[&#]|$)\";}}s:6:\"schema\";i:1;s:7:\"version\";i:6;}}s:28:\"RULE-CAMPAIGN-SCPB-BEACON-01\";a:11:{s:3:\"cve\";s:29:\"CAMPAIGN-2026-W37-SCPB-BEACON\";s:11:\"description\";s:626:\"Detects the client-side beacon of the sc_pb/sc_c mass-implant campaign.\nThe injected page script polls the site root with sc_pb=<13-digit millisecond\nepoch> as a cache-buster; the implanted mu-plugin answers the request and drives\nan outbound cURL call to the operator infrastructure through the WordPress HTTP\nAPI. 100% of observed values are exactly 13 digits. Production one-day window\n2026-09-08: 502,159 requests across 23,186 domains and 3,482 servers, of which\n98.1% also execute a campaign-shaped dropper file. Zero occurrences fleet-wide\nbefore 2026-09-01. Starts in pass mode pending the false-positive floor check.\n\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:8;s:4:\"tags\";a:4:{i:0;s:15:\"post-compromise\";i:1;s:6:\"beacon\";i:2;s:13:\"mass-campaign\";i:3;s:19:\"core-param-coverage\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:10:\"ARGS:sc_pb\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:13:\"~^[0-9]{13}$~\";}}}s:36:\"RULE-CAMPAIGN-SCPB-CANARY-MONITOR-01\";a:12:{s:3:\"cve\";s:33:\"CAMPAIGN-2026-W37-SCPB-IMPLANT-ID\";s:11:\"description\";s:83:\"Samples SC canary checks carrying sc_c and _r on directory or WordPress login URLs.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:1;s:4:\"tags\";a:4:{i:0;s:7:\"monitor\";i:1;s:25:\"post-compromise-signature\";i:2;s:21:\"infection-unconfirmed\";i:3;s:19:\"sampled-observation\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"method\";s:3:\"GET\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:5:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:176:\"~\\A/(?:[^/?#\\r\\n]+/)*(?:wp-login\\.php)?\\?(?=(?:[^&]*&)*sc_c=[0-9a-f]{16}(?:&|\\z))(?=(?:[^&]*&)*_r=[0-9]{6}(?:&|\\z))[A-Za-z0-9_-]+=[^?&#\\r\\n]*(?:&[A-Za-z0-9_-]+=[^?&#\\r\\n]*)*\\z~\";}i:1;a:3:{s:4:\"name\";s:26:\"REQUEST_HEADERS:User-Agent\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:18:\"~^WordPress/[0-9]~\";}i:2;a:3:{s:4:\"name\";s:9:\"ARGS:sc_c\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:18:\"~\\A[0-9a-f]{16}\\z~\";}i:3;a:3:{s:4:\"name\";s:7:\"ARGS:_r\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:14:\"~\\A[0-9]{6}\\z~\";}i:4;a:2:{s:4:\"type\";s:13:\"probabilistic\";s:5:\"value\";s:6:\"0.0005\";}}}s:40:\"RULE-CAMPAIGN-SCPB-HIDDEN-DIR-MONITOR-01\";a:11:{s:3:\"cve\";s:33:\"CAMPAIGN-2026-W37-SCPB-HIDDEN-DIR\";s:11:\"description\";s:925:\"Monitors direct HTTP access to the campaign hidden payload directory\nwp-content/.sc_<8 hex>/. No WordPress distribution, plugin or theme ships a\ndot-prefixed directory under wp-content, so the path cannot resolve on a clean\ninstallation and every hit is attacker or researcher traffic by construction\n(zero false-positive floor). The directory holds the implant module set\n(.g_/.gr_/.gs_/.gm_/.gv_/.gk_/.gl_/.gsu_ plus own_<8hex>.php and the\ncore_<8hex>.php kill switch) and the implant writes its own .htaccess there,\nso a probe is likely denied before PHP executes. That is why PHP-layer\ntelemetry records nothing on this surface and why a request-layer rule is the\ninstrument that can answer whether it is probed at all. Ships pass with\nblock_policy: never_block — it is a monitor by design, and the release\npipeline must not auto-promote it into an enforcing rule on the strength of\na zero-false-positive record alone.\n\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:2;s:4:\"tags\";a:5:{i:0;s:21:\"post-compromise-probe\";i:1;s:27:\"filesystem-planted-backdoor\";i:2;s:16:\"hidden-directory\";i:3;s:7:\"monitor\";i:4;s:21:\"core-fs-path-coverage\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:32:\"~/wp-content/\\.sc_[0-9a-f]{8}/~i\";}}}s:32:\"RULE-CAMPAIGN-SCPB-IMPLANT-ID-01\";a:11:{s:3:\"cve\";s:33:\"CAMPAIGN-2026-W37-SCPB-IMPLANT-ID\";s:11:\"description\";s:750:\"Detects the per-site implant identifier of the sc_pb/sc_c mass-implant\ncampaign. The implanted loader answers requests carrying sc_c=<16 lowercase hex>\non / and /wp-login.php. The value is constant per victim host (one distinct\nvalue per domain across a full production day), which makes it an implant ID\nrather than a cache-buster. This parameter had zero occurrences fleet-wide\nbefore 2026-09-01 and reached 45,986 distinct domains by 2026-09-08, a growth\nshape no legitimately-distributed plugin produces. Starts in pass mode so the\nrelease pipeline can confirm the false-positive floor before promotion.\nThis rule does NOT remediate the compromise; it severs one implant control\nchannel and routes the host to filesystem-integrity investigation.\n\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:8.5;s:4:\"tags\";a:4:{i:0;s:15:\"post-compromise\";i:1;s:23:\"implant-control-channel\";i:2;s:13:\"mass-campaign\";i:3;s:19:\"core-param-coverage\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:9:\"ARGS:sc_c\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:16:\"~^[0-9a-f]{16}$~\";}}}s:42:\"RULE-CAMPAIGN-SCPB-IMPLANT-ID-COMPANION-01\";a:11:{s:3:\"cve\";s:33:\"CAMPAIGN-2026-W37-SCPB-IMPLANT-ID\";s:11:\"description\";s:245:\"Relaxed sampling sibling of RULE-CAMPAIGN-SCPB-IMPLANT-ID-01. Matches\nany sc_c value regardless of shape so that operator rotation of the identifier\nformat (length or alphabet) is visible as companion>0 while primary=0. Never\npromoted to block.\n\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:1;s:4:\"tags\";a:2:{i:0;s:17:\"companion-sampler\";i:1;s:13:\"mass-campaign\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:2:{s:4:\"name\";s:9:\"ARGS:sc_c\";s:4:\"type\";s:6:\"exists\";}}}s:38:\"RULE-CAMPAIGN-SCPB-LOOPBACK-MONITOR-01\";a:12:{s:3:\"cve\";s:29:\"CAMPAIGN-2026-W37-SCPB-BEACON\";s:11:\"description\";s:60:\"Samples SC loopback checks carrying sc_pb on directory URLs.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:1;s:4:\"tags\";a:4:{i:0;s:7:\"monitor\";i:1;s:25:\"post-compromise-signature\";i:2;s:21:\"infection-unconfirmed\";i:3;s:19:\"sampled-observation\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"method\";s:3:\"GET\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:4:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:122:\"~\\A/(?:[^/?#\\r\\n]+/)*\\?(?=(?:[^&]*&)*sc_pb=[0-9]{13}(?:&|\\z))[A-Za-z0-9_-]+=[^?&#\\r\\n]*(?:&[A-Za-z0-9_-]+=[^?