Mass CMS exploitation campaign 2026: WordPress plugins, Craft, Joomla JCE

What the ACSC reported

The alert describes actors scanning websites worldwide, many of them small and medium businesses, for flaws that allow unauthenticated file upload, remote code execution, server-side request forgery or deserialisation, and then deploying webshells for defacement, credential capture, malware hosting or a foothold into the wider network.

Is my site affected?

• List installed plugins and versions (for WordPress: Plugins screen, or wp plugin list with WP-CLI) and compare them with the table and each vendor’s fixed version.
• Look for PHP files in upload directories and for recently changed PHP files you did not deploy.
• Review new administrator accounts, scheduled tasks and unknown outbound connections from the web server.

# Recently changed PHP files in a web root (adjust the path and days)
find /var/www -name '*.php' -mtime -30 -print
# PHP files where none should exist
find /var/www -path '*/uploads/*' -name '*.php' -print

How to fix it

• Update or remove every listed component. Remove plugins you do not use.
• If you find a webshell, treat the server as compromised: take a copy for investigation, restore from a known-good backup or rebuild, and rotate database, admin, FTP/SSH and API credentials.
• Keep the PHP runtime patched too; see PHP2Shell remediation.

FAQ