What happened
The Australian Cyber Security Centre (ACSC) — the federal government's cyber defence agency — issued a critical alert about a large-scale, ongoing campaign targeting websites built on content management systems: WordPress most prominently, along with Joomla, Craft CMS and others. The ACSC says the campaign is global, is active in Australia, and that many small- to medium-sized Australian businesses have already been impacted.
The attackers aren't picking targets. They run automated scanners across the internet looking for websites running old, vulnerable versions of common plugins — the small add-ons that power contact forms, bookings, media players and backups. When a scanner finds one, it exploits the flaw to plant a webshell: a small hidden file that gives the attacker ongoing remote control of the website, as if they were sitting at the keyboard.
Two details make this alert worth your attention. First, according to the ACSC, nearly all of the security flaws being exploited already have fixes available — sites are being compromised through problems their software vendors solved, sometimes years ago. Second, this is the ACSC's second CMS alert in two months — this is a persistent pattern, not a one-off event.
Why it matters to your business
It's tempting to assume a small website has nothing worth stealing. That's not how this campaign works. According to the ACSC, once attackers control a site they use it to deface pages, steal credentials, host malware and phishing pages aimed at your visitors, and pivot into anything else connected to it. Your website becomes their infrastructure.
There's also evidence this is an organised business, not lone vandals. In July, security researchers reported finding an exposed attacker server behind part of this activity — a campaign dubbed "WP-SHELLSTORM" — operating as an access-brokerage operation: compromised websites were catalogued, packaged and resold to other criminals. Those figures come from researcher and media reporting rather than the ACSC, but the shape of it is instructive: a hacked small-business site isn't a one-off incident — it's inventory.
For you as an owner, the practical consequences are concrete: Google can flag your site as dangerous (most visitors never click past that red warning screen), customers can be phished from a domain they trust — yours — and if personal information your business holds is accessed, you may have obligations under the Privacy Act's notifiable data breach scheme. Whether those obligations apply to your business is a legal question worth having a professional confirm — we won't rule on it here.
Is your site affected?
The ACSC's alert names the software being actively exploited. Most entries are WordPress plugins — several of them household names in the WordPress world:
The ACSC notes this list is not exhaustive — the same campaign exploits other components too. The full list is in the alert itself.
If your site is on Shopify, Wix or Squarespace: breathe out. Those are hosted platforms — the company runs and patches the underlying software for you, so this campaign largely isn't aimed at you. It's still good practice to review any third-party apps you've added, but the urgent checks below are for owners of self-managed sites.
If your site is on WordPress, Joomla or another self-managed CMS — and WordPress alone runs around 40% of the world's websites — the following checks are worth doing this week.
What to do this week
Find out what your website actually runs
What
Many owners genuinely don't know whether their site is WordPress, or what plugins are installed — especially if a developer built it years ago. If you can log in at yoursite.com.au/wp-admin, you're on WordPress. If someone else manages the site, this is a one-line email: "Can you confirm what CMS and plugins our site runs, and that everything is up to date?"
Why it matters
You can't secure what you don't know you have. Abandoned sites with a forgotten plugin are exactly what this campaign's scanners are built to find.
Update everything — core, plugins and themes
What
Log in to your site's admin area and apply every pending update: the CMS itself, every plugin, every theme. In WordPress this is the Dashboard → Updates screen. Take a backup first if you have the option.
Why it matters
The ACSC says nearly all the flaws in this campaign already have patches. Updating is the single most effective thing you can do, and for most sites it takes under half an hour.
How to go further
Turn on automatic updates for plugins where your setup allows it, so this isn't a chore you have to remember.
Delete what you don't use
What
Go through your plugin list and delete — not just deactivate — anything your site no longer needs. Old page builders, abandoned form plugins, that slider from a design three redesigns ago.
Why it matters
Every installed plugin is a door. Deactivated plugin code can still sit on your server, and unused plugins are the least likely to ever get updated. Fewer plugins means fewer ways in.
Check for abandoned plugins
What
For each plugin you keep, check when it was last updated by its developer (the WordPress plugin directory shows this on each plugin's page). If a plugin hasn't been updated in over a year, treat it as a candidate for replacement.
Why it matters
A plugin nobody maintains will never receive a security fix — a flaw found in it stays open forever. Several plugins named in this campaign were exploited through flaws in older, unmaintained versions.
Put a date in the calendar
What
A recurring monthly reminder: log in, run updates, glance at the plugin list. Fifteen minutes.
Why it matters
This is the ACSC's second CMS alert in two months. The campaign will change names; the defence won't. Sites that are patched promptly simply aren't what these scanners are looking for.
Signs your site may already be compromised
The ACSC notes many Australian businesses have already been affected — so it's worth a look backwards as well as forwards. None of these signs is proof on its own, but each deserves investigation:
- Admin users you don't recognise in your CMS user list.
- Pages or files you didn't create — including spam pages showing up in Google searches for your own business name.
- Visitors being redirected to sites you've never heard of, or a browser warning appearing before your site loads.
- Google flagging your site as deceptive or dangerous, or your emails suddenly landing in spam.
If you suspect a compromise, updating is not enough. Once a webshell is planted, patching the plugin closes the door the attacker came through — but they're already inside. That's the point to bring in your hosting provider or a professional for a proper cleanup, and to report the incident to the government via ReportCyber, which also gives you access to their guidance and support.
Where a scan fits in
One of the checks AegorIQ runs on every tier — including the free Scorecard — is exactly the surface this campaign exploits: WordPress core, plugins and themes checked against a live vulnerability feed, alongside whether Google has blacklisted the site. We check what's publicly visible; we don't log in, and a scan is not a substitute for the updates above. What it gives you is an independent answer to the question this alert raises: is my site currently showing the internet something out of date? — with every check we run published here.
Sources
- ACSC — Large-scale exploitation campaign targeting website content management systems (CMS), alert, 9 July 2026
- iTnews — Second alert from ACSC in two months shows unpatched CMS bugs still exploited, July 2026
- BleepingComputer — Australia warns of global campaign targeting vulnerable CMS platforms, July 2026
- The Hacker News — Exposed hacker server reveals WP-SHELLSTORM campaign, 10 July 2026 (researcher/media reporting; figures not independently verified)
- ACSC — ReportCyber incident reporting portal