&#\\r\\n]*)*\\z~\";}i:1;a:3:{s:4:\"name\";s:26:\"REQUEST_HEADERS:User-Agent\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:18:\"~^WordPress/[0-9]~\";}i:2;a:3:{s:4:\"name\";s:10:\"ARGS:sc_pb\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:15:\"~\\A[0-9]{13}\\z~\";}i:3;a:2:{s:4:\"type\";s:13:\"probabilistic\";s:5:\"value\";s:6:\"0.0005\";}}}s:33:\"RULE-CAMPAIGN-SCPB-WLH-CHANNEL-01\";a:11:{s:3:\"cve\";s:26:\"CAMPAIGN-2026-W37-SCPB-WLH\";s:11:\"description\";s:236:\"Monitors the SC wlhck channel: exactly eight ASCII alphanumeric characters. Historical WLH-CHANNEL-01 also covered wlh_sc; from this split, wlh_sc telemetry belongs to WLH-CHANNEL-02. Parameter shape alone does not establish compromise.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:7.5;s:4:\"tags\";a:4:{i:0;s:15:\"post-compromise\";i:1;s:23:\"implant-control-channel\";i:2;s:13:\"mass-campaign\";i:3;s:19:\"core-param-coverage\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:22:\"ARGS:/wlhck(?![\\s\\S])/\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:20:\"~\\A[0-9A-Za-z]{8}\\z~\";}}}s:33:\"RULE-CAMPAIGN-SCPB-WLH-CHANNEL-02\";a:11:{s:3:\"cve\";s:26:\"CAMPAIGN-2026-W37-SCPB-WLH\";s:11:\"description\";s:212:\"Monitors the SC wlh_sc channel: exactly twelve ASCII alphanumeric characters. Split from historical WLH-CHANNEL-01 so each parameter keeps its observed length. Parameter shape alone does not establish compromise.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:7.5;s:4:\"tags\";a:4:{i:0;s:15:\"post-compromise\";i:1;s:23:\"implant-control-channel\";i:2;s:13:\"mass-campaign\";i:3;s:19:\"core-param-coverage\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:23:\"ARGS:/wlh_sc(?![\\s\\S])/\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:21:\"~\\A[0-9A-Za-z]{12}\\z~\";}}}s:43:\"RULE-CAMPAIGN-SERVICE-WORKER-FETCH-PROBE-01\";a:11:{s:3:\"cve\";s:42:\"CAMPAIGN-2026-W37-SERVICE-WORKER-TELEMETRY\";s:11:\"description\";s:757:\"Telemetry-only sampler. Browsers send the request header\n\"Service-Worker: script\" on service-worker registration and on the periodic\nupdate fetch, so this rule records which WordPress-served URLs are being\nregistered as service workers. A rogue service worker gives an attacker\npersistent client-side MITM on every subsequent navigation, and the\nregistration URL is not otherwise recoverable from any Imunify telemetry\nstream today. Sampling is capped at 1 request in 200 because legitimate PWA\nplugins (SuperPWA, Webpushr, Firebase messaging, PWA for WP) register service\nworkers on 11,598 distinct domains per day; the header alone is not a\ncompromise signal, it is the collection surface that makes rogue registrations\nfindable. Never promoted to block.\n\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:1;s:4:\"tags\";a:3:{i:0;s:9:\"telemetry\";i:1;s:14:\"service-worker\";i:2;s:23:\"client-side-persistence\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:30:\"REQUEST_HEADERS:Service-Worker\";s:4:\"type\";s:6:\"equals\";s:5:\"value\";s:6:\"script\";}i:1;a:2:{s:4:\"type\";s:13:\"probabilistic\";s:5:\"value\";s:5:\"0.005\";}}}s:38:\"RULE-CAMPAIGN-WP-EDITOR-AUTH-COOKIE-02\";a:12:{s:3:\"cve\";s:29:\"CAMPAIGN-2026-WP-EDITOR-ABUSE\";s:11:\"description\";s:100:\"Block WordPress core editor writes that select an administrator and create an authentication cookie.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:9;s:4:\"tags\";a:4:{i:0;s:26:\"authenticated-editor-abuse\";i:1;s:23:\"authentication-backdoor\";i:2;s:15:\"post-compromise\";i:3;s:25:\"wordpress-core-entrypoint\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"method\";s:4:\"POST\";s:11:\"ajax_action\";s:22:\"edit-theme-plugin-file\";s:10:\"conditions\";a:3:{i:0;a:3:{s:4:\"name\";s:13:\"ARGS:/^file$/\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:9:\"~\\.php$~i\";}i:1;a:3:{s:4:\"name\";s:15:\"ARGS:newcontent\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:18:\"~<\\?(?:php\\b|=)?~i\";}i:2;a:3:{s:4:\"name\";s:15:\"ARGS:newcontent\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:846:\"~(?is)(?=.*\\$[A-Za-z_]\\w*(?:\\s|/\\*.*?\\*/|(?:\\/\\/|#)[^\\r\\n]*(?:\\r?\\n|$))*=(?:\\s|/\\*.*?\\*/|(?:\\/\\/|#)[^\\r\\n]*(?:\\r?\\n|$))*\\bget_users(?:\\s|/\\*.*?\\*/|(?:\\/\\/|#)[^\\r\\n]*(?:\\r?\\n|$))*\\((?=[^;]{0,512}\\b(?:role|roles)\\b[^;]{0,512}\\badministrator\\b))(?=.*\\bwp_set_current_user(?:\\s|/\\*.*?\\*/|(?:\\/\\/|#)[^\\r\\n]*(?:\\r?\\n|$))*\\((?:\\s|/\\*.*?\\*/|(?:\\/\\/|#)[^\\r\\n]*(?:\\r?\\n|$))*\\$[A-Za-z_]\\w*(?:\\s|/\\*.*?\\*/|(?:\\/\\/|#)[^\\r\\n]*(?:\\r?\\n|$))*(?:\\[\\s*\\d+\\s*\\])?(?:\\s|/\\*.*?\\*/|(?:\\/\\/|#)[^\\r\\n]*(?:\\r?\\n|$))*->(?:\\s|/\\*.*?\\*/|(?:\\/\\/|#)[^\\r\\n]*(?:\\r?\\n|$))*ID\\b)(?=.*\\bwp_set_auth_cookie(?:\\s|/\\*.*?\\*/|(?:\\/\\/|#)[^\\r\\n]*(?:\\r?\\n|$))*\\((?:\\s|/\\*.*?\\*/|(?:\\/\\/|#)[^\\r\\n]*(?:\\r?\\n|$))*\\$[A-Za-z_]\\w*(?:\\s|/\\*.*?\\*/|(?:\\/\\/|#)[^\\r\\n]*(?:\\r?\\n|$))*(?:\\[\\s*\\d+\\s*\\])?(?:\\s|/\\*.*?\\*/|(?:\\/\\/|#)[^\\r\\n]*(?:\\r?\\n|$))*->(?:\\s|/\\*.*?\\*/|(?:\\/\\/|#)[^\\r\\n]*(?:\\r?\\n|$))*ID\\b)~\";}}}s:43:\"RULE-CAMPAIGN-WP-EDITOR-REQUEST-CALLABLE-01\";a:12:{s:3:\"cve\";s:29:\"CAMPAIGN-2026-WP-EDITOR-ABUSE\";s:11:\"description\";s:111:\"Block WordPress core editor writes that extract request variables and invoke an attacker-selected PHP callable.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:9;s:4:\"tags\";a:4:{i:0;s:26:\"authenticated-editor-abuse\";i:1;s:12:\"php-backdoor\";i:2;s:15:\"post-compromise\";i:3;s:25:\"wordpress-core-entrypoint\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"method\";s:4:\"POST\";s:11:\"ajax_action\";s:22:\"edit-theme-plugin-file\";s:10:\"conditions\";a:3:{i:0;a:3:{s:4:\"name\";s:13:\"ARGS:/^file$/\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:9:\"~\\.php$~i\";}i:1;a:3:{s:4:\"name\";s:15:\"ARGS:newcontent\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:18:\"~<\\?(?:php\\b|=)?~i\";}i:2;a:3:{s:4:\"name\";s:15:\"ARGS:newcontent\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:347:\"~(?is)(?=.*\\bextract(?:\\s|/\\*.*?\\*/|(?:\\/\\/|#)[^\\r\\n]*(?:\\r?\\n|$))*\\((?:\\s|/\\*.*?\\*/|(?:\\/\\/|#)[^\\r\\n]*(?:\\r?\\n|$))*\\$_(?:REQUEST|GET|POST)\\b)(?=.*(?:\\$[A-Za-z_]\\w*|\\bcall_user_func|\\$_(?:REQUEST|GET|POST)\\s*\\[\\s*[\\x22\\x27][A-Za-z_]\\w*[\\x22\\x27]\\s*\\]|\\$\\{\\s*[\\x22\\x27][A-Za-z_]\\w*[\\x22\\x27]\\s*\\})(?:\\s|/\\*.*?\\*/|(?:\\/\\/|#)[^\\r\\n]*(?:\\r?\\n|$))*\\()~\";}}}s:36:\"RULE-CAMPAIGN-WPACCT-ADMIN-CREATE-01\";a:12:{s:3:\"cve\";s:27:\"CAMPAIGN-WPACCT-ADMIN-GRANT\";s:11:\"description\";s:295:\"Observes creation of an administrator through wp-admin/user-new.php, whatever the username. Backdoor accounts are not always named after a known family; every administrator grant is the evidence needed to trace a compromised account to the accounts it created (ModSec 77433249 tracks all roles).