Australia Alerts Organizations to Ongoing CMS Exploitation Attacks

Simple File List, a WordPress plugin for publishing downloadable file lists, is vulnerable to unauthenticated remote code execution in all versions up to and including 4.2.2 (CWE-434). The flaw is in the plugin's rename function: an attacker first uploads a file containing PHP code with a harmless .png extension, then abuses the rename function to change that file's extension to .php, turning the upload into an executable script on the server. Because the upload and rename operations require no authentication, any remote attacker can run arbitrary code on the web server, which can lead to complete site compromise, webshells, or backdoor installation. All WordPress sites running Simple File List 4.2.2 or earlier are affected, on the order of tens of thousands of installations based on the plugin's active-install count. Public proof-of-concept exploits are available and the vulnerability carries a high EPSS score (44.7% probability of exploitation in 30 days, 99th percentile), though it is not yet listed in CISA's Known Exploited Vulnerabilities catalog.

Do: Update Simple File List to the latest release (any version newer than 4.2.2); there is no configuration mitigation since the attack requires no authentication. Until patched, check the plugin's upload directory for unexpected .php files and renamed .png uploads, and review web server logs for unauthenticated requests to the plugin's upload/rename endpoints. Given ongoing WordPress plugin exploitation campaigns reported in 2026 (e.g., WP-SHELLSTORM), also scan already-patched sites for webshells and backdoors in case exploitation already occurred.

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the install_and_activate_plugin_from_external() function (install-active-plugin REST API endpoint) in all versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins, or utilize the functionality to upload arbitrary files spoofed like plugins.

The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing unauthenticated users to upload arbitrary file on the server and lead to RCE

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This only impacts sites that have allow_url_fopen set to `On`, the post creation form enabled along with a file upload field for the post

CVE-2025-13486 is a critical unauthenticated remote code execution vulnerability (CWE-94) in the Advanced Custom Fields: Extended WordPress plugin, affecting versions 0.9.0.5 through 0.9.1.1. The flaw resides in the prepare_form() function, which accepts user-supplied input and passes it to call_user_func_array(), so a crafted unauthenticated HTTP request can cause arbitrary code to execute on the server. A successful attacker gains code execution, which can be used to inject backdoors or create new administrative user accounts, potentially leading to full site takeover. Any WordPress site running an affected version of the plugin — estimated in the low tens of thousands of installs — is exposed, with the greatest risk on sites where the plugin's form functionality is reachable by anonymous visitors. No public proof-of-concept, no CISA KEV listing, and no confirmed in-the-wild exploitation have been reported yet, but the 67.6% EPSS score (99th percentile) indicates a high likelihood of exploitation within 30 days.

Do: Update Advanced Custom Fields: Extended to a version beyond 0.9.1.1 as soon as possible; if patching is delayed, disable the plugin or restrict access to its front-end form endpoints. Audit affected sites for unexpected administrator accounts, unfamiliar files, and modified plugin or core files that could indicate a backdoor. Prioritize this patch given the 9.8 CVSS score and high EPSS probability of near-term exploitation.

Craft CMS contains a code injection vulnerability (CWE-94) that allows a remote attacker to execute arbitrary code on affected servers. CISA's listing does not specify the exact attack path or authentication requirements, but the flaw is remotely triggerable and grants arbitrary code execution, which typically means full compromise of the web server and a foothold for follow-on activity such as ransomware (ransomware use is not yet confirmed). Any organization running a Craft CMS instance is in scope, including internet-facing content sites and deployments where the Craft admin panel is reachable from the internet. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-03-20, confirming exploitation in the wild, and EPSS assigns a 99.8% probability of exploitation within 30 days (100th percentile), although no public proof-of-concept is known. No CVSS score has been published yet, so defenders should treat the flaw as urgent given the KEV listing and near-certain EPSS likelihood.

Do: Apply the patched Craft CMS release per the vendor's security advisory referenced in CISA's KEV entry (specific fixed version numbers are not provided in the source data), prioritizing internet-exposed instances, and U.S. federal agencies should follow BOD 22-01 requirements for KEV-listed flaws. Until patched, restrict network access to the Craft CMS control panel/admin interface and review web and application logs for signs of code injection or unexpected process execution, since exploitation in the wild is confirmed while ransomware use remains unknown. Given the 99.8% EPSS score and KEV listing, treat discovery and patching of all Craft CMS instances, including headless deployments, as an urgent, time-boxed task.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36847.

