thinQtankLABS

Detection Engineering & Incident Response: CVE-2026-1357

Respond to a WPvivid file-upload compromise (CVE-2026-1357). Reconstruct the timeline from the web access log and the plugin upload log, see how filename traversal placed PHP in a web-accessible directory, find the attacker's rogue must-use-plugin persistence, engineer a detection rule for the malicious upload pattern, then contain, eradicate, update, verify and report.

Intermediate 21 guided steps 6 tasks About 75 minutes Runs in your browser

Skills you will practice

  • Web access-log correlation
  • Timeline reconstruction
  • Arbitrary file upload IOCs
  • Web shell and mu-plugin persistence hunting
  • Detection engineering
  • Containment and eradication
  • Incident reporting

Certifications this lab maps to

This lab builds hands-on skills that appear on these certification exams. thinQtank Learning runs instructor-led training camps for each — click one to see upcoming classes.

CompTIA CySA+ CS0-003 Log analysis, detection and IR Training at thinQtank Learning EC-Council Certified Incident Handler E|CIH Incident-handling lifecycle Training at thinQtank Learning EC-Council Certified Ethical Hacker CEH Web shells, file upload abuse and IOCs Training at thinQtank Learning ISC2 CISSP CISSP Security Operations domain Training at thinQtank Learning
Part of these certification lab packages: CySA+ CS0-003 CISSP Certified Ethical Hacker (CEH) CEH Certified Incident Handler (E|CIH) E|CIH GCIH GCIH GCIA GCIA

The scenario

An internet-facing WordPress site (CVE-2026-1357 open) logged unauthenticated upload requests followed by new PHP files on disk. You are the responder. Classify it.

What you will do

  1. Open and classify the incident4 steps

    Open the incident · Read the alert · Read the ticket · Classify it

  2. Reconstruct the timeline3 steps

    Pull the attacker’s requests · Correlate the file-drop log · What turned upload into RCE?

  3. Impact and persistence3 steps

    Inspect the dropped files · What persistence? · Record IOCs

  4. Engineer a detection rule4 steps

    Study the sample · Write a rule · Test and tune · Why not flag every wpvivid request?

  5. Contain, eradicate, verify5 steps

    Remove the persistence · Remove the uploaded webshell · Update the plugin · Verify the host · …

  6. Report2 steps

    Write the report · What else would blunt it?

How this lab works

A real Linux-style console. Commands run against real files, so hashes, hex dumps and comparisons give real results.

A file browser where you can place evidence into the lab, either the file provided or one of your own.

Reset a single step, a whole task or the entire lab. The environment is rebuilt so you can try again cleanly.

Progress saves after every step. Close the tab and come back later; your files and answers are waiting.