Reported by 3 outlets
ACSC Warns of Global CMS Exploitation Campaign — 18 CVEs Across WordPress, Craft CMS, Joomla, and Others
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
ASD's Australian Cyber Security Centre published the underlying alert on 9 July 2026, three days before it hit the news cycle, rated critical, and the campaign it describes is broader and messier than the headline count of 18 CVEs suggests. NVD records CVE-2025-34085 as a rejected duplicate of CVE-2020-36847, both of which the advisory lists under Simple File List, so the campaign resolves to 17 unique vulnerabilities, and the advisory hedges the GutenKit/Hunk Companion entry as "Likely CVE-2024-9234", a qualifier that secondary coverage dropped. The vulnerability classes are uniform across the list, unauthenticated file upload, code execution, SSRF, or deserialisation, all ending in webshell deployment. One listed target is not even a CMS: CVE-2026-31843 in pay-uz is a Laravel package flaw in the /payment/api/editable/update endpoint, which means anything running PHP with a file-write path is in scope, not just WordPress, Craft, MaxSite, MetInfo, and Joomla.
The operational point is that seventeen distinct CVEs behave here like a single bug. Nearly every entry is the same primitive, an unauthenticated route that writes attacker-controlled files or reaches call_user_func, whether that is ACF Extended's prepare_form(), Sneeit Framework's sneeit_articles_pagination_callback(), Breeze's fetch_gravatar_from_remote(), Gravity Forms' copy_post_image(), or GutenKit's install-active-plugin REST endpoint, so one scanner sweeps all of them in a pass. The disclosure dates tell defenders who is actually exposed: CVE-2024-9234 was published on 11 October 2024 and the newest entry, CVE-2026-48907, on 5 June 2026, so every target had a patch available for weeks at minimum and most for a year or more. The victims the ACSC confirmed, many Australian small and medium businesses, are the unpatched long tail, meaning campaign scale measures plugin maintenance debt rather than zero-day sophistication. Treat this as one detection problem, unexpected file creation and child processes on web servers, rather than eighteen patch triage problems.
The ACSC's response sequence applies before patching on any suspected hit: inspect web directories and affected plugin directories for abnormal files, review web access logs for GET or POST requests to webshell paths, treat any positive host as compromised, isolate it, and audit authentication and network logs back to the initial exploitation. Patch floors where the records state them: Craft CMS 3.9.15, 4.14.15, or 5.6.17 per branch; ThemeREX Addons 2.38.5; WavePlayer 3.8.0; and past the last-vulnerable releases GutenKit 2.1.0, Breeze 2.4.4, BerqWP 2.2.42, WPBookit 1.0.6, Ninja Forms File Uploads 3.3.26, Gravity Forms 2.9.20, WPvivid Backup 0.9.123, Sneeit Framework 8.3, Simple File List 4.2.2, ACF Extended 0.9.1.1, MaxSite CMS 109.1, and pay-uz 2.2.24, with MetInfo 7.9, 8.0, and 8.1 all named as vulnerable. Concrete hunt anchors from the vulnerability records: unauthenticated requests to store_javascript_cache.php, the add_new_customer route, editor_markitup/preview-ajax.php, and /payment/api/editable/update; unexpected .php files appearing under plugin directories; and child processes spawning from the webserver worker, which the ACSC recommends killing through application control. Set web directories read-only where feasible and deny lateral traffic from web hosts toward corporate networks.
Two developments would move this assessment. Joomla JCE has sat on CISA's KEV catalog since 16 June, and KEV additions for the remaining sixteen would impose federal remediation deadlines and widen the reporting pool well past Australia. Confirmation of the advisory's suggestion that AI is accelerating the campaign, or named actor attribution with scan telemetry, would shift this from an opportunistic sweep over patch lag to a targeted operation and change the response calculus accordingly.
