# Australia (ACSC) Warns of Global Campaign Exploiting Vulnerable CMS Platforms to Deploy Webshells

> The Australian Cyber Security Centre (ACSC) warns that malicious cyber actors are actively scanning websites and exploiting over 20 vulnerabilities across WordPress plugins, Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE to deploy webshells for persistent access. Multiple Australian small-to-medium businesses have already been compromised, with attackers using webshells to steal credentials and deploy additional malware.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1224
- **ID:** TL-2026-1224
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-34085, CVE-2020-36847, CVE-2026-0740, CVE-2026-3844, CVE-2026-1357, CVE-2025-32432, CVE-2026-48907

## Description

On 2026-07-11 the ACSC (part of the Australian Signals Directorate) published an alert describing a large-scale, ongoing exploitation campaign against publicly-facing website content management systems. Rather than relying on a single flaw, attackers are chaining more than 20 known CVEs across widely-deployed WordPress plugins (Simple File List, WavePlayer, BerqWP, WPBookit, Ninja Forms File Uploads, ThemeREX Addons, Breeze Cache, pay-uz, ACF Extended, Sneeit Framework, WPvivid Backup & Migration, Gravity Forms, GutenKit/Hunk Companion) and standalone CMS products (Craft CMS, MaxSite CMS, MetInfo CMS, Joomla JCE extension) to gain unauthenticated remote code execution and drop PHP webshells. Most of the WordPress-plugin CVEs are unrestricted/arbitrary file-upload flaws (CWE-434) allowing an attacker to upload a disguised or predictably-keyed PHP payload to a public directory and then execute it; Craft CMS's CVE-2025-32432 is a code-injection/PHP-object-deserialization gadget chain (CWE-94) and Joomla JCE's CVE-2026-48907 is a broken-access-control flaw (CWE-284) letting an unauthenticated user create an editor profile that can upload and execute PHP. Once a webshell is planted, operators use it for persistent access, credential theft (WordPress/CMS admin creds, hosting-panel creds), deployment of secondary malware, website defacement/disruption, delivery of malware to site visitors, and pivoting into the broader network. ACSC states many Australian SMBs have already been compromised and references a recent Five Eyes joint statement noting AI-assisted tooling is helping actors scale scanning and exploitation of newly disclosed CVEs faster than defenders can patch. This is the second such ACSC alert in two months, indicating the pattern of opportunistic mass-CVE-chaining against CMS platforms is continuing/escalating. Of the 7 CVEs tracked for this record: CVE-2025-34085 was rejected/withdrawn by its CNA as a duplicate of CVE-2020-36847 (Simple File List plugin RCE via file-rename, CVSS 9.8); CVE-2020-36847 (Simple File List, CVSS 9.8, CWE-434), CVE-2026-0740 (Ninja Forms File Uploads, CVSS 9.8, CWE-434), CVE-2026-3844 (Breeze Cache, CVSS 9.8, CWE-434), and CVE-2026-1357 (WPvivid Backup & Migration, CVSS 9.8, CWE-434) are all critical unauthenticated arbitrary-file-upload-to-RCE bugs; CVE-2025-32432 (Craft CMS, CVSS 10.0, CWE-94) is CISA KEV-listed (added 2026-03-20, remediation deadline 2026-04-03) and involves planting a malicious PHP session file then triggering a PhpManager gadget chain via an image-transform endpoint __class bypass; CVE-2026-48907 (Joomla JCE, CVSS 9.8/v3.1 and 10.0/v4.0, CWE-284) was added to CISA KEV on 2026-06-16 with confirmed active exploitation.

## MITRE ATT&CK

- T1595 Active Scanning
- T1593 Search Open Websites/Domains
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1136 Create Account
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1036 Masquerading
- T1070 Indicator Removal
- T1140 Deobfuscate/Decode Files or Information
- T1552 Unsecured Credentials
- T1539 Steal Web Session Cookie
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1016 System Network Configuration Discovery
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1102 Web Service
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1491 Defacement
- T1489 Service Stop

## Sources

- [Australia warns of global campaign targeting vulnerable CMS platforms](https://www.bleepingcomputer.com/news/security/australia-warns-of-global-campaign-targeting-vulnerable-cms-platforms/)
- [Large-scale exploitation campaign targeting website content management systems (CMS)](https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/large-scale-exploitation-campaign-targeting-website-content-management-systems-cms)
- [ACSC Warns of Large-Scale CMS Exploitation Campaign Deploys Webshells on Vulnerable Websites](https://cybersecuritynews.com/acsc-warns-of-large-scale-cms-exploitation-campaign-deploys-webshells/)
- [ACSC warns of large-scale campaign exploiting CMS vulnerabilities in Australia](https://australiancybersecuritymagazine.com.au/acsc-warns-of-large-scale-campaign-exploiting-cms-vulnerabilities-in-australia/)
- [Critical alert! ACSC warns of 'large-scale exploitation' of Aussie websites](https://www.cyberdaily.au/security/13882-critical-alert-acsc-warns-of-large-scale-exploitation-of-aussie-websites)
- [Second alert from ACSC in two months shows unpatched CMS bugs still exploited](https://www.itnews.com.au/news/second-alert-from-acsc-in-two-months-shows-unpatched-cms-bugs-still-exploited-627256)
- [CVE-2020-36847 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36847)
- [CVE-2025-34085 Detail - NVD (rejected/duplicate)](https://nvd.nist.gov/vuln/detail/CVE-2025-34085)
- [CVE-2026-0740 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-0740)
- [CVE-2026-3844 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-3844)
- [CVE-2026-1357 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-1357)
- [CVE-2025-32432 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-32432)
- [CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026](https://thehackernews.com/2026/03/cisa-flags-apple-craft-cms-laravel-bugs.html)
- [CVE-2025-32432: Craft CMS RCE Vulnerability Explained](https://www.opswat.com/blog/cve-2025-32432-unauthenticated-remote-code-execution-in-craft-cms)
- [Critical vulnerability in WPvivid backup plugin allows remote code execution](https://www.scworld.com/brief/critical-vulnerability-in-wpvivid-backup-plugin-allows-remote-code-execution)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1224