A Chinese-speaking hacking group has exploited serious vulnerabilities in WordPress sites to breach at least 49 institutions across 29 countries, stealing 18,566 government records including plaintext passwords and other sensitive data. The attack used an exploit known as wp2shell, which refers to two tracked vulnerabilities: CVE-2026-63030 and CVE-2026-60137. By infiltrating public websites, the attackers were able to use them as springboards for more extensive internal compromise.
Attack Path
The intrusion campaign began around July 22, 2026, when the attackers deployed a custom webshell on vulnerable WordPress servers through the wp2shell vulnerability chain. With that foothold, they dumped user tables—gaining access to 13 administrator accounts—and added a fake admin account masquerading as part of the victim’s domain infrastructure. A plugin helped enumerate the installation, while the webshell enabled reconnaissance, command execution, and escalation.
From there, they searched readable files for credentials, executed password-spraying attacks, accessed internal SQL servers, and staged sensitive files into ZIP archives for exfiltration. One western government agency was hit hardest: 18,566 records, including accounts, plaintext passwords, personal identifiable information from law enforcement and government sectors, were exfiltrated.
Broader Scope & Other Affected Technologies
This wasn’t restricted to WordPress. The threat actor also probed network appliances like ZyXEL GS1900 switches—compromising or extracting data from 996 devices across 48 countries. The attack style suggests automated scanning of exposed services, with the goal of grabbing any vulnerable surface.
Recommended Defenses
To counter the risk, organizations are urged to patch WordPress core, themes, and plugins immediately. Infected or unknown administrator accounts should be removed, passwords and database secrets rotated, and active sessions terminated. Look for unexpected PHP files in web directories, monitor authentication logs, restrict database access from web servers, and enable multifactor authentication wherever possible.
Furthermore, it’s critical to establish alerts for anomalous activity—such as unusual admin account creation, password spraying, or large archive downloads—and treat password reuse as a serious security issue. Isolate affected systems, restore from clean backups, and compare internal patching practices against recent WordPress security updates.
The threat actor’s infrastructure also included indicators of compromise (IoCs) like specific SHA-256 backdoor file hashes, domain names, IP addresses, and newly created accounts linked to the attack. Even though some details are being withheld due to operational risk and sensitivity of victims, the scale and speed of the exploit are clear.
While there is speculation that parts of the actor’s code may have been assisted by large language models, analysts found no direct evidence of AI tools in use. However, it underscores how quickly exploitation tools are evolving.
As sites go unpatched and new vulnerabilities are disclosed, the window for attack remains open. This incident confirms that a compromised website isn’t just about exposed information—it can be the entry point for an organization-wide breach. Be alert, be prepared.
