Schools dealing with the Large-Scale Exploitation Campaign Targeting Website Content Management Systems (CMS) notice

How bad is it?

The ongoing threat of malicious actors is very real, and the use of AI in cyber attacks is shortening the time between the discovery of vulnerabilities and their use to compromise your website. Most of the vulnerabilities listed by the ASD are classed as critical, meaning they can cause severe damage and should be addressed immediately.

However…

Every WordPress-related vulnerability on the list is for a third-party plugin or framework, not WordPress itself. And a number of them require very specific circumstances for a hacker to exploit your website.

For example, Gravity Forms, a popular form builder, had a vulnerability that could allow a hacker to upload arbitrary files to your website. That’s incredibly dangerous! But your site needed a specific version of an additional “Post Creation” module installed, and a form with a “File upload” field, for this to be a problem.

What’s more, the ASD also lists pay-uz as a WordPress vulnerability, when it’s actually a Laravel package, completely unrelated to WordPress. The ASD have amended the notice, since I contacted them about the error.

For many schools the notice will look overwhelming, but it’s possible you aren’t running any of the targeted software.

The affected software

The original list can be found on the Australian Signals Directorate notice. This version provides the affected versions of the software, the severity score, and links to the CVE Record Information.

Software	Affected versions	Severity	CVE
Simple File List WordPress plugin	< 4.2.3	9.8	CVE-2020-36847
WavePlayer WordPress plugin	< 3.8.0	9.8	CVE-2025-12057
BerqWP WordPress plugin	<= 2.2.42	8.1	CVE-2025-7443
WPBookit WordPress plugin	<= 1.0.6	9.8	CVE-2025-7852
Ninja Forms – File uploads add-on WordPress plugin	<= 3.3.26	9.8	CVE-2026-0740
ThemeREX Addons WordPress plugin	< 2.38.5	9.8	CVE-2026-1969
Breeze Cache WordPress plugin	<= 2.4.4	9.8	CVE-2026-3844
pay-uz Laravel package	<= 2.2.24	10.0	CVE-2026-31843
ACF Extended WordPress plugin	0.9.0.5 – 0.9.1.1	9.8	CVE-2025-13486
Sneeit Framework WordPress framework	<= 8.3	9.8	CVE-2025-6389
WPvivid Backup & Migration WordPress plugin	<= 0.9.123	9.8	CVE-2026-1357
Gravity Forms WordPress plugin	<= 2.9.20	9.8	CVE-2025-12352
GutenKit/Hunk Companion WordPress plugin	<= 2.1.0	9.8	Likely CVE-2024-9234
Craft Content Management System	Various	10.0	CVE-2025-32432
MaxSite Content Management System	<= 109.1	7.3	CVE-2026-3395
MetInfo Content Management System	7.9, 8.0, and 8.1	9.3	CVE-2026-29014
JCE editor Joomla extension	< 2.9.99.5	10.0	CVE-2026-48907

What should you do?

1. Don’t panic.
2. Check whether your website uses any of the software on the list above.
3. Search for your website on Google and make sure the results show your actual school content in the preview. Warning signs of a compromise include spammy text, foreign-language content, or unexpected links to pharmaceutical, gambling, or other unrelated sites.
4. If either of the above is a problem, contact a professional to check your site for signs of compromise. In the meantime, consider taking the site offline temporarily and informing the Department.

What could you have done?

There are a range of WordPress security plugins, software firewalls, and scanners. And there are third-party security products like Cloudflare that can help protect your website. There are also well-documented methods for hardening WordPress and web servers.

But the simplest, non-technical steps are:

1. Keep your software up to date—you can configure WordPress to keep everything updated automatically.
2. Use a complicated, unique password for accessing the website—a password manager makes this much easier.
3. Limit website access, particularly administrator access, to people who need it.
4. Make sure you have regular off-site backups—this makes recovery far easier if something goes wrong.

---