The Australian Cyber Security Centre (ACSC) has issued an urgent alert confirming a large-scale global exploitation campaign that is actively targeting vulnerable content management systems (CMS) and plugins. The campaign has already impacted numerous Australian businesses, particularly small- to medium-sized enterprises, with attackers deploying webshells on compromised websites to establish persistent remote access.
Widespread Campaign Targets Multiple CMS Platforms and Plugins
The ACSC reports that malicious actors are systematically scanning websites for exploitable vulnerabilities across a broad range of CMS platforms and popular plugins. The following products and specific CVEs have been identified as targets in this ongoing campaign:
- Simple File List (WordPress) – CVE-2025-34085 / CVE-2020-36847
- WavePlayer (WordPress) – CVE-2025-12057
- BerqWP (WordPress) – CVE-2025-7443
- WPBookit (WordPress) – CVE-2025-7852
- Ninja Forms (WordPress) – CVE-2026-0740
- ThemeREX Addons (WordPress) – CVE-2026-1969
- Breeze Cache (WordPress) – CVE-2026-3844
- pay-uz (WordPress) – CVE-2026-31843
- ACF Extended (WordPress) – CVE-2025-13486
- Sneeit Framework – CVE-2025-6389
- WPvivid Backup (WordPress) – CVE-2026-1357
- Gravity Forms (WordPress) – CVE-2025-12352
- GutenKit / Hunk Companion (WordPress) – likely CVE-2024-9234
- Craft CMS – CVE-2025-32432
- MaxSite CMS – CVE-2026-3395
- MetInfo CMS – CVE-2026-29014
- Joomla JCE – CVE-2026-48907
The list spans widely deployed WordPress plugins, several standalone CMS platforms, and a Joomla editor plugin, reflecting the broad targeting strategy of the threat actors behind the campaign.
Webshells Provide Persistent Access and Enable Lateral Movement
Webshells are malicious scripts uploaded to compromised web servers that grant attackers ongoing remote control over the affected environment. Once installed, these backdoors allow threat actors to disrupt website operations, steal user credentials, plant additional malware, and move laterally into the internal network. The ACSC emphasizes that the deployment of webshells represents a significant escalation, as it transforms a single website compromise into a persistent foothold within the organisation’s broader infrastructure.
What Is a Webshell and How Does It Compromise a Website?
A webshell is a malicious script uploaded to a web server that enables an attacker to remotely execute commands, access files, and maintain persistent, covert access to the compromised environment. Unlike a one-time exploit, a webshell gives the attacker ongoing control, often escaping detection by standard security tools, and serves as a launch point for deeper network infiltration.
AI-Driven Capabilities May Be Accelerating the Campaign
The ACSC has noted that the campaign may be supported by artificial intelligence, which would enable threat actors to accelerate scanning, rapidly adapt to newly disclosed vulnerabilities, and scale their exploitation efforts more efficiently. The use of AI in this context represents an evolution in the speed and adaptability of mass-exploitation operations, making timely patching even more critical for defenders.
How Website Administrators Can Protect Against CMS Exploitation
To defend against this campaign, website administrators should immediately apply the latest security updates for their CMS, themes, and plugins, remove any unused components, and enable automatic updates wherever possible. Additional protective measures include making web directories read-only when feasible, monitoring for unauthorised file creation, restricting access to sensitive directories, and blocking unexpected spawning of child processes on the web server. Deploying a web application firewall with virtual patching capabilities and implementing file integrity monitoring are recommended solution categories that can help detect and block exploitation attempts before webshells are deployed.
What Affected Users Should Do Now
Administrators of websites running any of the identified CMS platforms or plugins should treat this alert as an active and urgent threat. Immediately apply all available patches for the listed CVEs, conduct a thorough audit of web directories for any unauthorised files or suspicious scripts, rotate all administrative credentials, and enable multi-factor authentication on all administrative accounts. For organisations that have already detected signs of compromise, engage an incident response team to assess the scope of the breach and remediate any webshells before they can be used to move deeper into the network.
