A large-scale, globally active exploitation campaign is targeting multiple vulnerabilities across various content management systems (CMS) and their plugins. Threat actors are conducting mass scanning operations to identify vulnerable, internet-facing CMS installations and deploy webshells for persistent remote access. The campaign is notable for its scale — Five Eyes cyber agencies have flagged that AI-enabled tooling is compressing the window between vulnerability disclosure and active exploitation, meaning patch cycles now have far less margin than before.

The campaign exploits 17 distinct CVEs across CMS platforms and plugins, predominantly WordPress-based: Simple File List (WordPress) - CVE-2020-36847
WavePlayer (WordPress) - CVE-2025-12057
BerqWP (WordPress - CVE-2025-7443
WPBookit (WordPress) - CVE-2025-7852
Ninja Forms (WordPress) - CVE-2026-0740
ThemeREX Addons (WordPress) - CVE-2026-1969
Breeze Cache (WordPress) - CVE-2026-3844
pay-uz (WordPress) - CVE-2026-31843
ACF Extended (WordPress) - CVE-2025-13486
Sneeit Framework - CVE-2025-6389
WPvivid Backup (WordPress) - CVE-2026-1357
Gravity Forms (WordPress) - CVE-2025-12352
GutenKit/Hunk Companion - Likely CVE-2024-9234
Craft CMS - CVE-2025-32432
MaxSite CMS - CVE-2026-3395
MetInfo CMS - CVE-2026-29014
Joomla JCE - CVE-2026-48907

How it's exploited:

The vulnerability classes involved primarily fall into four categories:

• Unauthenticated file upload – allows direct placement of malicious files (webshells) into web-accessible directories without any authentication.
• Remote code execution (RCE) – allows arbitrary command execution on the underlying server.
• Server-side request forgery (SSRF) – allows the attacker to make the server issue requests on their behalf, often to reach internal resources.
• Deserialisation flaws – allow crafted serialized objects to trigger unintended code execution when processed by the application.

Attack sequence:

• Mass scanning identifies internet-facing CMS instances running vulnerable software/plugin versions.
• The specific vulnerability class (upload, RCE, SSRF, or deserialisation) is exploited to plant a webshell in the web directory or plugin directory.
• The webshell provides persistent command execution, which attackers use to:
  • Deface or disrupt the website
  • Harvest credentials or data submitted by site users
  • Stage further malware to compromise site visitors
  • Move laterally into the broader network from the compromised web server

CERTVU recommends the following:

Detection / Immediate response:

• Inspect the CMS web directory (and plugin directories, if a vulnerable plugin is confirmed) for abnormal or unexpected files.
• Review web access logs for GET/POST requests to known webshell paths.
• Treat any server with an identified webshell as compromised — isolate it and audit authentication/network logs for malicious activity.
• Trace back through logs to identify the initial exploitation request.
• Check edge firewall/network logs for communication with any known malicious IPs associated with the webshells.
• Look for evidence of persistence, lateral movement, new account creation, exfiltration, or additional malware deployment.
• Patch the vulnerable component, remove/quarantine webshells and persistence mechanisms, then verify clean before returning the host to production.
• If compromise is confirmed, restore from a known-good backup