Attackers Are Actively Exploiting CMS Vulnerabilities. Is Your Website Next?
If your business runs its website on WordPress, Drupal, or any other content management system, the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) has flagged a critical, large-scale exploitation campaign targeting CMS vulnerabilities. The campaign is active now, and any business running an unpatched or poorly configured CMS is a potential target, regardless of size or industry.
Why This Alert Matters
ASD’s ACSC issues alert ratings based on severity and likelihood of exploitation. A “critical” rating, combined with confirmation of large-scale, active exploitation, is reserved for the most urgent cases. This isn’t a theoretical vulnerability sitting in a research paper. It’s being exploited against real organisations right now, and the scale of the campaign suggests attackers are running automated scans across the internet looking for exposed, vulnerable CMS installations.
For Australian businesses, the risk isn’t limited to large enterprises with dedicated security teams. Small and medium businesses often run CMS platforms with default configurations, outdated plugins, or no formal patch management process at all, which makes them some of the easiest targets in this kind of campaign.
A Fresh Example: The wp2shell WordPress Core Flaw
This alert isn’t just a general warning. A concrete example landed days later. On 17 July 2026, WordPress released versions 6.9.5 and 7.0.2 to patch a pre-authentication remote code execution flaw dubbed wp2shell, found in WordPress core itself.
What makes this one notable:
- It affects a default WordPress install with no plugins installed at all, so having a “clean” site with nothing added isn’t protection.
- It’s exploitable by an anonymous attacker with no login credentials required.
- Versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are affected. If your site is running anything in those ranges and hasn’t been updated since 17 July 2026, it’s exposed.
- Neither WordPress nor the researcher who found it has published a CVE ID or CVSS score yet, which means CVE-based vulnerability scanners will not flag this one. Checking your actual version number is the only reliable way to know if you’re affected.
No mass exploitation has been publicly reported yet, but the underlying campaign ASD flagged shows attackers moving quickly once a fix like this is public, because the patch itself points directly at what was broken. If you can’t update immediately, blocking anonymous access to the WordPress REST API batch endpoint at your firewall is a stopgap, not a fix.
Who’s at Risk
Any organisation running a CMS is a potential target, but risk increases significantly if your business:
- Hasn’t applied CMS core, theme, or plugin updates in the last 30 to 60 days
- Uses free or lesser-known plugins without an active security patching history
- Doesn’t have a web application firewall (WAF) or equivalent protection in front of the CMS
- Has never had the CMS independently penetration tested
- Manages the website internally without a dedicated security or IT resource
If any of these apply to your organisation, treat this alert as a prompt to act, not just read.
What Australian Businesses Should Do Now
1. Confirm your CMS and all plugins are fully patched. This includes the CMS core, all themes, and every installed plugin, not just the ones you actively use. Abandoned or inactive plugins are common entry points because they’re often forgotten during routine updates.
2. Review user accounts and access levels. Remove any admin accounts that are no longer needed, and enforce multi-factor authentication on all remaining admin-level accounts.
3. Check for a web application firewall. A properly configured WAF can block many of the automated exploitation attempts associated with this kind of campaign before they reach your CMS.
4. Get the CMS independently tested. Automated scanning tools are useful, but they don’t replicate what a skilled attacker actually does. A proper penetration test identifies exploitable weaknesses that scanners miss, including chained vulnerabilities and misconfigurations specific to your setup.
5. Have an incident response plan ready. If your website is compromised despite these steps, knowing who to call and what to do in the first hour matters. A clear plan reduces both downtime and data exposure.
How Intrix Can Help
Intrix’s Application Security services are built specifically to identify and validate the kinds of CMS and web application vulnerabilities being exploited in campaigns like this one. For businesses that want continuous coverage rather than a single point-in-time test, our AppSec as a Service offering provides ongoing testing and validation as your website and its plugins change over time.
If you’re not sure whether your CMS is currently exposed, the fastest way to find out is to have it properly tested by a CREST-certified team rather than waiting to see if you show up in the next wave of this campaign.
The Bottom Line
This alert is a timely reminder that a CMS is not a “set and forget” part of your business. Attackers are actively scanning for exactly this kind of exposure right now. Patching, access reviews, and independent testing are the fastest ways to move your business off the list of easy targets.
Frequently Asked Questions
What is ASD’s ACSC and why does its alert rating matter? ASD’s ACSC is Australia’s national cyber security authority. Its alert ratings reflect severity and likelihood of exploitation, with “critical” reserved for the most urgent, actively exploited threats. A critical rating means businesses should act immediately, not just monitor the situation.
Which CMS platforms are affected by this campaign? The alert covers vulnerabilities across various web content management systems, not one specific platform. WordPress, Drupal, and other CMS platforms with outdated cores, themes, or plugins are all potential targets in this kind of large-scale campaign.
What is the wp2shell WordPress vulnerability? wp2shell is a pre-authentication remote code execution flaw found in WordPress core, patched in versions 6.9.5 and 7.0.2 on 17 July 2026. It affects default installs with no plugins and requires no login credentials to exploit, making it exploitable by any anonymous attacker.
How do I know if my website has already been affected? Warning signs include unexpected admin accounts, unfamiliar files in your CMS directory, unusual outbound traffic, or changes to site content you didn’t make. If you notice any of these, engage an incident response specialist immediately rather than attempting to fix it yourself.
Is a web application firewall enough protection on its own? No. A WAF helps block many automated attacks, but it isn’t a substitute for patching, access control, and independent testing. Layered defences, not a single tool, are what actually reduce risk in a campaign like this.