CVE-2025-6389 is a critical (CVSS 9.8) unauthenticated remote code execution flaw in the Sneeit Framework plugin for WordPress, affecting every version up to and including 8.3. The sneeit_articles_pagination_callback() function takes input supplied by the request and passes it directly to PHP's call_user_func(), so an unauthenticated attacker can send crafted input that causes the server to invoke attacker-chosen PHP functions. Successful exploitation yields arbitrary code execution on the server, which attackers can use to inject backdoors, create new administrative WordPress accounts, or take full control of the site and potentially the underlying host. Any WordPress site running the Sneeit Framework plugin at version 8.3 or earlier is affected. The flaw is not in CISA's KEV and no public proof-of-concept is known, but EPSS puts its exploitation probability in the next 30 days at 76.1% (100th percentile), and security reporting indicates it is already being exploited in the wild.

Do: Update Sneeit Framework to the latest patched release (any version newer than 8.3); if updating is not immediately possible, deactivate or remove the plugin, or apply a WAF/virtual-patching rule that blocks the vulnerable pagination callback endpoint. Because the flaw is already exploited in the wild, sites that ran version 8.3 or earlier should audit wp_users for rogue administrator accounts, look for injected backdoors (unexpected PHP files, modified core/theme files, suspicious scheduled tasks), and review web access logs for exploitation attempts. Monitor the vendor and Wordfence advisories for the fixed version number and any indicators of compromise.

The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the store_javascript_cache.php file in all versions up to, and including, 2.2.42. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_new_customer' route in all versions up to, and including, 1.0.6. The plugin’s image‐upload handler calls move_uploaded_file() on client‐supplied files without restricting allowed extensions or MIME types, nor sanitizing the filename. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVE-2026-0740 is a critical (CVSS 9.8) unauthenticated arbitrary file upload vulnerability in the Ninja Forms - File Uploads plugin for WordPress, affecting all versions up to and including 3.3.26. It is caused by missing file type validation in the NF_FU_AJAX_Controllers_Uploads::handle_upload function, so anyone can send a crafted request to the plugin's upload AJAX endpoint with no account, no privileges, and no user interaction. Because uploaded file types are not validated, an attacker can plant arbitrary files, such as PHP scripts, on the web server, which may enable remote code execution and full compromise of the site. Any WordPress site running the File Uploads add-on for Ninja Forms at version 3.3.26 or earlier is exposed, especially sites that accept front-end uploads from visitors. The flaw was partially patched in 3.3.25 and fully fixed in 3.3.27; no public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the 62.9% EPSS score (99th percentile) signals a high likelihood of exploitation within 30 days.

Do: Update the Ninja Forms - File Uploads add-on to version 3.3.27 or later, since 3.3.25-3.3.26 contain only a partial fix. Until patched, restrict or disable unauthenticated front-end uploads and block unauthenticated requests to the plugin's upload AJAX endpoint via WAF rules. Audit the uploads directories for unexpected PHP files or webshells, as arbitrary uploads may have enabled code execution.

Migration, Backup, Staging - WPvivid Backup & Migration, a WordPress backup and migration plugin, is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to and including 0.9.123. The flaw combines two errors in the plugin's encrypted transfer feature: when RSA decryption of a session key fails via openssl_private_decrypt(), the plugin continues anyway, and the phpseclib AES library treats the returned boolean 'false' as a key made of null bytes, letting attackers forge properly encrypted payloads with a predictable key. Because filenames taken from the decrypted payload are never sanitized, directory traversal lets an attacker write PHP files outside the protected backup directory into publicly accessible folders, all triggered by an unauthenticated request containing the wpvivid_action=send_to_site parameter. Any WordPress site running the plugin at version 0.9.123 or earlier is affected, with no authentication or user interaction required, consistent with the maximum-range 9.8 CVSS score. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the EPSS score of 32.7% (98th percentile) implies roughly a one-in-three chance of exploitation within 30 days.