Timeline
-
original reporting
ACSC Warns of Global CMS Exploitation Campaign — 18 CVEs Across WordPress, Craft CMS, Joomla, and Others
bleepingcomputer.com · 94d ago · July 12th, 2026
Previously covered: JCE (CVE-2026-48907) July 8; ColdFusion and Langflow KEV additions July 8/9. New: ACSC issues government alert with comprehensive CVE list, confirms widespread Australian business impact.
The Australian Cyber Security Centre (ACSC) has issued a formal alert about a large-scale exploitation campaign targeting vulnerable content management systems globally, with many Australian SMBs confirmed affected. The campaign deploys webshells for persistent access, enabling service disruption, credential theft, additional malware deployment, and lateral network movement.
The ACSC advisory lists 18 specific CVEs under active exploitation across five CMS platforms and 14 plugins/extensions:
WordPress plugins (13 CVEs): Simple File List (CVE-2025-34085, CVE-2020-36847), WavePlayer (CVE-2025-12057), BerqWP (CVE-2025-7443), WPBookit (CVE-2025-7852), Ninja Forms (CVE-2026-0740), ThemeREX Addons (CVE-2026-1969), Breeze Cache (CVE-2026-3844), pay-uz (CVE-2026-31843), ACF Extended (CVE-2025-13486), Sneeit Framework (CVE-2025-6389), WPvivid Backup (CVE-2026-1357), Gravity Forms (CVE-2025-12352), GutenKit/Hunk Companion (CVE-2024-9234).
Other platforms: Craft CMS (CVE-2025-32432), MaxSite CMS (CVE-2026-3395), MetInfo CMS (CVE-2026-29014), Joomla JCE (CVE-2026-48907 — CISA KEV since June 16).
The ACSC noted the campaign may be supported by AI, which could accelerate vulnerability discovery and exploitation at scale. Website administrators should apply all CMS/plugin updates immediately, remove unused components, enable automatic updates, make web directories read-only, monitor for unauthorized file creation, restrict access to sensitive directories, and block unexpected child process spawning on web servers.
-
update from nvd.nist.gov
CVE-2024-9234: GutenKit plugin arbitrary file upload via install-and-activate REST endpoint
nvd.nist.gov · 732d ago · October 11th, 2024
NVD record for the GutenKit plugin for WordPress, vulnerable in all versions up to and including 2.1.0 to arbitrary file uploads via a missing capability check on install_and_activate_plugin_from_external() on the install-active-plugin REST API endpoint. Exploitation allows unauthenticated attackers to install and activate arbitrary plugins. This is the oldest vulnerability in the ACSC campaign list, published October 2024.
-
update from nvd.nist.gov
CVE-2025-32432: Craft CMS remote code execution
nvd.nist.gov · 536d ago · April 25th, 2025
NVD record describing a remote code execution vulnerability in Craft CMS from 3.0.0-RC1 before 3.9.15, 4.0.0-RC1 before 4.14.15, and 5.0.0-RC1 before 5.6.17, with a high-impact, low-complexity attack vector. Patched in versions 3.9.15, 4.14.15, and 5.6.17.
-
update from nvd.nist.gov
CVE-2025-34085 rejected as duplicate of CVE-2020-36847
nvd.nist.gov · 462d ago · July 9th, 2025
NVD carries a rejected record for CVE-2025-34085, withdrawn by its CVE Numbering Authority as a duplicate of CVE-2020-36847. The ACSC campaign list counts both identifiers under Simple File List, so the advertised 18 CVEs resolve to 17 unique vulnerabilities.
-
update from nvd.nist.gov
CVE-2020-36847: Simple File List plugin remote code execution
nvd.nist.gov · 458d ago · July 12th, 2025
NVD record for the Simple-File-List plugin for WordPress, vulnerable in versions up to and including 4.2.2 via a rename function that converts an uploaded PNG to a PHP file, giving unauthenticated attackers code execution.
-
update from nvd.nist.gov
CVE-2025-7852: WPBookit plugin arbitrary file upload
nvd.nist.gov · 446d ago · July 24th, 2025
NVD record for the WPBookit booking plugin for WordPress, vulnerable up to and including 1.0.6 through missing file type validation in image_upload_handle(), hooked via the add_new_customer route.