\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:1;s:4:\"tags\";a:3:{i:0;s:7:\"monitor\";i:1;s:15:\"privilege-grant\";i:2;s:21:\"infection-unconfirmed\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"method\";s:4:\"POST\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:3:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:36:\"~/wp-admin/user-new\\.php(?:[?#]|$)~i\";}i:1;a:3:{s:4:\"name\";s:11:\"ARGS:action\";s:4:\"type\";s:6:\"equals\";s:5:\"value\";s:10:\"createuser\";}i:2;a:3:{s:4:\"name\";s:9:\"ARGS:role\";s:4:\"type\";s:6:\"equals\";s:5:\"value\";s:13:\"administrator\";}}}s:30:\"RULE-CAMPAIGN-WPACCT-CREATE-01\";a:12:{s:3:\"cve\";s:30:\"CAMPAIGN-WPACCT-KNOWN-BACKDOOR\";s:11:\"description\";s:303:\"Observes a request that submits a known backdoor username as user_login or username on any path (user-new.php, REST /wp/v2/users, registration, plugin AJAX handlers, lost-password). Includes the SC framework shapes and bd_<6 base36>; bd_ also fits some real usernames, which is acceptable for a monitor.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:1;s:4:\"tags\";a:4:{i:0;s:7:\"monitor\";i:1;s:25:\"post-compromise-signature\";i:2;s:11:\"rogue-admin\";i:3;s:22:\"known-backdoor-account\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"method\";s:4:\"POST\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:32:\"ARGS:/^(?:user_login|username)$/\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:347:\"~^(?:admin\\d?backup|wpadminerlzp|adminlin|admin_lin|administratoir|sendsdesr|adminzaxhh34|rxrhack1337|siteseomanager461|admlnlx|serverhostx|adm1n1str4t0r|adm1njabarnews|adm1n_2411|sys_maint|nxploited\\w{0,64}|usr_[a-f0-9]{6,10}|sys_monitor[a-f0-9]{8}|bd_[0-9a-z]{6}|administrator_[0-9a-f]{6}|adm_[0-9a-f]{10}|admin_[0-9a-f]{10}|backup_[0-9]{10})$~i\";}}}s:30:\"RULE-CAMPAIGN-WPACCT-CREATE-02\";a:12:{s:3:\"cve\";s:30:\"CAMPAIGN-WPACCT-KNOWN-BACKDOOR\";s:11:\"description\";s:135:\"Observes a request that submits a known backdoor email address as email or user_email (account creation, registration, profile change).\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:1;s:4:\"tags\";a:4:{i:0;s:7:\"monitor\";i:1;s:25:\"post-compromise-signature\";i:2;s:11:\"rogue-admin\";i:3;s:22:\"known-backdoor-account\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"method\";s:4:\"POST\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:29:\"ARGS:/^(?:email|user_email)$/\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:127:\"~^(?:admin\\d?backup@wordpress\\.org|wpadmin@volovmart\\.ru|sys@localhost\\.local|sys_maint@local\\.com|wordpresupport@\\S{1,253})$~i\";}}}s:29:\"RULE-CAMPAIGN-WPACCT-LOGIN-01\";a:12:{s:3:\"cve\";s:30:\"CAMPAIGN-WPACCT-KNOWN-BACKDOOR\";s:11:\"description\";s:368:\"Observes wp-login.php sign-in attempts with a per-site generated backdoor account (sys_monitor<8 hex>, usr_<6-10 hex>) or a known backdoor email address. Generated names cannot be guessed across sites, so an attempt points at a site where the account exists. SC framework names are covered by RULE-CAMPAIGN-SC-ROGUE-ADMIN-LOGIN-01; fixed names are sampled by LOGIN-02.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:1;s:4:\"tags\";a:4:{i:0;s:7:\"monitor\";i:1;s:25:\"post-compromise-signature\";i:2;s:11:\"rogue-admin\";i:3;s:22:\"known-backdoor-account\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"method\";s:4:\"POST\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:27:\"~/wp-login\\.php(?:[?#]|$)~i\";}i:1;a:3:{s:4:\"name\";s:8:\"ARGS:log\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:169:\"~^(?:usr_[a-f0-9]{6,10}|sys_monitor[a-f0-9]{8}|admin\\d?backup@wordpress\\.org|wpadmin@volovmart\\.ru|sys@localhost\\.local|sys_maint@local\\.com|wordpresupport@\\S{1,253})$~i\";}}}s:29:\"RULE-CAMPAIGN-WPACCT-LOGIN-02\";a:12:{s:3:\"cve\";s:30:\"CAMPAIGN-WPACCT-KNOWN-BACKDOOR\";s:11:\"description\";s:224:\"Samples 1% of wp-login.php sign-in attempts with a fixed-name backdoor account (sys_maint, admin<N>backup, wpadminerlzp, administratoir, adminlin and the rest of the ModSec 77896900 list). These names are sprayed fleet-wide.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:1;s:4:\"tags\";a:4:{i:0;s:7:\"monitor\";i:1;s:22:\"known-backdoor-account\";i:2;s:16:\"credential-spray\";i:3;s:19:\"sampled-observation\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"method\";s:4:\"POST\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:3:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:27:\"~/wp-login\\.php(?:[?#]|$)~i\";}i:1;a:3:{s:4:\"name\";s:8:\"ARGS:log\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:211:\"~^(?:admin\\d?backup|wpadminerlzp|adminlin|admin_lin|administratoir|sendsdesr|adminzaxhh34|rxrhack1337|siteseomanager461|admlnlx|serverhostx|adm1n1str4t0r|adm1njabarnews|adm1n_2411|sys_maint|nxploited\\w{0,64})$~i\";}i:2;a:2:{s:4:\"type\";s:13:\"probabilistic\";s:5:\"value\";s:4:\"0.01\";}}}s:31:\"RULE-CAMPAIGN-WPACCT-PROMOTE-01\";a:12:{s:3:\"cve\";s:27:\"CAMPAIGN-WPACCT-ADMIN-GRANT\";s:11:\"description\";s:219:\"Observes wp-admin/user-edit.php saves that set the role to administrator (ModSec 77488182). The form resubmits the current role, so saving an existing administrator\'s profile also matches; correlate with the prior role.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:1;s:4:\"tags\";a:3:{i:0;s:7:\"monitor\";i:1;s:15:\"privilege-grant\";i:2;s:21:\"infection-unconfirmed\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"method\";s:4:\"POST\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:37:\"~/wp-admin/user-edit\\.php(?:[?#]|$)~i\";}i:1;a:3:{s:4:\"name\";s:9:\"ARGS:role\";s:4:\"type\";s:6:\"equals\";s:5:\"value\";s:13:\"administrator\";}}}s:31:\"RULE-CAMPAIGN-WPACCT-PROMOTE-02\";a:11:{s:3:\"cve\";s:27:\"CAMPAIGN-WPACCT-ADMIN-GRANT\";s:11:\"description\";s:188:\"Observes the wp-admin/users.php bulk \"Change role to\" action granting administrator (new_role or new_role2), which ModSec does not track. The list form submits by GET, so no method is set.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:1;s:4:\"tags\";a:3:{i:0;s:7:\"monitor\";i:1;s:15:\"privilege-grant\";i:2;s:21:\"infection-unconfirmed\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:33:\"~/wp-admin/users\\.php(?:[?#]|$)~i\";}i:1;a:3:{s:4:\"name\";s:19:\"ARGS:/^new_role2?$/\";s:4:\"type\";s:6:\"equals\";s:5:\"value\";s:13:\"administrator\";}}}s:33:\"RULE-CAMPAIGN-WPACCT-REST-ROLE-01\";a:12:{s:3:\"cve\";s:27:\"CAMPAIGN-WPACCT-ADMIN-GRANT\";s:11:\"description\";s:220:\"Observes REST user creation or update (/wp/v2/users, /wp/v2/users/<id>, pretty or ?rest_route= form) that assigns the administrator role, which ModSec does not track. GET listings filtered by role are excluded by method.