Hackers Exploit WordPress Flaws to Steal 18,566 Government Records and Plaintext Passwords

A suspected Chinese-speaking threat actor has used WordPress vulnerabilities to break into at least 49 organizations across 29 countries.

The campaign exposed how a compromised website can become a launchpad for database theft, credential abuse, and wider network intrusion.

The attackers exploited the wp2shell chain, tracked as CVE-2026-63030 and CVE-2026-60137, against vulnerable WordPress installations.

After gaining access, they planted a webshell, created a hidden administrator account, searched readable files for credentials, and moved toward internal systems.

GreyNoise identified the activity while monitoring attacker infrastructure and decoy systems. GreyNoise said in a report shared with Cyber Security News (CSN) that one western government suffered the most serious intrusion, with 18,566 records downloaded from a backend SQL database.

The stolen material included accounts, plaintext passwords, and personally identifiable information linked to law enforcement and government agencies.

GreyNoise also observed the same actor targeting other technologies, including ZyXEL GS1900 switches, where 996 devices in 48 countries were compromised or had sensitive information exfiltrated.

Hackers Exploit WordPress Flaws

The WordPress intrusion began on July 22, 2026, when the actor used the exploit chain to deploy a custom webshell.

The attackers then dumped the WordPress user table, stealing 13 administrator accounts, and added an account designed to resemble a legitimate address in the victim’s domain.

A custom plugin helped enumerate the installation, while the webshell supported reconnaissance and command execution.

The attackers checked security tools, services, listening ports, database configuration files, and local accounts before attempting to weaken defenses and escalate privileges.

The campaign then moved from the website to the environment. A custom credential-search tool found usable database access details in readable files, allowing the attackers to conduct password spraying and reach an internal SQL server.

GreyNoise said the actor staged stolen files in a ZIP archive before downloading them, then used tools to extract sensitive SQL data. The operation ended with the theft of 18,566 records, followed by further password-spraying attempts that continued for several hours.

The incident reflects a broader risk highlighted by recent WordPress vulnerability disclosures, where attackers can turn weaknesses in a site or plugin into server-level access.

Administrators should also review recent wp2shell exploit attempts to understand how quickly exposed systems can attract automated attacks.

Attack Chain and Mitigation

The actor’s activity did not stop at WordPress. GreyNoise linked the campaign to scans and exploitation of network appliances, developer platforms, Linux systems, and business applications, suggesting a broad search for exposed services rather than a single-victim operation.

The pattern mirrors the danger described in CISA WordPress core warning, where an actively exploited flaw can provide a route from public website exposure to deeper compromise.

Organizations should patch WordPress core, themes, and plugins, remove unknown administrator accounts, rotate passwords and database secrets, and invalidate active sessions.

They should also inspect web directories for unexpected PHP files, review process and authentication logs, and isolate affected servers before restoring them from trusted backups.

Because plaintext credentials were exposed, password reuse must be treated as an urgent concern across connected services. Teams can also compare their patching process with recent WordPress security updates, which underline the value of applying fixes before scanning begins.

Defenders should enable multifactor authentication where possible, restrict database access from web servers, monitor unusual administrator creation, and alert on password spraying and unexpected archive downloads.

These controls can limit an attacker’s ability to turn a website compromise into broader internal access. The findings also show why internet-facing systems need continuous monitoring.

Blocking one address may not stop the actor, but identifying repeated scanning patterns, suspicious webshell requests, and access to configuration files can help defenders detect the intrusion earlier.

The source report does not name the affected government organization and withholds some infrastructure details because of victim sensitivity and operational risk.

It also notes that the actor’s rapidly changing code may have been produced with help from a large language model, although GreyNoise found no specific AI tool in use.

The case shows that a web application compromise can rapidly become a serious enterprise-wide data security incident affecting organizations.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC