Large-scale CMS exploitation campaign targets Australian websites

What happened

In July 2026 the ASD’s Australian Cyber Security Centre (ACSC) issued an alert about a large, automated campaign targeting website content management systems worldwide, including in Australia. The ACSC said many small to medium Australian businesses had been affected.

Attackers are scanning the internet for websites running vulnerable software, then using known flaws to upload a webshell: a small file that gives them remote control of the web server. The flaws mostly allow uploading files or running code without logging in.

What’s being targeted

The alert lists vulnerable versions of more than a dozen products. Most are WordPress plugins, including popular ones:

• Form and booking plugins such as Ninja Forms, Gravity Forms and WPBookit
• Performance and backup plugins such as Breeze Cache, BerqWP and WPvivid Backup
• Theme and builder add-ons such as ThemeREX Addons, ACF Extended and GutenKit
• Other platforms, including Craft CMS, Joomla JCE, MetInfo and MaxSite

The ACSC also pointed to a joint statement from Five Eyes cyber agencies warning that AI is shrinking the time between a flaw being published and attackers using it.

Why it matters for a small business

Once attackers control a web server, they can deface or take down the site, capture what visitors type into forms (including logins and payment details), plant malware or scam pages aimed at your customers, and use the server as a stepping stone into the rest of your network. For most small businesses the website is the shop front, so the reputational damage can outlast the technical fix.

What to do now

• Update everything. Bring your CMS, themes and plugins up to date, and delete plugins and themes you don’t use.
• Check for signs of compromise. Look for unfamiliar files in the website folders, especially recently changed files in plugin directories, and new admin users.
• Ask your web host or developer to review web access logs for requests to suspicious files. The ACSC’s alert includes technical steps for this.
• Treat any server with a webshell as compromised. Isolate it, restore from a clean backup or rebuild, then change every password. Our guide on what to do if your website is hacked walks through it.
• Turn on two-step verification for website admins, hosting, your domain registrar and DNS.

Where to get help

Businesses that think they’ve been affected can call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), or report through ReportCyber.