# WP-SHELLSTORM: Exposed Chinese-Speaking Threat Actor Server Reveals Mass WordPress/Joomla Webshell Brokerage Targeting 1.4M Domains via CVE-2026-48907 (Joomla JCE) and CVE-2021-29441 (Nacos)

> An unsecured 800MB Python web server run by a Chinese-speaking financially-motivated crew exposed a webshell access brokerage operation that scanned 1.4 million WordPress/Joomla domains, confirmed-compromising 25,195+ sites with 5,700+ active webshells via a chain of WordPress/Joomla plugin CVEs including the CISA KEV-listed maximum-severity Joomla JCE Editor flaw (CVE-2026-48907). The same crew separately used a Nacos authentication bypass (CVE-2021-29441) in May 2026 to harvest 613 cloud/database credential files from 11 corporate Java systems, and deployed SNOWLIGHT/VShell tooling previously linked to suspected Chinese state actor UNC5174.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1180
- **ID:** TL-2026-1180
- **Severity:** HIGH (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** WP-SHELLSTORM Crew (China)
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-3844, CVE-2026-48907, CVE-2026-1969, CVE-2020-36847, CVE-2026-6433, CVE-2025-7443, CVE-2026-0740, CVE-2025-12057, CVE-2025-7852, CVE-2020-25213, CVE-2021-29441, CVE-2026-3300

## Description

On June 11, 2026, SOCRadar discovered an unauthenticated Python web server (137.175.93[.]126, a US-hosted VPS) that had been left open for 22 days, exposing roughly 800MB of operational data belonging to a Chinese-speaking cybercriminal crew. The trove included exploit scripts, unredacted command history, FOFA search-engine configuration files (FOFA requires a Chinese phone number to register, a strong nationality signal), and target lists naming 1.4 million WordPress and Joomla domains. Ctrl-Alt-Intel (via the Hunt.io open-directory platform) published deduplicated analysis on June 22, 2026 confirming 25,195 sites showed evidence of successful compromise, and SOCRadar's July 9, 2026 writeup counted 5,700+ live webshells still active on infected hosts at time of discovery.

The operation is best characterized as a webshell-access brokerage: automated FOFA-sourced reconnaissance identifies vulnerable WordPress and Joomla installations at scale, a scanner/exploiter framework fires a chain of 11 known plugin/CMS CVEs plus one enterprise Java CVE, and successful hits are backdoored with a custom heavily-obfuscated (four layers of encoding) PHP webshell named down.php, derived from the open-source Chinese webshell kit BestShell. Confirmed access is then packaged and resold to downstream customers rather than monetized directly by the crew, consistent with an initial-access-broker business model.

The single highest-impact vulnerability in the chain is CVE-2026-48907, an improper access control flaw in the Joomla Content Editor (JCE) extension (versions 1.0.0 through 2.9.99.4) that lets an unauthenticated attacker create a rogue editor profile and use it to upload and execute arbitrary PHP, achieving unauthenticated remote code execution with a CVSS score of 10.0. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog with a federal remediation deadline of 2026-06-19 under BOD 26-04; public exploit code is available and attacks are automated. In this campaign the JCE vector reached 560,000+ candidate targets but yielded only 77 confirmed successful compromises, indicating most sites had already patched or additional exploitation preconditions limited success. By contrast, CVE-2026-3844 — an unauthenticated arbitrary file-upload vulnerability in the Breeze Cache plugin (versions ≤2.4.4, 400,000+ active installs, developed by Cloudways) reachable through the plugin's fetch_gravatar_from_remote function when the 'Host Files Locally – Gravatars' option is enabled — was the volume leader, hitting 45,000+ targets and yielding 17,000+ confirmed backdoors, the bulk of the campaign's total compromise count.

For persistence beyond the initial down.php webshell, the crew deployed a second-stage toolchain consisting of a SNOWLIGHT dropper that loads VShell, a fileless WebSocket-based reverse-shell/RAT, directly into memory using the Linux memfd_create syscall. The resulting process disguises itself as [kworker/0:2] to blend in with legitimate kernel worker threads, which normally have no backing program file, command line, or open network sockets — making its presence a strong host-based detection signal. This SNOWLIGHT-to-VShell toolchain was first documented publicly by Sysdig in April 2025 in connection with the suspected Chinese state-nexus group UNC5174, previously known for using SUPERSHELL and for targeting F5 devices and other edge infrastructure for espionage and access-brokering. Sysdig and other researchers caution that VShell has since proliferated into general Chinese-speaking criminal forums, so its presence alone is not proof of state-actor involvement; this WP-SHELLSTORM operation is independently assessed as financially motivated (webshell brokerage) even though it reuses UNC5174-associated tradecraft. Godzilla, another Chinese-origin webshell/C2 management framework, was also found among the exposed operator's toolset.

A separate but related campaign thread, conducted by the same crew in May 2026 and documented in the exposed command history, targeted corporate Java systems directly via CVE-2021-29441, an authentication bypass in Alibaba Nacos (a widely used service-discovery/configuration-management platform for Java microservices) affecting versions prior to 1.4.1. When Nacos authentication is enabled, its AuthFilter servlet contains a built-in bypass: any request carrying a 'Nacos-Server' User-Agent header is automatically trusted when enableUserAgentAuthWhite is set (the default), and a second bypass exists via a specially crafted trailing-slash URL. Either technique lets an unauthenticated attacker perform full administrative operations against the Nacos console, including reading and querying stored configuration data. Using this bypass, the crew exfiltrated 613 configuration files from 11 distinct corporate systems spanning fintech, e-commerce, logistics, gaming, and electronics sectors, harvesting live cloud and service credentials including AWS, Alibaba Cloud, Oracle Cloud, Tencent Cloud, and DigitalOcean API keys, database passwords, and Alipay RSA private keys — a direct pivot from web-app exploitation into cloud-account takeover.