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:1;s:4:\"tags\";a:3:{i:0;s:7:\"monitor\";i:1;s:15:\"privilege-grant\";i:2;s:21:\"infection-unconfirmed\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"method\";s:4:\"POST\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:115:\"~(?:/wp-json|[?&]rest_route=)(?:/|%2F)wp(?:/|%2F)v2(?:/|%2F)users(?:(?:/|%2F)(?:[0-9]+|me))?(?:/|%2F)?(?:[?#&]|$)~i\";}i:1;a:3:{s:4:\"name\";s:15:\"ARGS:/^roles?$/\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:18:\"~^administrator$~i\";}}}s:31:\"RULE-CAMPAIGN-WPACCT-SESSION-01\";a:11:{s:3:\"cve\";s:30:\"CAMPAIGN-WPACCT-KNOWN-BACKDOOR\";s:11:\"description\";s:319:\"Observes requests carrying a WordPress logged-in cookie that names a known backdoor account (the named and hex-suffixed families above plus the SC framework shapes administrator_<6 hex>, adm_<10 hex>, admin_<10 hex>, backup_<10 digits>). A live session for such an account means the operator is already inside the site.\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:1;s:4:\"tags\";a:4:{i:0;s:7:\"monitor\";i:1;s:25:\"post-compromise-signature\";i:2;s:11:\"rogue-admin\";i:3;s:22:\"known-backdoor-account\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:22:\"REQUEST_HEADERS:Cookie\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:382:\"~(?:^|;)\\s*wordpress_logged_in_[^=;]{1,64}=(?:admin\\d?backup|wpadminerlzp|adminlin|admin_lin|administratoir|sendsdesr|adminzaxhh34|rxrhack1337|siteseomanager461|admlnlx|serverhostx|adm1n1str4t0r|adm1njabarnews|adm1n_2411|sys_maint|nxploited\\w{0,64}|usr_[a-f0-9]{6,10}|sys_monitor[a-f0-9]{8}|administrator_[0-9a-f]{6}|adm_[0-9a-f]{10}|admin_[0-9a-f]{10}|backup_[0-9]{10})(?:\\||%7C)~i\";}}}s:38:\"RULE-CAMPAIGN-WPCONFIG-BACKUP-EXFIL-01\";a:11:{s:3:\"cve\";s:30:\"CAMPAIGN-WPCONFIG-BACKUP-EXFIL\";s:11:\"description\";s:1030:\"Block credential-harvesting recon for wp-config.php derivatives — editor\nswap files (.swp/.swo/.un~/~), operator backups (.bak/.old/.save/.orig),\nand archive/rename artefacts (.zip/.txt/.1/.copy). WordPress core ships\nexactly one wp-config.php and never a suffixed sibling, so a request for\n`wp-config.php<suffix>` is attacker traffic by construction — the same\nzero-FP-floor reasoning as RULE-CAMPAIGN-MAINT-INDEX-01. A hit that\nreturns 200 leaks DB credentials and AUTH_KEY salts verbatim.\n\nEvidence (ClickHouse `incident`, full day 2026-08-20, `plugin_id=\'modsec\'`):\n2,154,801 matching requests across 32,887 distinct servers and 2,106\ndistinct URI variants. Of those, 1,282,803 (59.5%) were NOT denied by any\nexisting rule — this rule closes that pass-through gap. 100% of matching\nrows are `modsec`, i.e. server-side observations that the behaviour exists\nat scale; this is not a measurement of WP-engine coverage. The surface\ncarries no wp-rules coverage today: `wp-config` appears 0 times in\ninitial-rules.yaml.\n\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:7;s:4:\"tags\";a:5:{i:0;s:19:\"credential-exposure\";i:1;s:17:\"config-disclosure\";i:2;s:5:\"recon\";i:3;s:15:\"unauthenticated\";i:4;s:13:\"zero-fp-floor\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:3:\">=0\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:35:\"~^[^?#]*/\\.?wp-config\\.php[^/?#]+~i\";}}}s:24:\"RULE-CAMPAIGN-WPMATES-01\";a:12:{s:3:\"cve\";s:19:\"CAMPAIGN-WPMATES-01\";s:11:\"description\";s:441:\"Blocks requests to /wp-mates.php, a documented planted-backdoor filename\nnot present in WordPress core or any tracked legitimate plugin or theme\ndistribution. Any HTTP request to this path is a post-compromise callback\nprobe from a threat actor confirming the backdoor remains reachable. The\nfile must be removed from the filesystem and admin credentials rotated;\nthis rule blocks the probe but does not remediate the underlying\ncompromise.\n\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:9;s:4:\"tags\";a:5:{i:0;s:21:\"post-compromise-probe\";i:1;s:22:\"dropper-survival-check\";i:2;s:27:\"filesystem-planted-backdoor\";i:3;s:21:\"core-fs-path-coverage\";i:4;s:17:\"wp-mates-backdoor\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:13:\"<=999.999.999\";s:6:\"method\";s:3:\"GET\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:23:\"~^/wp-mates\\.php($|\\?)~\";}}}s:22:\"RULE-CVE-2026-15748-01\";a:12:{s:3:\"cve\";s:14:\"CVE-2026-15748\";s:11:\"description\";s:316:\"Forminator <=1.56.1 unauthenticated arbitrary file upload to RCE via public form submission (server-executable filename on upload-1). Covers this field id only - the engine cannot yet express a scan across every upload field, so an upload sent under any other name is caught by RULE-CVE-2026-15748-05 instead of here\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-15748\";s:8:\"severity\";d:9.8;s:4:\"tags\";a:4:{i:0;s:11:\"file-upload\";i:1;s:21:\"arbitrary-file-upload\";i:2;s:15:\"unauthenticated\";i:3;s:21:\"remote-code-execution\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:8:\"<=1.56.1\";s:6:\"method\";s:4:\"POST\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:11:\"ARGS:action\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:26:\"~^forminator_submit_form_~\";}i:1;a:3:{s:4:\"name\";s:19:\"FILES:upload-1:name\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:55:\"~\\.(?:ph(?:p\\d?|t|tm|tml|ar|ps?)|htaccess|user\\.ini)$~i\";}}}s:22:\"RULE-CVE-2026-15748-02\";a:12:{s:3:\"cve\";s:14:\"CVE-2026-15748\";s:11:\"description\";s:423:\"Forminator <=1.56.1 hardening - PHP-executable filename submitted to the forminator_multiple_file_upload AJAX endpoint on upload-1. Defence-in-depth, not the CVE-2026-15748 exploit path. That handler resolves the upload field config from the stored form definition (Forminator_CForm_Front::multiple_file_upload -> module_object->get_field), so the attacker-controlled filetypes/custom-files injection cannot be reached here\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-15748\";s:8:\"severity\";d:9.8;s:4:\"tags\";a:4:{i:0;s:11:\"file-upload\";i:1;s:21:\"arbitrary-file-upload\";i:2;s:15:\"unauthenticated\";i:3;s:21:\"remote-code-execution\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:8:\"<=1.56.1\";s:6:\"method\";s:4:\"POST\";s:11:\"ajax_action\";s:31:\"forminator_multiple_file_upload\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:19:\"FILES:upload-1:name\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:55:\"~\\.(?:ph(?:p\\d?|t|tm|tml|ar|ps?)