A global exploitation campaign is actively targeting vulnerabilities in various CMS platforms and plugins, including multiple WordPress plugins and CMS products such as Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE. The campaign involves scanning for vulnerable sites to deploy webshells, which provide attackers persistent access to compromised systems. The ACSC has identified specific CVEs associated with exploited plugins and CMS products. The campaign has affected many Australian businesses and may be leveraging AI to enhance attack speed and scale. The ACSC recommends applying security updates, removing unused components, enabling automatic updates, and implementing access restrictions to mitigate the threat.

Successful exploitation allows attackers to deploy webshells on compromised CMS platforms, granting persistent access. This access can be used to disrupt services, steal credentials, install additional malware, and move laterally within affected networks. The campaign has already impacted many small- to medium-sized Australian businesses, indicating real-world exploitation and operational impact.

Apply the latest security updates for CMS platforms, themes, and plugins as soon as they become available. Remove any unused CMS components and enable automatic updates where possible. Make web directories read-only when feasible, monitor for unauthorized file creation, restrict access to sensitive directories, and block unexpected spawning of child processes on web servers. These measures align with ACSC recommendations to reduce exposure to this campaign.