Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites

The File Manager (wp-file-manager) WordPress plugin before version 6.9 ships an example elFinder connector file that the plugin renames to have a .php extension, exposing it directly to unauthenticated web requests. An attacker can invoke the elFinder upload (or mkfile and put) commands on that connector to write arbitrary PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory, which the web server then executes. Successful exploitation yields full unauthenticated remote code execution on the hosting server, compromising the WordPress site and potentially the broader host. Any WordPress site running an affected version of the File Manager plugin is exposed, and the flaw was heavily exploited in the wild in August and September 2020, including mass backdooring campaigns (WP-SHELLSTORM) and chaining with other vulnerabilities such as Zerologon. It carries a CVSS 3.1 score of 9.8, sits in CISA's Known Exploited Vulnerabilities catalog, and has a 97.3% EPSS probability of exploitation.

Do: Update the File Manager (wp-file-manager) plugin to version 6.9 or later immediately, per vendor and CISA instructions. If updating is not immediately possible, deactivate the plugin or remove/restrict the exposed example elFinder connector file, and check wp-content/plugins/wp-file-manager/lib/files/ for unexpected PHP files (e.g., webshells) plus unfamiliar admin users, since exploitation was widespread in August–September 2020.

Simple File List, a WordPress plugin for publishing downloadable file lists, is vulnerable to unauthenticated remote code execution in all versions up to and including 4.2.2 (CWE-434). The flaw is in the plugin's rename function: an attacker first uploads a file containing PHP code with a harmless .png extension, then abuses the rename function to change that file's extension to .php, turning the upload into an executable script on the server. Because the upload and rename operations require no authentication, any remote attacker can run arbitrary code on the web server, which can lead to complete site compromise, webshells, or backdoor installation. All WordPress sites running Simple File List 4.2.2 or earlier are affected, on the order of tens of thousands of installations based on the plugin's active-install count. Public proof-of-concept exploits are available and the vulnerability carries a high EPSS score (44.7% probability of exploitation in 30 days, 99th percentile), though it is not yet listed in CISA's Known Exploited Vulnerabilities catalog.

Do: Update Simple File List to the latest release (any version newer than 4.2.2); there is no configuration mitigation since the attack requires no authentication. Until patched, check the plugin's upload directory for unexpected .php files and renamed .png uploads, and review web server logs for unauthenticated requests to the plugin's upload/rename endpoints. Given ongoing WordPress plugin exploitation campaigns reported in 2026 (e.g., WP-SHELLSTORM), also scan already-patched sites for webshells and backdoors in case exploitation already occurred.

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.

The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing unauthenticated users to upload arbitrary file on the server and lead to RCE

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36847.

The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the store_javascript_cache.php file in all versions up to, and including, 2.2.42. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_new_customer' route in all versions up to, and including, 1.0.6. The plugin’s image‐upload handler calls move_uploaded_file() on client‐supplied files without restricting allowed extensions or MIME types, nor sanitizing the filename. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVE-2026-0740 is a critical (CVSS 9.8) unauthenticated arbitrary file upload vulnerability in the Ninja Forms - File Uploads plugin for WordPress, affecting all versions up to and including 3.3.26. It is caused by missing file type validation in the NF_FU_AJAX_Controllers_Uploads::handle_upload function, so anyone can send a crafted request to the plugin's upload AJAX endpoint with no account, no privileges, and no user interaction. Because uploaded file types are not validated, an attacker can plant arbitrary files, such as PHP scripts, on the web server, which may enable remote code execution and full compromise of the site. Any WordPress site running the File Uploads add-on for Ninja Forms at version 3.3.26 or earlier is exposed, especially sites that accept front-end uploads from visitors. The flaw was partially patched in 3.3.25 and fully fixed in 3.3.27; no public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the 62.9% EPSS score (99th percentile) signals a high likelihood of exploitation within 30 days.

Do: Update the Ninja Forms - File Uploads add-on to version 3.3.27 or later, since 3.3.25-3.3.26 contain only a partial fix. Until patched, restrict or disable unauthenticated front-end uploads and block unauthenticated requests to the plugin's upload AJAX endpoint via WAF rules. Audit the uploads directories for unexpected PHP files or webshells, as arbitrary uploads may have enabled code execution.

