WordPress and Joomla Are Under Active Exploitation. This Is What's Happening.

Unfortunately, this isn't a theoretical risk. Attackers are actively scanning internet facing WordPress and Joomla installations right now, looking for specific vulnerabilities, and deploying webshells when they find them. The goal is persistent remote access to your server - or in other words, a quiet foothold.

July 2026 brought two separate but related events that together make this the most significant CMS security moment in recent memory. If you're running either platform (or managing sites for clients who are), there are specific things you need to check today.

The Campaign - What the ACSC Alert Said

On July 9, 2026, Australia's Cyber Security Centre issued a critical alert about a large scale exploitation campaign targeting CMS platforms globally. Note that the name "Australian" in that alert can be misleading - the agency was flagging a worldwide campaign that was hitting Australian businesses specifically, not one limited to that geography. Organizations across North America, Europe, and Asia are all in scope.

The campaign works the way most opportunistic exploitation does - automated scanning at scale, looking for sites running vulnerable software versions, then dropping a webshell when one is found. A webshell is a small piece of code planted in your file system that gives the attacker remote command execution on your server - persistent access they can return to whenever they want, typically without triggering obvious alarms. From there they can steal credentials, deface the site, distribute malware to your visitors, or use your server as a launchpad into other systems. We've seen this firsthand.

The campaign's pace suggests it may be supported by AI tooling. The Five Eyes agencies released a joint statement specifically on this - advances in AI are compressing the window between vulnerability disclosure and active exploitation. The time you used to have to patch before attackers moved (historically measured in weeks) is getting shorter and shorter.

The Specific Software Being Targeted

The ACSC published a full table of affected products and CVEs. For WordPress, the campaign is targeting vulnerabilities in plugins many sites are actively running:

• Ninja Forms (CVE-2026-0740)
• Gravity Forms (CVE-2025-12352)
• ACF Extended (CVE-2025-13486)
• WPvivid Backup (CVE-2026-1357)
• Breeze Cache (CVE-2026-3844)
• ThemeREX Addons (CVE-2026-1969)
• Simple File List, WavePlayer, BerqWP, WPBookit, GutenKit / Hunk Companion - and several others

On the Joomla side, the primary target is Joomla Content Editor (JCE) - CVE-2026-48907, an unauthenticated remote code execution vulnerability via unsafe deserialization in the asset transform functionality. No credentials required. JCE was added to CISA's Known Exploited Vulnerabilities catalogue on June 16, 2026, and public automated exploit tooling has been available since. Roughly 2.5 million Joomla sites are potentially in scope. The fix is JCE version 2.9.99.5 or later.

Then... wp2shell Hit WordPress Core

Eight days after the ACSC alert, on July 17, 2026, a separate and more serious WordPress vulnerability was disclosed. wp2shell is a chain of two WordPress core flaws - CVE-2026-63030 (REST API batch route confusion) and CVE-2026-60137 (SQL injection in WP_Query) - that together allow an unauthenticated attacker to achieve full remote code execution on a default WordPress install with no plugins.

That last part is what makes this different from most WordPress vulnerabilities. Most exploits require a specific plugin to be installed. wp2shell requires nothing beyond a stock WordPress 6.9.0 through 7.0.1 installation. No login, no user interaction, no preconditions. A working public proof of concept appeared within hours of disclosure, and confirmed in-the-wild exploitation followed within days. WordPress pushed emergency patches (versions 6.9.5 and 7.0.2) and - unusually - enabled forced automatic updates across all sites running affected versions. Both CVEs were added to the CISA KEV catalogue on July 21.

Forced auto updates are rare. WordPress.org reserves them for situations where the risk is severe enough that waiting for manual action is not acceptable. This was one of those situations.

How the Attack Chain Works in Layman's Terms

Webshell attacks follow a consistent pattern regardless of which specific vulnerability is being exploited. Understanding it makes the mitigation steps make more sense.

The attacker's scanner hits your site and checks what software you're running and which version. If you're running a vulnerable version of JCE, or a vulnerable WordPress plugin, or an unpatched WordPress core, the exploit is sent - typically a crafted HTTP request that requires no authentication. If it succeeds, a small PHP file gets written somewhere in your web-accessible directory. That file is the webshell. It looks like any other PHP file, passes most basic file scans, and can sit quietly for days or weeks before being used. Once it's there, the attacker has a persistent backdoor that survives password changes, plugin updates, and most cleanup efforts unless the file itself is found and removed.

This is why the ACSC guidance specifically says that if you find a webshell, treat the entire server as compromised. Not just the website - the server.

What to Check Right Now

If you're running WordPress or Joomla, here's what you should be checking:

• WordPress: confirm your version is 7.0.2, 6.9.5, or 6.8.6+. Don't assume the forced auto update applied correctly - log into wp-admin and check the version number directly. If you're on 6.9.0 through 7.0.1, you're vulnerable to wp2shell until patched!
  
  
• Joomla: confirm JCE is updated to 2.9.99.5 or later if you have it installed. This is non-negotiable given it has been on CISA KEV since June and has public automated exploit tooling.
  
  
• Audit your plugin and extension list. Cross reference against the ACSC's published CVE table. Any plugin on that list that hasn't been updated is an open door. If a vulnerable plugin hasn't received a patch from its developer, disable and remove it.
  
  
• Look for unexpected files in your web directory. Webshells are often named to look innocuous - something like wp-config-bak.php, a file in your uploads folder, or an unexpected PHP file in a theme directory. Look for recently modified files in web-accessible locations, especially anything created in the last 30 to 60 days that you don't recognize.
  
  
• Check your administrator accounts. wp2shell's exploit chain can create a rogue admin account as part of the RCE sequence. Review your WordPress user list and remove any accounts you don't recognize.
  
  
• Review web access logs for suspicious REST API requests. Specifically, look for unexpected POST requests to /wp-json/batch/v1. That endpoint is the entry point for the wp2shell chain.
  
  
• Enable automatic updates if you haven't. For both plugins and core. This is one of those cases where the update risk is almost always lower than the exploit risk.

The Real Exposure & Next Steps

The real exposure (as is almost always the case) is in the plugins and extensions. 13 WordPress plugins were named in the ACSC alert. Several carry CVEs from 2025 that have had patches available for months and the JCE vulnerability was on CISA's known exploited list for over three weeks before most site owners heard about it.

If your sites run a long list of plugins or extensions that nobody is actively maintaining and reviewing, this campaign is a direct preview of what that exposure looks like when attackers decide to act on it. If you want a second set of eyes on a WordPress or Joomla site, or you're not sure what your current plugins and extensions look like, our security and compliance services are a place to start. We work with both platforms regularly and have decades of experience.

In short - if something looks compromised, treat the whole server that way, not just the CMS. The window to act keeps getting shorter, and this campaign has been running for weeks.