|htaccess|user\\.ini)$~i\";}}}s:22:\"RULE-CVE-2026-15748-03\";a:12:{s:3:\"cve\";s:14:\"CVE-2026-15748\";s:11:\"description\";s:316:\"Forminator <=1.56.1 unauthenticated arbitrary file upload to RCE via public form submission (server-executable filename on upload-2). Covers this field id only - the engine cannot yet express a scan across every upload field, so an upload sent under any other name is caught by RULE-CVE-2026-15748-05 instead of here\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-15748\";s:8:\"severity\";d:9.8;s:4:\"tags\";a:4:{i:0;s:11:\"file-upload\";i:1;s:21:\"arbitrary-file-upload\";i:2;s:15:\"unauthenticated\";i:3;s:21:\"remote-code-execution\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:8:\"<=1.56.1\";s:6:\"method\";s:4:\"POST\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:11:\"ARGS:action\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:26:\"~^forminator_submit_form_~\";}i:1;a:3:{s:4:\"name\";s:19:\"FILES:upload-2:name\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:55:\"~\\.(?:ph(?:p\\d?|t|tm|tml|ar|ps?)|htaccess|user\\.ini)$~i\";}}}s:22:\"RULE-CVE-2026-15748-04\";a:12:{s:3:\"cve\";s:14:\"CVE-2026-15748\";s:11:\"description\";s:423:\"Forminator <=1.56.1 hardening - PHP-executable filename submitted to the forminator_multiple_file_upload AJAX endpoint on upload-2. Defence-in-depth, not the CVE-2026-15748 exploit path. That handler resolves the upload field config from the stored form definition (Forminator_CForm_Front::multiple_file_upload -> module_object->get_field), so the attacker-controlled filetypes/custom-files injection cannot be reached here\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-15748\";s:8:\"severity\";d:9.8;s:4:\"tags\";a:4:{i:0;s:11:\"file-upload\";i:1;s:21:\"arbitrary-file-upload\";i:2;s:15:\"unauthenticated\";i:3;s:21:\"remote-code-execution\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:8:\"<=1.56.1\";s:6:\"method\";s:4:\"POST\";s:11:\"ajax_action\";s:31:\"forminator_multiple_file_upload\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:19:\"FILES:upload-2:name\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:55:\"~\\.(?:ph(?:p\\d?|t|tm|tml|ar|ps?)|htaccess|user\\.ini)$~i\";}}}s:22:\"RULE-CVE-2026-15748-05\";a:12:{s:3:\"cve\";s:14:\"CVE-2026-15748\";s:11:\"description\";s:249:\"Forminator <=1.56.1 unauthenticated arbitrary file upload to RCE - field_data_array injection via a client-supplied `return` key carrying a forged upload field config (matches the vulnerability primitive, independent of the uploaded file field name)\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-15748\";s:8:\"severity\";d:9.8;s:4:\"tags\";a:4:{i:0;s:11:\"file-upload\";i:1;s:21:\"arbitrary-file-upload\";i:2;s:15:\"unauthenticated\";i:3;s:21:\"remote-code-execution\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:8:\"<=1.56.1\";s:6:\"method\";s:4:\"POST\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:3:{i:0;a:3:{s:4:\"name\";s:11:\"ARGS:action\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:39:\"~^forminator_submit_(?:preview_)?form_~\";}i:1;a:2:{s:4:\"name\";s:19:\"ARGS:/^.+$/[return]\";s:4:\"type\";s:6:\"exists\";}i:2;a:3:{s:4:\"name\";s:23:\"ARGS:/^.+$/[field_type]\";s:4:\"type\";s:6:\"equals\";s:5:\"value\";s:6:\"upload\";}}}s:22:\"RULE-CVE-2026-15748-06\";a:12:{s:3:\"cve\";s:14:\"CVE-2026-15748\";s:11:\"description\";s:248:\"Forminator <=1.56.1 companion sampler - any client-supplied `return` key on a public form submission (the sanitize/validate bypass primitive, regardless of injected field type). Pass-only, measures whether RULE-CVE-2026-15748-05 misses real attacks\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-15748\";s:8:\"severity\";d:9.8;s:4:\"tags\";a:4:{i:0;s:11:\"file-upload\";i:1;s:21:\"arbitrary-file-upload\";i:2;s:15:\"unauthenticated\";i:3;s:21:\"remote-code-execution\";}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:8:\"<=1.56.1\";s:6:\"method\";s:4:\"POST\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:11:\"ARGS:action\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:39:\"~^forminator_submit_(?:preview_)?form_~\";}i:1;a:2:{s:4:\"name\";s:19:\"ARGS:/^.+$/[return]\";s:4:\"type\";s:6:\"exists\";}}}s:22:\"RULE-CVE-2026-18323-01\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-18323\";s:11:\"description\";s:172:\"Forminator Forms <=1.57.0.2 unauthenticated stored XSS via radio field option-membership bypass in Save-and-Continue draft submission (forminator_submit_form_* AJAX action)\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-18323\";s:8:\"severity\";d:7.2;s:4:\"tags\";a:4:{i:0;s:3:\"xss\";i:1;s:6:\"stored\";i:2;s:15:\"unauthenticated\";i:3;s:4:\"ajax\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:10:\"<=1.57.0.2\";s:6:\"action\";s:10:\"admin_init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:11:\"ARGS:action\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:27:\"~^forminator_submit_form_~i\";}i:1;a:3:{s:4:\"name\";s:4:\"ARGS\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:61:\"~(?:<script[\\s/>]|<[^>]*\\bon[a-z]{3,20}\\s*=|javascript\\s*:)~i\";}}}s:22:\"RULE-CVE-2026-18323-02\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-18323\";s:11:\"description\";s:188:\"Forminator Forms <=1.57.0.2 unauthenticated stored XSS via radio field option-membership bypass in Save-and-Continue preview draft submission (forminator_submit_preview_form_* AJAX action)\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-18323\";s:8:\"severity\";d:7.2;s:4:\"tags\";a:4:{i:0;s:3:\"xss\";i:1;s:6:\"stored\";i:2;s:15:\"unauthenticated\";i:3;s:4:\"ajax\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:10:\"<=1.57.0.2\";s:6:\"action\";s:10:\"admin_init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:11:\"ARGS:action\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:35:\"~^forminator_submit_preview_form_~i\";}i:1;a:3:{s:4:\"name\";s:4:\"ARGS\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:61:\"~(?:<script[\\s/>]|<[^>]*\\bon[a-z]{3,20}\\s*=|javascript\\s*:)~i\";}}}s:22:\"RULE-CVE-2026-18324-01\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-18324\";s:11:\"description\";s:210:\"Forminator Forms <=1.57.0.1 unauthenticated stored XSS - script/event-handler payload submitted through a form field and rendered unescaped in the admin entries view (fixed upstream by wp_kses_post() on output)\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-18324\";s:8:\"severity\";d:7.2;s:4:\"tags\";a:4:{i:0;s:3:\"xss\";i:1;s:10:\"stored-xss\";i:2;s:15:\"unauthenticated\";i:3;s:16:\"rich-text-editor\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:10:\"<=1.57.0.1\";s:6:\"action\";s:10:\"admin_init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:11:\"ARGS:action\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:40:\"~^forminator_submit_(?:preview_)?form_~i\";}i:1;a:3:{s:4:\"name\";s:4:\"ARGS\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:114:\"~<\\s*script\\b|<\\s*iframe\\b|<[^>]*\\bon[a-z]{3,15}\\s*=|(?:href|src|action|formaction)\\s*=\\s*[\"\']?