Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-25213 | Unauthenticated RCE in WordPress File Manager (wp-file-manager) Plugin | 9.8 | 97% | KEVPoC ×5 | KEV |
| CVE-2020-36847 | Unauthenticated Remote Code Execution in Simple File List WordPress Plugin | 9.8 | 44% | PoC ×2 | |
| CVE-2021-29441 | Nacos: When configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce… | 9.8 | 83% | PoC ×2 | |
| CVE-2025-12057 | The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing… | 9.8 | <1% | ||
| CVE-2025-34085 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36847 | — | — | ||
| CVE-2025-7443 | The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to… | 8.1 | <1% | ||
| CVE-2025-7852 | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via… | 9.8 | 2% | ||
| CVE-2026-0740 | Unauthenticated Arbitrary File Upload RCE in Ninja Forms File Uploads WordPress Plugin | 9.8 | 63% | ||
| CVE-2026-1969 | The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload… | 5.3 | <1% | ||
| CVE-2026-3300 | Unauthenticated RCE via PHP Code Injection in Everest Forms Pro WordPress Plugin | 9.8 | 39% | ||
| CVE-2026-3844 | Unauthenticated Arbitrary File Upload in Breeze Cache WordPress Plugin | 9.8 | 28% | ||
| CVE-2026-48907 | Unauthenticated PHP Code Upload and Execution in Joomla Content Editor (JCE) | 10.0 | 85% | KEVPoC ×3 | KEV |
| CVE-2026-6433 | The Custom css-js-php WordPress plugin through 2.0.7 does not properly sanitize user input before using it in a SQL query, and the result is passed to eval()… | 7.3 | 1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | xxooonline.eu.cc | ucture: 137.175.93[.]126, 43.108.17[.]80, and the domain xs.xxooonline[.]eu[.]cc. What makes WP-SHELLSTORM worth attention is not how ad |
| ipv4 | 137.175.93.126 | spotted it on June 11, 2026, on a US-based rented server at 137.175.93[.]126 with no password on it at all. Inside was roughly 800MB a |
| ipv4 | 43.108.17.80 | impostor. Block the known infrastructure: 137.175.93[.]126, 43.108.17[.]80, and the domain xs.xxooonline[.]eu[.]cc. What makes WP-SH |
From the original article
6 min read at thehackernews.com
A cybercrime crew left one of its own servers wide open on the internet for three weeks, and it exposed the operation's inner workings: the hacking tools, the activity logs, and target lists naming more than 1. 4 million websites. Far fewer were actually broken into, but the exposed files showed researchers how a mass site-hacking operation runs from the inside.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.