The Australian Cyber Security Centre (ACSC) has warned of a worldwide exploitation campaign targeting content management systems and their plugins. Numerous Australian small‑to‑medium businesses have already been compromised with webshells, raising risks of data theft and service disruption.

Key Takeaways

  • A large‑scale global campaign is actively exploiting CMS vulnerabilities.
  • Webshells give attackers persistent access to compromised sites.
  • Artificial intelligence (AI) may be accelerating the attack workflow.

The Australian Cyber Security Centre (ACSC) issued a detailed advisory on July 11, highlighting an international threat actor group that is weaponising weaknesses in popular content management systems (CMS) and associated plugins. The campaign specifically targets platforms such as WordPress, Craft CMS, MaxSite CMS, MetInfo CMS and Joomla JCE.

Impact on Australian Enterprises

According to ACSC, a significant number of small‑ and medium‑sized Australian businesses have already found malicious webshells planted on their websites. Webshells act as backdoors, granting attackers continuous remote control, enabling credential theft, further malware deployment, and deeper network infiltration.

Vulnerable Plugins and CVEs

The advisory lists more than twenty exploited plugins, each tied to a known CVE. Examples include Simple File List (CVE‑2025‑34085), WavePlayer (CVE‑2025‑12057), Ninja Forms (CVE‑2026‑0740), Gravity Forms (CVE‑2025‑12352) and several others across the WordPress ecosystem, as well as Craft CMS (CVE‑2025‑32432) and Joomla JCE (CVE‑2026‑48907). These flaws allow attackers to inject malicious code and gain privileged access.

AI‑Assisted Exploitation

ACSC notes that the campaign may be powered by artificial intelligence, which can automate reconnaissance, prioritize vulnerable targets, and accelerate the exploitation chain. AI‑driven scanners can probe thousands of sites in minutes, dramatically increasing the scale and speed of attacks.

Mitigation Recommendations

Web administrators are urged to apply the latest security patches for their CMS, themes, and plugins, remove any unused components, and enable automatic updates wherever possible. Additional hardening steps include setting web directories to read‑only, monitoring for unauthorized file creation, restricting access to sensitive directories, and blocking unexpected child‑process spawning on the web server.

Broader Implications

This incident underscores the systemic risk posed by widely adopted software stacks and the necessity for continuous security hygiene, especially for smaller enterprises with limited IT resources. Security experts recommend that regulators collaborate with CMS vendors to expand bug‑bounty programs and enforce stricter disclosure timelines, thereby reducing the window of opportunity for threat actors.