The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448

Everest Forms Pro, a premium WordPress form-builder plugin, contains an unauthenticated PHP code-injection flaw (CWE-94) in its Calculation Addon, where the process_filter() function concatenates user-submitted form field values into a PHP code string that is passed to eval() without adequate escaping. The sanitize_text_field() sanitization applied to input does not escape single quotes or other PHP-context characters, so an unauthenticated attacker can submit a crafted value in any string-type form field (text, email, URL, select, radio) on a form using the 'Complex Calculation' feature and execute arbitrary PHP code on the server. Successful exploitation yields full remote code execution (CVSS 3.1: 9.8, AV:N/AC:L/PR:N/UI:N), and related reporting indicates attackers are using it to take over sites and gain admin access, with the WP-SHELLSTORM campaign described as having backdoored thousands of WordPress sites. Any WordPress site running Everest Forms Pro in version 1.9.12 or earlier, where a form uses the Calculation Addon's Complex Calculation feature, is affected. No public proof-of-concept is known and the flaw is not in CISA KEV, but multiple news outlets report active in-the-wild exploitation, and the 39.2% EPSS score (99th percentile) indicates a high probability of exploitation within 30 days.

Do: Update Everest Forms Pro to a version newer than 1.9.12 as soon as possible; as an interim mitigation, disable or remove forms that use the Calculation Addon's Complex Calculation feature (or deactivate the addon). Because the flaw is being actively exploited to backdoor sites and obtain admin access, check affected sites for unauthorized administrator accounts, suspicious or newly modified files and webshells, and unknown plugins/themes, and review form-submission logs for anomalous values in string-type fields.

CVE-2026-3844 is a critical (CVSS 9.8) arbitrary file upload vulnerability in the Breeze Cache plugin for WordPress, caused by missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to and including 2.4.4. An unauthenticated attacker can trigger the function over the network and upload arbitrary files to the affected site's server, but the flaw is only exploitable when the 'Host Files Locally - Gravatars' option is enabled, which is disabled by default. Uploaded files can include executable PHP such as web shells, so successful exploitation may make remote code execution and full site or server compromise possible. Any WordPress site running Breeze Cache 2.4.4 or earlier with local Gravatar hosting switched on is affected, and press coverage reports more than 400,000 sites at risk. Headlines indicate attackers are already exploiting the flaw in the wild; no public proof-of-concept is known, the EPSS score of 27.7% (98th percentile) signals high near-term exploitation risk, and the CVE is not yet in CISA's KEV.

Do: Sites running Breeze Cache should update to the latest patched release (any version after 2.4.4); if updating is not immediately possible, disable the 'Host Files Locally - Gravatars' setting to close the attack path. Administrators should also audit uploaded files and the webroot for unexpected PHP files or web shells and check site integrity for signs of compromise, given reports of active exploitation and related WordPress backdoor campaigns.

CVE-2026-48907 is an improper access control flaw (CWE-284) in the Joomla Content Editor (JCE) extension from Widget Factory Limited that allows unauthenticated users to create new editor profiles. Because these profiles can confer file-upload privileges, an attacker can reach the editor's upload functionality without logging in, upload malicious PHP files, and have the web server execute them, resulting in unauthenticated remote code execution with high impact on system confidentiality, integrity, and availability (CVSS 4.0 score of 10). Any Joomla site running the affected JCE extension is exposed, with internet-facing sites most at risk. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-16, confirming in-the-wild exploitation, and EPSS assigns a 78.1% probability of exploitation within 30 days (100th percentile). No public proof-of-concept is known, but CISA and Australian authorities have warned of active CMS exploitation targeting this flaw.

Do: Apply the latest JCE update per Widget Factory Limited's vendor instructions, in line with CISA BOD 26-04 requirements (federal agencies must patch or discontinue use of the product if mitigations are unavailable). Until patched, verify whether unauthenticated users can create editor profiles in your JCE configuration, restrict access to the extension, and inspect webroots and logs for unexpected PHP file uploads. Given confirmed active exploitation and a very high EPSS score, prioritize internet-facing Joomla sites immediately.

The Custom css-js-php WordPress plugin through 2.0.7 does not properly sanitize user input before using it in a SQL query, and the result is passed to eval(), allowing unauthenticated users to execute arbitrary PHP code on the server.