-
mentioned by nvd.nist.gov
CVE-2025-7443: BerqWP plugin arbitrary file upload
nvd.nist.gov · 438d ago · August 1st, 2025
-
mentioned by nvd.nist.gov
CVE-2025-12352: Gravity Forms arbitrary file upload
nvd.nist.gov · 340d ago · November 7th, 2025
-
update from nvd.nist.gov
CVE-2025-12057: WavePlayer plugin unauthenticated file upload
nvd.nist.gov · 328d ago · November 19th, 2025
NVD record for the WavePlayer WordPress plugin before 3.8.0, which lacks authorization on an AJAX action and validation of copied files, letting unauthenticated users upload arbitrary files and achieve remote code execution. Fixed in 3.8.0.
-
update from nvd.nist.gov
CVE-2025-6389: Sneeit Framework plugin remote code execution
nvd.nist.gov · 323d ago · November 25th, 2025
NVD record for the Sneeit Framework plugin for WordPress, vulnerable in all versions up to and including 8.3 via sneeit_articles_pagination_callback() passing user input to call_user_func(). Unauthenticated code execution can be leveraged to inject backdoors. Sneeit Framework exploitation was publicly reported in late 2025.
-
mentioned by nvd.nist.gov
CVE-2025-13486: ACF Extended plugin remote code execution
nvd.nist.gov · 314d ago · December 3rd, 2025
-
update from nvd.nist.gov
CVE-2026-1357: WPvivid Backup unauthenticated arbitrary file upload
nvd.nist.gov · 244d ago · February 11th, 2026
NVD record for the WPvivid Backup & Migration plugin for WordPress, vulnerable up to and including 0.9.123 through improper error handling in RSA decryption combined with missing path sanitization when writing files.
-
update from nvd.nist.gov
CVE-2026-3395: MaxSite CMS code injection
nvd.nist.gov · 226d ago · March 1st, 2026
NVD record describing code injection in MaxSite CMS up to version 109.1 via eval in application/maxsite/admin/plugins/editor_markitup/preview-ajax.php in the MarkItUp preview AJAX endpoint. Remote code execution is possible without authentication.
-
update from nvd.nist.gov
CVE-2026-1969: ThemeREX Addons arbitrary file upload, incomplete fix of CVE-2024-13448
nvd.nist.gov · 204d ago · March 23rd, 2026
The flaw is an incorrect fix for the earlier CVE-2024-13448 in the same code.
-
mentioned by nvd.nist.gov
CVE-2026-29014: MetInfo CMS unauthenticated PHP code injection
nvd.nist.gov · 195d ago · April 1st, 2026
-
mentioned by nvd.nist.gov
CVE-2026-0740: Ninja Forms File Uploads arbitrary file upload
nvd.nist.gov · 189d ago · April 7th, 2026
-
update from nvd.nist.gov
CVE-2026-31843: pay-uz Laravel package unauthenticated file overwrite
nvd.nist.gov · 180d ago · April 16th, 2026
NVD record for the goodoneuz/pay-uz Laravel payment package up to and including 2.2.24, exposing /payment/api/editable/update via Route::any without authentication middleware. Unauthenticated attackers can overwrite existing PHP payment hook files, yielding remote code execution. The component is a Laravel package rather than a CMS plugin.
-
mentioned by nvd.nist.gov
CVE-2026-3844: Breeze cache plugin arbitrary file upload
nvd.nist.gov · 174d ago · April 23rd, 2026
-
mentioned by nvd.nist.gov
CVE-2026-48907: Joomla JCE extension editor profile creation to PHP upload
nvd.nist.gov · 130d ago · June 5th, 2026
-
update from cyber.gov.au
ACSC alert: Large-scale exploitation campaign targeting website content management systems (CMS)
cyber.gov.au · 97d ago · July 9th, 2026
Mitigations include webshell inspection of web and plugin directories, access-log review for requests to webshell paths, treating webshell hosts as compromised, read-only web directories, and application control against unexpected child processes spawned by the webserver.