Critical WordPress Flaws Let Attackers Steal Government Records, Plaintext Passwords

Key Takeaways

• A suspected Chinese-speaking threat actor exploited WordPress vulnerabilities to breach 49 organizations across 29 countries.
• The attack chain, dubbed “wp2shell” (CVE-2026-63030 and CVE-2026-60137), allowed attackers to steal over 18,500 government records, including plaintext passwords.
• The breaches led to the exfiltration of sensitive data, including PII and credentials, from government and law enforcement agencies.
• The threat actor also targeted other systems like ZyXEL switches, highlighting a broader campaign beyond WordPress.
• Organizations must prioritize patching, implement strong authentication, and monitor for suspicious activity to mitigate similar attacks.

Sophisticated WordPress Attacks Lead to Government Data Theft

A threat actor, believed to be operating from China, has successfully compromised at least 49 organizations spanning 29 countries by exploiting critical vulnerabilities in WordPress installations. This campaign demonstrates how a seemingly isolated website compromise can escalate into extensive data theft, credential abuse, and deeper network intrusions.

The attackers leveraged a sophisticated exploit chain, referred to as wp2shell and tracked as CVE-2026-63030 and CVE-2026-60137. Once initial access was established on vulnerable WordPress sites, the operatives deployed a webshell, established a stealthy administrator account, and systematically searched for credentials within accessible files, preparing for lateral movement into internal systems.

GreyNoise, a cybersecurity firm, uncovered this malicious activity while monitoring attacker infrastructure and decoy systems. According to a GreyNoise report, one Western government agency experienced a particularly severe intrusion, resulting in the exfiltration of 18,566 records from a backend SQL database. These stolen records encompassed accounts, plaintext passwords, and personally identifiable information (PII) pertinent to law enforcement and government entities.

Beyond WordPress, GreyNoise observed the same actor targeting other technologies, including ZyXEL GS1900 switches. This broader targeting led to the compromise or data exfiltration from 996 devices across 48 countries.

Anatomy of the WordPress Exploitation

The WordPress intrusion campaign commenced on July 22, 2026. The attackers initiated the breach by exploiting the wp2shell chain to deploy a custom webshell. Following this, they proceeded to dump the WordPress user table, illicitly obtaining 13 administrator accounts. To maintain persistence and blend in, a new administrator account was created, meticulously crafted to mimic a legitimate address within the victim’s domain.

The attackers employed a custom plugin for enumerating the WordPress installation, while the webshell facilitated reconnaissance and command execution. Their methodical approach involved scrutinizing security tools, services, listening ports, database configuration files, and local user accounts. This pre-attack intelligence gathering aimed to identify weaknesses, disable defenses, and escalate privileges.

The operation then transitioned from the compromised website to the broader network environment. A specialized credential-searching tool was utilized to discover database access details within readable files, enabling the attackers to perform password spraying attacks and subsequently gain access to an internal SQL server. GreyNoise researchers noted that the threat actor compressed the stolen files into a ZIP archive before exfiltration and then used further tools to extract sensitive SQL data. The incident culminated in the theft of 18,566 records, followed by sustained password-spraying attempts over several hours.

This incident underscores a critical risk frequently highlighted by recent WordPress vulnerability disclosures: weaknesses in a website or its plugins can be leveraged to gain server-level access. Security administrators are urged to examine recent wp2shell exploit attempts to understand the rapid pace at which exposed systems can fall victim to automated attacks.

Attack Chain and Mitigation

The threat actor’s malicious activities extended beyond WordPress. GreyNoise connected the campaign to widespread scanning and exploitation efforts targeting various network appliances, developer platforms, Linux systems, and business applications. This suggests a broad, opportunistic search for exposed services rather than a focused attack on a single victim.

This pattern aligns with warnings from organizations like CISA regarding WordPress core vulnerabilities, where an actively exploited flaw can serve as a direct pathway from public web exposure to deeper enterprise compromise. The incident starkly illustrates how a web application compromise can rapidly evolve into a severe, enterprise-wide data security event.

The GreyNoise report indicates that the actor’s rapidly evolving code might have been generated with the assistance of a large language model, although no specific AI tool was definitively identified in use. For further technical details and indicators of compromise, refer to the full report: Hackers Exploit WordPress Flaws to Steal 18566 Government Records and Plaintext Passwords.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Patch Immediately: Ensure all WordPress core files, themes, and plugins are updated to their latest versions to address known vulnerabilities like CVE-2026-63030 and CVE-2026-60137.
• Review User Accounts: Scrutinize all administrator accounts for any unauthorized or suspicious entries and remove them promptly.
• Rotate Credentials: Change all WordPress and database passwords and secrets. Invalidate active user sessions to force re-authentication.
• Inspect Web Directories: Regularly check web server directories for any unexpected or unknown PHP files, which could indicate webshells.
• Monitor Logs: Review process and authentication logs frequently for unusual activity, especially concerning new account creation, privilege escalation attempts, or suspicious login patterns.
• Isolate and Restore: In the event of a compromise, immediately isolate affected servers and restore them from verified, trusted backups.
• Address Password Reuse: Given the theft of plaintext credentials, enforce strict password policies and consider the immediate rotation of passwords across all connected services if reuse is suspected.
• Implement Multi-Factor Authentication (MFA): Enable MFA wherever possible, particularly for administrator accounts, to add an essential layer of security.
• Restrict Database Access: Limit database access from web servers to the absolute minimum necessary, following the principle of least privilege.
• Continuous Monitoring: Implement continuous monitoring for internet-facing systems to detect repeated scanning patterns, suspicious webshell requests, and unauthorized access to configuration files, enabling earlier detection and response.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.