Global Campaign Exploits Unpatched CMS Vulnerabilities to Deploy Webshells on WordPress, Joomla, and Others
What Happened — Australia’s Signals Directorate warned that threat actors are running a coordinated campaign that scans for known CMS flaws (17 CVEs across WordPress plugins, Craft CMS, Joomla, etc.) and, when found, uploads web‑shells to gain persistent remote access. All of the vulnerabilities are publicly disclosed and already patched; successful compromises are therefore the result of organizations that have not applied the fixes.
Why It Matters for Compliance & Audit Readiness
- Unpatched software represents a control gap that SOC 2 CC6.1 (Change Management) and CC7.1 (System Operations) are designed to detect, remediate, and evidence.
- Continuous evidence of patch‑management and configuration‑baseline monitoring is essential to demonstrate due diligence during a SOC 2 audit.
- Mapping each CMS component to a control and collecting automated proof (e.g., patch‑status logs) provides the audit trail that the Trust Center can surface for reviewers.
Who Is Affected – Small‑ and medium‑size businesses that run public‑facing websites, especially in retail/e‑commerce, professional services, and any sector that relies on WordPress, Joomla, or similar CMS platforms.
Recommended Actions
- Inventory every CMS instance and associated plugins; cross‑reference against the CVE list in the alert.
- Deploy an automated patch‑management solution that records successful updates as audit evidence.
- Implement continuous configuration monitoring to flag any unauthenticated file‑upload or RCE‑type changes.
- Document the remediation process in your SOC 2 control narrative and retain logs in the Trust Center for future audits.
Source: Security Affairs – Australia Alerts Organizations to Ongoing CMS Exploitation Attacks
Technical Notes – Attack vector: vulnerability exploitation (unauthenticated file upload, remote code execution, SSRF, deserialization). Exploited CVEs include CVE‑2025‑34085, CVE‑2026‑0740, CVE‑2025‑32432, among others. Payload: web‑shells that enable credential harvesting, site defacement, and lateral malware distribution. Source: same as above