Attackers are mass-scanning WordPress and Joomla sites to plant webshells

Attackers are mass-scanning WordPress and Joomla sites to plant webshells — here's what it means for you

A global campaign is mass-scanning WordPress, Joomla, and other CMS sites and planting webshells through vulnerable plugins and extensions. Australia's cyber agency warned about it on July 9, and CISA has flagged fresh Joomla flaws being exploited. If you run a CMS site, the move is to update your plugins now and check what of yours is exposed.

By Paul Rudenko, Security ResearcherJul 13, 20266 min read

What’s actually happening?

Attackers are sweeping the internet for content-management-system sites running known-vulnerable add-ons, then using those flaws to upload a webshell — a small script that hands them remote control of the server.

On July 9, 2026, the Australian Cyber Security Centre (ACSC) issued an alert describing this as a large-scale global campaign, and noted that many small and medium businesses are among those hit (ACSC / cyber.gov.au).

It isn’t one product. The alert names WordPress plugins, Joomla, Craft CMS, MaxSite CMS, and MetInfo — with the common thread being flaws that allow unauthenticated file upload, remote code execution, or similar.

The pressure is current. On July 10, 2026, CISA added two Joomla extension flaws — iCagenda (CVE-2026-48939) and Balbooa Forms (CVE-2026-56291), both rated CVSS 10.0 — to its Known Exploited Vulnerabilities catalog, with a federal patch deadline of July 13 (CISA alert).

Why is this different from the usual “patch now” story?

Most vulnerability coverage is about one bug in one product. This is about a method being run at scale against everyone at once.

The attackers don’t care which plugin lets them in. They’re scanning broadly and taking whatever’s reachable and out of date — a forgotten form plugin, an old page builder, a calendar extension nobody’s touched in a year.

The ACSC also noted the campaign may be AI-assisted, which mainly means one thing for you: the gap between a flaw becoming public and it being exploited at scale is getting shorter. “I’ll patch it next month” is a weaker plan than it used to be.

So the useful question isn’t “am I affected by CVE-2026-48939?” It’s “do I actually know every plugin and extension my site runs, and is any of it out of date and facing the internet?”

For the site owner (plain English)

If your site runs on WordPress, Joomla, or another CMS, this is worth an hour of your attention this week. Here’s the order that matters:

Update everything — core, plugins, themes, extensions. Most of the flaws being exploited already have fixes. Applying available updates closes the doors this campaign walks through.
Delete what you don’t use. Every deactivated-but-installed plugin is still code on your server. If you’re not using it, remove it — that’s less surface for a scanner to find.
Ask who’s actually watching the site. Many small-business sites were built once by an agency and left running. If nobody owns updates, that’s the finding.

There’s a step underneath all of this: knowing what you’ve got exposed in the first place. You can’t update or retire a plugin you’ve forgotten is there, on a site you’ve forgotten is live.

That’s what an external attack-surface scan is for. MySecScan looks at your domain from the outside — the way an attacker’s scanner does — and shows you what’s reachable: login pages, admin panels, upload endpoints, sites you didn’t remember you still run. It won’t tell you “you have CVE-2026-48939” — no honest external scan can — but it shows you where to point your update-and-retire effort first.

How do developers and IT respond?

Patch the named software. Update Joomla extensions (iCagenda, Balbooa Forms, JCE, SP Page Builder to 6.6.2+) and the WordPress plugins listed in the ACSC advisory. Confirm versions post-update.
Hunt for webshells, don’t just patch. Because this is already being exploited, assume upload paths may have been used. Check web-writable upload directories for non-media files — for Balbooa Forms, the advisory points at images/baforms/uploads — and scan the web root for unexpected .php files and recently modified files.
Lock down upload paths. Ensure upload directories can’t execute PHP, enforce auth and file-type validation on upload endpoints, and put a WAF in front if you don’t have one.
Shrink the surface. Remove unused extensions, restrict admin panels by IP or VPN, and least-privilege the accounts that can install plugins.
References: the ACSC advisory and the CISA KEV catalog.

What’s the real lesson here?

This is the same pattern we keep seeing, just industrialized: an internet-facing app, an add-on with a known flaw, a patch that shipped but never got installed, and an automated crew that scaled up the gap. Last month it was the SP Page Builder and Kirki plugin flaws. This month it’s a whole campaign.

The common thread is never the specific CVE. It’s the forgotten thing facing the internet. Patch cadence matters, but knowing your external footprint — and shrinking it — is what actually breaks the pattern.

Frequently asked questions

Is my WordPress or Joomla site caught up in this campaign?

There's no way to know from the headlines alone, because the campaign is opportunistic — it targets whatever's reachable and out of date, not a specific list of victims. The practical answer is to treat any internet-facing CMS site as in scope and check it. Start with the basics: is your CMS core current, are all plugins and extensions updated, and are there any you installed once and forgot? The Australian advisory names WordPress, Joomla, Craft, MaxSite, and MetInfo, but the underlying weakness — an outdated add-on that accepts file uploads — isn't unique to those. If you run more than one site, or inherited sites from a previous agency, the risk is usually the one you've lost track of, not the one you check every week.

How do I know if my site already has a webshell?

A webshell is a script an attacker uploads so they can keep controlling your server, so the signs are things that shouldn't be there. Have whoever manages the site look for unexpected files in upload folders — especially files ending in .php sitting where only images or documents should be — and for files changed at times nobody was working. Other red flags: new admin accounts you didn't create, unfamiliar scheduled tasks, or your host warning you about outbound spam or malware. If your site was running a vulnerable, internet-facing plugin during the campaign, it's worth checking properly rather than assuming you're clear. Finding a webshell is a different situation from patching a flaw — if you find one, get incident-response help, because updating the plugin afterward doesn't remove access an attacker already established.

I keep my site updated — am I safe from this?

Keeping things updated is most of the battle, and if you genuinely apply updates promptly you've closed the doors this campaign relies on. The catch is the word "genuinely." Auto-updates sometimes fail silently, staging sites and old subdomains get left behind, and plugins that were deactivated but never deleted are still code on your server. The gaps that get exploited are almost always the ones nobody's looking at — a second site, a forgotten subdomain, a plugin from a project that ended two years ago. So being safe isn't just about your main site being current; it's about knowing the full list of what you have exposed. That's the part an external view helps with: it finds the things you've stopped thinking about, which are exactly the things attackers scan for.

Does MySecScan tell me if I have these specific vulnerabilities?

No — and it's worth being clear about why. MySecScan is an external attack-surface scanner: it looks at your domain from the outside, the way an attacker's tooling does, and reports what's reachable and how it's configured. It does not log into your site or fingerprint plugin versions to declare "you have CVE-2026-48939," because doing that reliably from the outside isn't possible, and guessing would be worse than useless. What it does do is show you your exposure — which sites, login portals, admin panels, and upload points are facing the internet — so you know where to aim your updating and clean-up. In a campaign like this one, that visibility is the useful part: the flaw is fixable with an update, but only once you know the site and the plugin are there in the first place.