\\s*javascript\\s*:~i\";}}}s:22:\"RULE-CVE-2026-18328-01\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-18328\";s:11:\"description\";s:107:\"Forminator Forms <1.57.0.1 DOM-based reflected XSS via error_description parameter on Stripe Checkout forms\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-18328\";s:8:\"severity\";d:7.2;s:4:\"tags\";a:5:{i:0;s:3:\"xss\";i:1;s:7:\"dom-xss\";i:2;s:13:\"reflected-xss\";i:3;s:15:\"unauthenticated\";i:4;s:9:\"shortcode\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:17:\">=1.0.0 <1.57.0.1\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:22:\"ARGS:error_description\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:166:\"~(?:<script[\\s/>]|<svg[\\s/>]|<iframe[\\s/>]|<img[^>]*on\\w+\\s*=|on(?:error|load|mouseover|click|focus|toggle)\\s*=|javascript\\s*:|<\\s*\\w+[^>]*(?:autofocus|srcdoc)\\s*=)~i\";}}}s:22:\"RULE-CVE-2026-19221-01\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-19221\";s:11:\"description\";s:161:\"Forminator Forms >=1.40.0 <1.57.0.5 network-wide hub connector setting insufficiently restricted to network administrators on multisite via process_auth_callback\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-19221\";s:8:\"severity\";d:7.2;s:4:\"tags\";a:4:{i:0;s:21:\"missing-authorization\";i:1;s:20:\"privilege-escalation\";i:2;s:9:\"multisite\";i:3;s:21:\"broken-access-control\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:18:\">=1.40.0 <1.57.0.5\";s:6:\"action\";s:10:\"admin_init\";s:10:\"conditions\";a:2:{i:0;a:2:{s:4:\"name\";s:27:\"ARGS:hub_connector_callback\";s:4:\"type\";s:6:\"exists\";}i:1;a:2:{s:4:\"type\";s:18:\"missing_capability\";s:5:\"value\";s:22:\"manage_network_options\";}}}s:22:\"RULE-CVE-2026-19221-02\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-19221\";s:11:\"description\";s:146:\"Forminator Forms >=1.40.0 <1.57.0.5 network-wide hub connector sync REST endpoint insufficiently restricted to network administrators on multisite\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-19221\";s:8:\"severity\";d:7.2;s:4:\"tags\";a:4:{i:0;s:21:\"missing-authorization\";i:1;s:20:\"privilege-escalation\";i:2;s:9:\"multisite\";i:3;s:8:\"rest-api\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:18:\">=1.40.0 <1.57.0.5\";s:6:\"action\";s:13:\"rest_api_init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:87:\"~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/hub-connector/v1/sync[\\\\/]*(?:[?&]|$)~i\";}i:1;a:2:{s:4:\"type\";s:18:\"missing_capability\";s:5:\"value\";s:22:\"manage_network_options\";}}}s:22:\"RULE-CVE-2026-19221-03\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-19221\";s:11:\"description\";s:146:\"Forminator Forms >=1.40.0 <1.57.0.5 network-wide hub connector sync REST endpoint insufficiently restricted to network administrators on multisite\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-19221\";s:8:\"severity\";d:7.2;s:4:\"tags\";a:4:{i:0;s:21:\"missing-authorization\";i:1;s:20:\"privilege-escalation\";i:2;s:9:\"multisite\";i:3;s:8:\"rest-api\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:18:\">=1.40.0 <1.57.0.5\";s:6:\"action\";s:13:\"rest_api_init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:15:\"ARGS:rest_route\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:33:\"~^/hub-connector/v1/sync[\\\\/]*$~i\";}i:1;a:2:{s:4:\"type\";s:18:\"missing_capability\";s:5:\"value\";s:22:\"manage_network_options\";}}}s:22:\"RULE-CVE-2026-19221-04\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-19221\";s:11:\"description\";s:148:\"Forminator Forms >=1.40.0 <1.57.0.5 network-wide hub connector logout REST endpoint insufficiently restricted to network administrators on multisite\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-19221\";s:8:\"severity\";d:7.2;s:4:\"tags\";a:4:{i:0;s:21:\"missing-authorization\";i:1;s:20:\"privilege-escalation\";i:2;s:9:\"multisite\";i:3;s:8:\"rest-api\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:18:\">=1.40.0 <1.57.0.5\";s:6:\"action\";s:13:\"rest_api_init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:89:\"~(?:^(?:/[^?]*)?/wp-json|(?:^|[?&])rest_route=)/hub-connector/v1/logout[\\\\/]*(?:[?&]|$)~i\";}i:1;a:2:{s:4:\"type\";s:18:\"missing_capability\";s:5:\"value\";s:22:\"manage_network_options\";}}}s:22:\"RULE-CVE-2026-19221-05\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-19221\";s:11:\"description\";s:148:\"Forminator Forms >=1.40.0 <1.57.0.5 network-wide hub connector logout REST endpoint insufficiently restricted to network administrators on multisite\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-19221\";s:8:\"severity\";d:7.2;s:4:\"tags\";a:4:{i:0;s:21:\"missing-authorization\";i:1;s:20:\"privilege-escalation\";i:2;s:9:\"multisite\";i:3;s:8:\"rest-api\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:18:\">=1.40.0 <1.57.0.5\";s:6:\"action\";s:13:\"rest_api_init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:15:\"ARGS:rest_route\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:35:\"~^/hub-connector/v1/logout[\\\\/]*$~i\";}i:1;a:2:{s:4:\"type\";s:18:\"missing_capability\";s:5:\"value\";s:22:\"manage_network_options\";}}}s:22:\"RULE-CVE-2026-19222-01\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-19222\";s:11:\"description\";s:181:\"Forminator Forms <1.57.0.7 improper privilege management allows form builders lacking create_users to assign the administrator role via forminator_save_builder registration settings\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-19222\";s:8:\"severity\";d:6.6;s:4:\"tags\";a:3:{i:0;s:20:\"privilege-escalation\";i:1;s:22:\"improper-authorization\";i:2;s:13:\"authenticated\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:9:\"<1.57.0.7\";s:11:\"ajax_action\";s:23:\"forminator_save_builder\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:9:\"ARGS:data\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:81:\"~\"registration-role-field\"\\s*:\\s*\"(?:administrator|editor|shop_manager|author)\"~i\";}i:1;a:2:{s:4:\"type\";s:18:\"missing_capability\";s:5:\"value\";s:12:\"create_users\";}}}s:22:\"RULE-CVE-2026-22440-01\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-22440\";s:11:\"description\";s:0:\"\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:7.1;s:4:\"tags\";a:0:{}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:7:\">=1.0.0\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:60:\"~^(?:/(?:index\\.php)?(?:\\?|$)|/(?:archive|blog)(?:/|\\?