Global CMS Exploitation Campaign Targets WordPress and Joomla Sites

The Australia Cyber Security Centre (ACSC) is warning organizations about a CMS exploitation campaign targeting websites built on popular content management systems.

According to the agency, attackers are actively scanning vulnerable websites and exploiting flaws in CMS platforms and plugins to install webshells. Once deployed, the webshells give attackers remote control over compromised web servers.

CMS Exploitation Campaign Targets Multiple Platforms

The ACSC says the attackers are exploiting vulnerabilities that allow unauthenticated file uploads, remote code execution, server-side request forgery (SSRF), and insecure deserialization.

The campaign primarily targets WordPress and the Joomla Content Editor (JCE) extension.

Researchers have also observed attacks against:

• Craft CMS
• MaxSite CMS
• MetInfo CMS
• Sneeit Framework

By abusing these vulnerabilities, attackers can install webshells without requiring valid credentials.

Webshells Give Attackers Remote Access

Once a webshell is installed, attackers can remotely control the affected server.

They may take websites offline, deface pages with political messages, steal sensitive or personal information, upload additional malware, or use the compromised server as a foothold to attack other systems inside the network.

The ACSC says many small and medium-sized businesses in Australia have already been affected.

However, the CMS exploitation campaign is not limited to Australia. The agency says organizations around the world have also been targeted.

ACSC Warns Attack Window Is Shrinking

According to the ACSC, the campaign highlights how quickly attackers exploit newly discovered vulnerabilities.

Organizations now have less time to patch exposed systems before threat actors begin scanning for vulnerable targets.

The agency recommends reviewing web server logs, access logs, and network activity for signs of unauthorized access.

Security teams should also examine user accounts and restore a clean backup if they discover evidence of a compromise.

Organizations Should Patch and Monitor Systems

The ACSC urges administrators to ensure that both their CMS platform and all installed plugins remain fully updated.

Additional recommendations include:

• Restrict access to sensitive files and directories.
• Monitor or block unauthorized file creation.
• Watch for unexpected processes on web servers.
• Apply network segmentation where possible.

These measures can reduce the impact of successful attacks and make it harder for attackers to move through internal networks.

AI Expected to Accelerate Cyber Threats

The warning follows a recent advisory from intelligence agencies in Australia, Canada, New Zealand, the United Kingdom, and the United States.

The agencies said advances in artificial intelligence are likely to increase both the speed and scale of cyber operations.

They also stressed that cyber resilience is now a business priority rather than simply an IT responsibility.

Organizations that strengthen their defenses today will be better prepared to withstand future threats, while those that delay may face growing and avoidable risks.