Hackers Exploit WordPress Flaws to Steal 18,566 Government Records and Plaintext Passwords
Chinese-speaking actor exploited WordPress flaws affecting 49 orgs, stealing 18,566 government records including plaintext passwords.
A suspected Chinese-speaking threat actor has exploited WordPress vulnerabilities to compromise at least 49 organizations across 29 countries, stealing 18,566 records from a western government including accounts, plaintext passwords, and personally identifiable information. The attackers used the wp2shell exploit chain (CVE-2026-63030 and CVE-2026-60137) to deploy webshells, create hidden admin accounts, and move laterally to internal systems. The campaign also targeted ZyXEL GS1900 switches, with 996 devices compromised or having sensitive information exfiltrated across 48 countries.
- Chinese-speaking threat actor exploited WordPress vulnerabilities affecting 49 organizations in 29 countries.
- Attackers used wp2shell exploit chain (CVE-2026-63030, CVE-2026-60137) to deploy webshells.
- One government victim had 18,566 records stolen including plaintext passwords and PII.
- Campaign also targeted ZyXEL switches with 996 devices compromised in 48 countries.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-63030+1 related CVE | WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE | 9.8 group max | 11% | KEVPoC ×9 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.225.153.141 | re IP address 74.48.66.73 Staging infrastructure IP address 104.225.153.141 Command-and-control infrastructure IP address 172.245.247.2 |
| ipv4 | 172.245.247.21 | 4.225.153.141 Command-and-control infrastructure IP address 172.245.247.21 Exploitation infrastructure Account name kapibala2 Account |
| ipv4 | 74.48.66.73 | *.981666.xyz Command-and-control infrastructure IP address 74.48.66.73 Staging infrastructure IP address 104.225.153.141 Command-a |
| sha256 | 0e81d80b40eaacbf6cb1e817fb1824c30a824af5cb4faca4aa9b03fd506d480f | compromise (IoCs):- Type Indicator Description SHA-256 hash 0e81d80b40eaacbf6cb1e817fb1824c30a824af5cb4faca4aa9b03fd506d480f Backdoor SHA-256 hash 0f6e757e82c4d91df5bd249f775b9970b59de |
| sha256 | 0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6 | 824c30a824af5cb4faca4aa9b03fd506d480f Backdoor SHA-256 hash 0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6 Backdoor SHA-256 hash 2ff2945b13a4cd0e9a65c85af29ea1539e162 |
| sha256 | 2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1 | b9970b59dee42cc0dfe40f879d77fc16821c6 Backdoor SHA-256 hash 2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1 Backdoor Domain *.981666.xyz Command-and-control infrastruc |
From the original article
4 min read at cybersecuritynews.com
A suspected Chinese-speaking threat actor has used WordPress vulnerabilities to break into at least 49 organizations across 29 countries. The campaign exposed how a compromised website can become a launchpad for database theft, credential abuse, and wider network intrusion. The attackers exploited the wp2shell chain, tracked as CVE-2026-63030 and CVE-2026-60137, against vulnerable WordPress installations.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.