|$))~i\";}i:1;a:3:{s:4:\"name\";s:25:\"ARGS:/^(?:s|q|redirect)$/\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:95:\"~(?:<script[\\s/>]|on(?:error|load|click|mouse(?:over|down|up)|focus|blur)\\s*=|javascript\\s*:)~i\";}}}s:22:\"RULE-CVE-2026-28048-01\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-28048\";s:11:\"description\";s:84:\"FlashMart Theme <=2.0.15 unauthenticated local file inclusion via template parameter\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-28048\";s:8:\"severity\";d:8.1;s:4:\"tags\";a:3:{i:0;s:20:\"local-file-inclusion\";i:1;s:14:\"path-traversal\";i:2;s:15:\"unauthenticated\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:5:\">=5.0\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:18:\"ARGS:flashtemplate\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:59:\"~(?:\\.\\.[\\/]|wp-config\\.php|/etc/passwd|\\.htaccess|\\.env)~i\";}}}s:21:\"RULE-CVE-2026-5192-01\";a:11:{s:3:\"cve\";s:13:\"CVE-2026-5192\";s:11:\"description\";s:108:\"Forminator <=1.52.1 unauthenticated path traversal via upload-1[file][file_path] in form submit AJAX handler\";s:8:\"cve_link\";s:46:\"https://nvd.nist.gov/vuln/detail/CVE-2026-5192\";s:8:\"severity\";d:7.5;s:4:\"tags\";a:3:{i:0;s:14:\"path-traversal\";i:1;s:11:\"file-upload\";i:2;s:15:\"unauthenticated\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:8:\"<=1.52.1\";s:11:\"ajax_action\";s:28:\"forminator_submit_form_cform\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:30:\"ARGS:upload-1[file][file_path]\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:78:\"~(?:(?:\\.\\.[\\/]){2,}|wp-config\\.php|/etc/passwd|\\.htaccess|\\.env|debug\\.log)~i\";}}}s:21:\"RULE-CVE-2026-5192-02\";a:11:{s:3:\"cve\";s:13:\"CVE-2026-5192\";s:11:\"description\";s:112:\"Forminator <=1.52.1 unauthenticated path traversal via file_data[file_path] in multiple file upload AJAX handler\";s:8:\"cve_link\";s:46:\"https://nvd.nist.gov/vuln/detail/CVE-2026-5192\";s:8:\"severity\";d:7.5;s:4:\"tags\";a:3:{i:0;s:14:\"path-traversal\";i:1;s:11:\"file-upload\";i:2;s:15:\"unauthenticated\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:8:\"<=1.52.1\";s:11:\"ajax_action\";s:31:\"forminator_multiple_file_upload\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:25:\"ARGS:file_data[file_path]\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:78:\"~(?:(?:\\.\\.[\\/]){2,}|wp-config\\.php|/etc/passwd|\\.htaccess|\\.env|debug\\.log)~i\";}}}s:22:\"RULE-CVE-2026-56071-01\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-56071\";s:11:\"description\";s:79:\"Forminator <=1.53.1 unauthenticated stored XSS via form submission field values\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:7.1;s:4:\"tags\";a:0:{}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:8:\"<=1.53.1\";s:11:\"ajax_action\";s:35:\"forminator_submit_form_custom-forms\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:4:\"ARGS\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:160:\"~(?:<\\s*script[\\s/>]|\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|move))\\s*=|javascript\\s*:|data\\s*:(?!\\s*(?:image|audio|video|font)/))~i\";}}}s:22:\"RULE-CVE-2026-56071-02\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-56071\";s:11:\"description\";s:74:\"Forminator <=1.53.1 unauthenticated stored XSS via preview form submission\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:7.1;s:4:\"tags\";a:0:{}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:8:\"<=1.53.1\";s:11:\"ajax_action\";s:43:\"forminator_submit_preview_form_custom-forms\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:4:\"ARGS\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:160:\"~(?:<\\s*script[\\s/>]|\\bon(?:error|load|mouseover|click|focus|blur|mouse(?:over|out|enter|move))\\s*=|javascript\\s*:|data\\s*:(?!\\s*(?:image|audio|video|font)/))~i\";}}}s:22:\"RULE-CVE-2026-66583-01\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-66583\";s:11:\"description\";s:81:\"Forminator <=1.57.0.5 unauthenticated PHP Object Injection via form_uid parameter\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:9.8;s:4:\"tags\";a:0:{}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:10:\"<=1.57.0.5\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:13:\"ARGS:form_uid\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:34:\"~(?:O|C):[0-9]+:\"[^\"]*\":[0-9]+:\\{~\";}}}s:22:\"RULE-CVE-2026-85235-01\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-85235\";s:11:\"description\";s:125:\"Forminator <=1.57.2 unauthenticated stored XSS via rich-text textarea field in forminator_submit_form_custom-forms submission\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-85235\";s:8:\"severity\";d:7.2;s:4:\"tags\";a:3:{i:0;s:3:\"xss\";i:1;s:10:\"stored-xss\";i:2;s:15:\"unauthenticated\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:8:\"<=1.57.2\";s:11:\"ajax_action\";s:35:\"forminator_submit_form_custom-forms\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:22:\"ARGS:/textarea-[0-9]+/\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:151:\"~(?:on(?:error|load|click|mouseover|focus|blur|toggle)\\s*=|<script[\\s/>]|<img[^>]+onerror|javascript\\s*:|&(?:#x?0*6a|#106);\\s*avascript|&#x?0*3[cc];)~i\";}}}s:22:\"RULE-CVE-2026-87067-01\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-87067\";s:11:\"description\";s:137:\"Forminator Forms <1.57.2.1 authenticated PHP object injection via unrestricted class instantiation during XML-RPC request deserialization\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-87067\";s:8:\"severity\";d:8.5;s:4:\"tags\";a:4:{i:0;s:16:\"object-injection\";i:1;s:15:\"deserialization\";i:2;s:6:\"xmlrpc\";i:3;s:21:\"remote-code-execution\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:9:\"<1.57.2.1\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:11:\"REQUEST_URI\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:16:\"~^/xmlrpc\\.php~i\";}i:1;a:3:{s:4:\"name\";s:4:\"ARGS\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:34:\"~(?:O|C):[0-9]+:\"[^\"]+\":[0-9]+:\\{~\";}}}s:22:\"RULE-CVE-2026-92144-01\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-92144\";s:11:\"description\";s:127:\"Forminator <=1.57.2 unauthenticated stored XSS via Post Data custom-meta input postdata-N-post_meta-M on public form submission\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-92144\";s:8:\"severity\";d:7.2;s:4:\"tags\";a:4:{i:0;s:3:\"xss\";i:1;s:10:\"stored-xss\";i:2;s:15:\"unauthenticated\";i:3;s:6:\"cwe-79\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:8:\"<=1.57.2\";s:11:\"ajax_action\";s:35:\"forminator_submit_form_custom-forms\";s:10:\"conditions\";a:1:{i:0;a:4:{s:12:\"match_absent\";b:0;s:4:\"name\";s:44:\"ARGS:/^postdata-\\d+(?:-\\d+)*-post_meta-\\d+$/\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:246:\"~(?:<\\s*(?:script|iframe|svg|object|embed|math|details|body)\\b|on(?:error|load|click|mouseover|focus|blur|toggle|animationend|begin)\\s*=|javascript\\s*:(?