Do: Upgrade WPvivid Backup & Migration to a release newer than 0.9.123 on every site where it is installed as soon as a patched version is available. Until patched, block or restrict unauthenticated requests containing wpvivid_action=send_to_site (e.g., via WAF rules) and check web-accessible directories for unexpectedly created PHP files. Although no exploitation is confirmed yet, the high EPSS score (~33% within 30 days) warrants urgent patching.

The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448

CVE-2026-29014 is an unauthenticated PHP code injection flaw (CWE-94) in MetInfo CMS, caused by insufficient neutralization of user-supplied input in an execution path that evaluates PHP. A remote attacker needs no privileges or user interaction and triggers the flaw simply by sending crafted requests containing malicious PHP, which the server then executes. Successful exploitation results in full remote code execution, giving the attacker complete control over the affected web server and everything it hosts. All MetInfo CMS 7.9, 8.0, and 8.1 deployments are affected, with risk concentrated in internet-facing installations. Exploitation has been reported in the wild, public PoCs are available, and the 39.5% EPSS score (99th percentile) signals high near-term exploitation risk, though the flaw is not yet listed in CISA KEV.

Do: Upgrade MetInfo CMS to the latest patched release; the advisory flags 7.9, 8.0, and 8.1 as affected, so confirm the exact fixed version in the vendor's advisory before upgrading, and prioritize internet-facing instances. Until patched, restrict or WAF-filter HTTP access to MetInfo endpoints and review access logs for crafted requests containing injected PHP syntax. Use the public PoC write-ups (Karmain Security KIS-2026-06 and WebSec) to identify the vulnerable request pattern when hunting for signs of compromise.

The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials.

A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php of the component MarkItUp Preview AJAX Endpoint. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 109.2 will fix this issue. This patch is called 08937a3c5d672a242d68f53e9fccf8a748820ef3. You should upgrade the affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.

CVE-2026-3844 is a critical (CVSS 9.8) arbitrary file upload vulnerability in the Breeze Cache plugin for WordPress, caused by missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to and including 2.4.4. An unauthenticated attacker can trigger the function over the network and upload arbitrary files to the affected site's server, but the flaw is only exploitable when the 'Host Files Locally - Gravatars' option is enabled, which is disabled by default. Uploaded files can include executable PHP such as web shells, so successful exploitation may make remote code execution and full site or server compromise possible. Any WordPress site running Breeze Cache 2.4.4 or earlier with local Gravatar hosting switched on is affected, and press coverage reports more than 400,000 sites at risk. Headlines indicate attackers are already exploiting the flaw in the wild; no public proof-of-concept is known, the EPSS score of 27.7% (98th percentile) signals high near-term exploitation risk, and the CVE is not yet in CISA's KEV.

Do: Sites running Breeze Cache should update to the latest patched release (any version after 2.4.4); if updating is not immediately possible, disable the 'Host Files Locally - Gravatars' setting to close the attack path. Administrators should also audit uploaded files and the webroot for unexpected PHP files or web shells and check site integrity for signs of compromise, given reports of active exploitation and related WordPress backdoor campaigns.

CVE-2026-48907 is an improper access control flaw (CWE-284) in the Joomla Content Editor (JCE) extension from Widget Factory Limited that allows unauthenticated users to create new editor profiles. Because these profiles can confer file-upload privileges, an attacker can reach the editor's upload functionality without logging in, upload malicious PHP files, and have the web server execute them, resulting in unauthenticated remote code execution with high impact on system confidentiality, integrity, and availability (CVSS 4.0 score of 10). Any Joomla site running the affected JCE extension is exposed, with internet-facing sites most at risk. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-16, confirming in-the-wild exploitation, and EPSS assigns a 78.1% probability of exploitation within 30 days (100th percentile). No public proof-of-concept is known, but CISA and Australian authorities have warned of active CMS exploitation targeting this flaw.

Do: Apply the latest JCE update per Widget Factory Limited's vendor instructions, in line with CISA BOD 26-04 requirements (federal agencies must patch or discontinue use of the product if mitigations are unavailable). Until patched, verify whether unauthenticated users can create editor profiles in your JCE configuration, restrict access to the extension, and inspect webroots and logs for unexpected PHP file uploads. Given confirmed active exploitation and a very high EPSS score, prioritize internet-facing Joomla sites immediately.