Australia Alerts Organizations to Ongoing CMS Exploitation Attacks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-36847 | Unauthenticated Remote Code Execution in Simple File List WordPress Plugin | 9.8 | 44% | PoC ×2 | |
| CVE-2024-9234 | The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a… | 9.8 | 10% | ||
| CVE-2025-12057 | The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing… | 9.8 | <1% | ||
| CVE-2025-12352 | The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all… | 9.8 | 1% | ||
| CVE-2025-13486 | Unauthenticated RCE in WordPress Advanced Custom Fields: Extended Plugin | 9.8 | 68% | ||
| CVE-2025-32432 | Code Injection Enables Remote Code Execution in Craft CMS | 10.0 | 100% | KEVPoC ×3 | KEV |
| CVE-2025-34085 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36847 | — | — | ||
| CVE-2025-6389 | Unauthenticated Remote Code Execution in Sneeit Framework WordPress Plugin | 9.8 | 76% | ||
| CVE-2025-7443 | The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to… | 8.1 | <1% | ||
| CVE-2025-7852 | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via… | 9.8 | 2% | ||
| CVE-2026-0740 | Unauthenticated Arbitrary File Upload RCE in Ninja Forms File Uploads WordPress Plugin | 9.8 | 63% | ||
| CVE-2026-1357 | Unauthenticated RCE in WPvivid Backup & Migration WordPress Plugin | 9.8 | 33% | ||
| CVE-2026-1969 | The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload… | 5.3 | <1% | ||
| CVE-2026-29014 | Unauthenticated PHP Code Injection RCE in MetInfo CMS | 9.3 | 39% | PoC ×2 | |
| CVE-2026-31843 | The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated… | 10.0 | 1% | ||
| CVE-2026-3395 | A flaw has been found in MaxSite CMS up to 109.1 | 5.5 | 4% | ||
| CVE-2026-3844 | Unauthenticated Arbitrary File Upload in Breeze Cache WordPress Plugin | 9.8 | 28% | ||
| CVE-2026-48907 | Unauthenticated PHP Code Upload and Execution in Joomla Content Editor (JCE) | 10.0 | 85% | KEVPoC ×3 | KEV |
From the original article
3 min read at securityaffairs.com
Australia warns of a global campaign exploiting CMS flaws to deploy webshells on WordPress, Joomla, and other websites. Australia’s Signals Directorate has issued an alert about a large-scale exploitation campaign actively targeting content management systems (CMS) worldwide, with many small and medium-sized Australian businesses already hit.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.