=\\s*(?:[a-z_$][\\w$]*\\s*\\(|//|location\\.|window\\.|document\\.|eval\\b|atob\\b))|data:text/html)~i\";}}}s:22:\"RULE-CVE-2026-92144-02\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-92144\";s:11:\"description\";s:156:\"Forminator <=1.57.2 unauthenticated stored XSS via client-crafted nested postdata-N[post-custom][M][value] array persisted by Forminator_Postdata::save_post\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-92144\";s:8:\"severity\";d:7.2;s:4:\"tags\";a:4:{i:0;s:3:\"xss\";i:1;s:10:\"stored-xss\";i:2;s:15:\"unauthenticated\";i:3;s:6:\"cwe-79\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:8:\"<=1.57.2\";s:11:\"ajax_action\";s:35:\"forminator_submit_form_custom-forms\";s:10:\"conditions\";a:2:{i:0;a:4:{s:12:\"match_absent\";b:0;s:4:\"name\";s:10:\"ARGS_NAMES\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:65:\"~^postdata-[0-9]+(?:-[0-9]+)*\\[post-custom\\]\\[[0-9]+\\]\\[value\\]$~\";}i:1;a:4:{s:12:\"match_absent\";b:0;s:4:\"name\";s:4:\"ARGS\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:169:\"~(?:<\\s*(?:script|iframe|svg|object|embed|math|details|body)\\b|on(?:error|load|click|mouseover|focus|blur|toggle|animationend|begin)\\s*=|javascript\\s*:|data:text/html)~i\";}}}s:22:\"RULE-CVE-2026-92229-01\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-92229\";s:11:\"description\";s:103:\"Forminator <=1.57.2 unauthenticated arbitrary shortcode execution via forminator_load_quiz AJAX handler\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-92229\";s:8:\"severity\";d:9.1;s:4:\"tags\";a:3:{i:0;s:14:\"code-injection\";i:1;s:19:\"shortcode-injection\";i:2;s:15:\"unauthenticated\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:8:\"<=1.57.2\";s:11:\"ajax_action\";s:20:\"forminator_load_quiz\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:4:\"ARGS\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:49:\"~(?:[\"\']\\s*\\]\\s*\\[|[0-9]\\]\\[)\\s*[a-zA-Z_][\\w-]*~i\";}}}s:22:\"RULE-CVE-2026-92229-02\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-92229\";s:11:\"description\";s:105:\"Forminator <=1.57.2 unauthenticated arbitrary shortcode execution via forminator_reload_quiz AJAX handler\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-92229\";s:8:\"severity\";d:9.1;s:4:\"tags\";a:3:{i:0;s:14:\"code-injection\";i:1;s:19:\"shortcode-injection\";i:2;s:15:\"unauthenticated\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:10:\"forminator\";s:8:\"versions\";s:8:\"<=1.57.2\";s:11:\"ajax_action\";s:22:\"forminator_reload_quiz\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:4:\"ARGS\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:49:\"~(?:[\"\']\\s*\\]\\s*\\[|[0-9]\\]\\[)\\s*[a-zA-Z_][\\w-]*~i\";}}}s:22:\"RULE-CVE-2026-94169-01\";a:11:{s:3:\"cve\";s:14:\"CVE-2026-94169\";s:11:\"description\";s:134:\"The Grid <=2.8.1 unauthenticated code injection via the_grid_load_more grid_data[source_type] arbitrary The_Grid_* class instantiation\";s:8:\"cve_link\";s:47:\"https://nvd.nist.gov/vuln/detail/CVE-2026-94169\";s:8:\"severity\";d:10;s:4:\"tags\";a:4:{i:0;s:14:\"code-injection\";i:1;s:3:\"rce\";i:2;s:15:\"unauthenticated\";i:3;s:27:\"dynamic-class-instantiation\";}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:6:\"plugin\";s:4:\"slug\";s:8:\"the-grid\";s:8:\"versions\";s:7:\"<=2.8.1\";s:11:\"ajax_action\";s:18:\"the_grid_load_more\";s:10:\"conditions\";a:2:{i:0;a:3:{s:4:\"name\";s:27:\"ARGS:grid_data[source_type]\";s:4:\"type\";s:5:\"regex\";s:5:\"value\";s:76:\"~^(?!(?:post_type|instagram|youtube|vimeo|facebook|twitter|flickr|rss)$).+~i\";}i:1;a:2:{s:4:\"type\";s:18:\"missing_capability\";s:5:\"value\";s:14:\"manage_options\";}}}s:14:\"TEST-HEARTBEAT\";a:11:{s:3:\"cve\";s:14:\"TEST-HEARTBEAT\";s:11:\"description\";s:0:\"\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:0.1;s:4:\"tags\";a:0:{}s:4:\"mode\";s:4:\"pass\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:7:\">=1.0.0\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:2:{s:4:\"type\";s:13:\"probabilistic\";s:5:\"value\";s:6:\"0.0002\";}}}s:9:\"TEST-RULE\";a:11:{s:3:\"cve\";s:8:\"TEST-CVE\";s:11:\"description\";s:0:\"\";s:8:\"cve_link\";s:0:\"\";s:8:\"severity\";d:2;s:4:\"tags\";a:0:{}s:4:\"mode\";s:5:\"block\";s:6:\"target\";s:4:\"core\";s:4:\"slug\";s:0:\"\";s:8:\"versions\";s:7:\">=1.0.0\";s:6:\"action\";s:4:\"init\";s:10:\"conditions\";a:1:{i:0;a:3:{s:4:\"name\";s:14:\"ARGS:test-rule\";s:4:\"type\";s:6:\"equals\";s:5:\"value\";s:36:\"b3d45e60-53a5-4959-b911-5178baaef7ac\";}}}}}', 'off') ON DUPLICATE KEY UPDATE `option_name` = VALUES(`option_name`), `option_value` = VALUES(`option_value`), `autoload` = VALUES(`autoload`)

Error en la base de datos de WordPress: [The MySQL server is running with the --read-only option so it cannot execute this statement]
UPDATE `wp_options` SET `option_value` = '1793714144', `autoload` = 'on' WHERE `option_name` = 'imunify_bots_mu_checked'

Error en la base de datos de WordPress: [The MySQL server is running with the --read-only option so it cannot execute this statement]
DELETE FROM `wp_options` WHERE `option_name` = '_site_transient_wp_theme_files_patterns-5db63bcd9f41536c01fbc1f3966d4c76'

Error en la base de datos de WordPress: [The MySQL server is running with the --read-only option so it cannot execute this statement]
DELETE FROM `wp_options` WHERE `option_name` = '_site_transient_timeout_wp_theme_files_patterns-5db63bcd9f41536c01fbc1f3966d4c76'

Error en la base de datos de WordPress: [The MySQL server is running with the --read-only option so it cannot execute this statement]
INSERT INTO `wp_options` (`option_name`, `option_value`, `autoload`) VALUES ('_site_transient_timeout_wp_theme_files_patterns-5db63bcd9f41536c01fbc1f3966d4c76', '1793715945', 'off') ON DUPLICATE KEY UPDATE `option_name` = VALUES(`option_name`), `option_value` = VALUES(`option_value`), `autoload` = VALUES(`autoload`)

Error en la base de datos de WordPress: [The MySQL server is running with the --read-only option so it cannot execute this statement]
INSERT INTO `wp_options` (`option_name`, `option_value`, `autoload`) VALUES ('_site_transient_wp_theme_files_patterns-5db63bcd9f41536c01fbc1f3966d4c76', 'a:2:{s:7:\"version\";s:6:\"4.27.9\";s:8:\"patterns\";a:0:{}}', 'off') ON DUPLICATE KEY UPDATE `option_name` = VALUES(`option_name`), `option_value` = VALUES(`option_value`), `autoload` = VALUES(`autoload`)