Operational security on the exposed server was poor: in addition to running an unauthenticated Python HTTP server for 22 days, the crew left their FOFA account configuration (traceable through law-enforcement channels) and unedited shell command history in plaintext, along with loose personal handles (tance, chen-kk, chenyk) that researchers flag as non-confirmatory leads rather than solid attribution. Between July 2 and July 4, 2026 the operator appears to have noticed the exposure and deleted a batch of log files, though the bulk of the operational data had already been mirrored by researchers. A secondary access log showed 42,000+ tool-download requests originating from a Taiwan-based IP address; researchers could not determine whether this reflected the operator, a downstream customer, or another security researcher.

The remaining plugin CVEs in the exploitation chain — CVE-2026-3300 (Everest Forms Pro), CVE-2026-1969 (ThemeREX Addons / trx_addons, an incorrect fix for the earlier CVE-2024-13448 unauthenticated arbitrary file upload), CVE-2020-36847 (Simple-File-List, RCE via the plugin's rename function on versions ≤4.2.2), CVE-2026-6433 (Custom CSS & JS / PHP inline-code injection plugin), CVE-2025-7443 (BerqWP), CVE-2026-0740 (Ninja Forms upload handling), CVE-2025-12057 (WavePlayer), CVE-2025-7852 (WPBookit), and CVE-2020-25213 (WP File Manager, unauthenticated arbitrary file upload on versions <6.9, mass-exploited historically per Palo Alto Unit 42 and Wordfence tracking) round out a chain deliberately built from cheap, widely-deployed, and in several cases years-old unpatched WordPress/Joomla plugin vulnerabilities — reflecting a brokerage strategy optimized for breadth of coverage across the CMS plugin ecosystem rather than depth against any single target.

## MITRE ATT&CK

- T1596.005 Scan Databases
- T1587.001 Malware
- T1583.003 Virtual Private Server
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1203 Exploitation for Client Execution
- T1505.003 Web Shell
- T1543 Create or Modify System Process
- T1068 Exploitation for Privilege Escalation
- T1036.005 Match Legitimate Resource Name or Location
- T1620 Reflective Code Loading
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1552.001 Credentials In Files
- T1110.001 Password Guessing
- T1046 Network Service Discovery
- T1518.001 Security Software Discovery
- T1083 File and Directory Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1071.001 Web Protocols
- T1095 Non-Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1573.001 Symmetric Cryptography
- T1090.003 Multi-hop Proxy
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking

## Sources

- [Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites](https://thehackernews.com/2026/07/exposed-hacker-server-reveals-wp.html)
- [CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution](https://thehackernews.com/2026/06/cisa-warns-of-actively-exploited-joomla.html)
- [CVE-2026-48907 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-48907)
- [CVE-2026-48907: Joomla Content Editor Improper Access Control Vulnerability (CISA KEV)](https://threat-modeling.com/cve-2026-48907-joomla-content-editor-access-control-cisa-kev/)
- [Critical Joomla JCE RCE Added to CISA KEV as Attacks Target Linux Web Servers](https://linuxsecurity.com/news/security-vulnerabilities/critical-joomla-jce-rce-cisa-kev-linux-web-servers)
- [CVE-2021-29441 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-29441)
- [GHSL-2020-325: Authentication bypass in Nacos - CVE-2021-29441, CVE-2021-29442](https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/)
- [UNC5174's evolution in China's ongoing cyber warfare: From SNOWLIGHT to VShell](https://www.sysdig.com/blog/unc5174-chinese-threat-actor-vshell)
- [Chinese Hackers Target Linux Systems Using SNOWLIGHT Malware and VShell Tool](https://thehackernews.com/2025/04/chinese-hackers-target-linux-systems.html)
- [Uncovering the DNS Underbelly of UNC5174: The Shift from SNOWLIGHT to VShell](https://circleid.com/posts/uncovering-the-dns-underbelly-of-unc5174-the-shift-from-snowlight-to-vshell)
- [CVE-2026-3844: WordPress Breeze Cache Plugin RCE Flaw](https://www.sentinelone.com/vulnerability-database/cve-2026-3844/)
- [Over 400,000 sites at risk as hackers exploit Breeze Cache plugin flaw (CVE-2026-3844)](https://securityaffairs.com/191267/uncategorized/over-400000-sites-at-risk-as-hackers-exploit-breeze-cache-plugin-flaw-cve-2026-3844.html)
- [Hackers exploit file upload bug in Breeze Cache WordPress plugin](https://www.bleepingcomputer.com/news/security/hackers-exploit-file-upload-bug-in-breeze-cache-wordpress-plugin/)
- [CVE-2020-36847 : The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution](https://www.cvedetails.com/cve/CVE-2020-36847/)
- [Exploits in the Wild for WordPress File Manager RCE Vulnerability (CVE-2020-25213)](https://unit42.paloaltonetworks.com/cve-2020-25213/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1180