CMS Exploitation Campaign Nuclei Templates

Defensive Nuclei template pack for the large-scale CMS exploitation campaign reported by ASD's Australian Cyber Security Centre on 9 July 2026.

Advisory: https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/large-scale-exploitation-campaign-targeting-website-content-management-systems-cms

Context

This alert is relevant to all Australian website owners and website managers, and is intended for a technical audience.

ASD's ACSC reported a large-scale exploitation campaign targeting vulnerabilities in content management systems globally, including in Australia, with many small to medium sized Australian businesses impacted.

Malicious cyber actors are actively scanning websites for opportunities to deploy webshells by leveraging vulnerabilities in CMS software and plugins. The exploited vulnerability classes primarily allow unauthenticated file upload, remote code execution, server side request forgery or deserialisation.

Once deployed, webshells can allow remote access and control of targeted web servers. Compromised servers may be used for website defacement or disruption, credential and data capture, malware delivery to legitimate website users, or as a pathway for broader network compromise.

Coverage

This repository includes 16 CVE templates and 2 product-only detection templates for the campaign set.

Software / plugin	CVE	Template	Detection type
Simple File List (WordPress)	CVE-2025-34085	CVE-2025-34085.yaml	CVE template
Simple File List (WordPress)	CVE-2020-36847	CVE-2020-36847.yaml	CVE template
WavePlayer (WordPress)	CVE-2025-12057	CVE-2025-12057.yaml	CVE template
BerqWP (WordPress)	CVE-2025-7443	CVE-2025-7443.yaml	CVE template
WPBookit (WordPress)	CVE-2025-7852	CVE-2025-7852.yaml	CVE template
Ninja Forms (WordPress)	CVE-2026-0740	CVE-2026-0740.yaml	CVE template
ThemeREX Addons (WordPress)	CVE-2026-1969	CVE-2026-1969.yaml	CVE template
Breeze Cache (WordPress)	CVE-2026-3844	CVE-2026-3844.yaml	CVE template
pay-uz (WordPress)	CVE-2026-31843	pay-uz-detect.yaml	Product detection only
ACF Extended (WordPress)	CVE-2025-13486	CVE-2025-13486.yaml	CVE template
Sneeit Framework	CVE-2025-6389	CVE-2025-6389.yaml	CVE template
WPvivid Backup (WordPress)	CVE-2026-1357	CVE-2026-1357.yaml	CVE template
Gravity Forms (WordPress)	CVE-2025-12352	CVE-2025-12352.yaml	CVE template
GutenKit/Hunk Companion (WordPress)	Likely CVE-2024-9234	CVE-2024-9234.yaml	CVE template
Craft CMS	CVE-2025-32432	CVE-2025-32432.yaml	CVE template
MaxSite CMS	CVE-2026-3395	maxsite-cms-detect.yaml	Product detection only
MetInfo CMS	CVE-2026-29014	CVE-2026-29014.yaml	CVE template
Joomla JCE	CVE-2026-48907	CVE-2026-48907.yaml	CVE template

pay-uz-detect.yaml and maxsite-cms-detect.yaml confirm product presence only. They do not confirm vulnerable version or exploitability.

Where available, passive Wordfence-derived checks from topscoder/nuclei-wordfence-cve were preferred over active POST checks. Remaining POST-based templates are limited to cases where no passive replacement has been added here.

Clone and run

Install or update Nuclei:

go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
nuclei -update

Clone this repository:

git clone https://github.com/rxerium/cms-exploitation-campaign.git
cd cms-exploitation-campaign

Create a target list with one URL per line:

cat > targets.txt <<'EOF'
https://example.com
https://cms.example.org
EOF

Run all templates:

nuclei -l targets.txt -t . -o cms-campaign-results.txt

Run with conservative rate limits:

nuclei -l targets.txt -t . -rl 5 -c 2 -retries 1 -timeout 10 -o cms-campaign-results.txt

Run a single CVE template:

nuclei -l targets.txt -t CVE-2024-9234.yaml -o CVE-2024-9234-results.txt

Run a product-only detection template:

nuclei -l targets.txt -t pay-uz-detect.yaml -o pay-uz-detect-results.txt

Immediate mitigation guidance

ASD's ACSC recommends website owners confirm whether servers have been impacted and remediate accordingly:

• Inspect CMS web directories and plugin directories for webshells or abnormal internet-facing file changes.
• Examine web access logs for IP addresses making GET or POST requests to webshell paths.
• Treat servers with identified webshells as compromised, isolate them, and audit authentication and network logging.
• Look back for suspicious web requests linked to initial exploitation and webshell deployment.
• Review network logs for interactions with IP addresses seen communicating with webshells.
• Investigate logging and hosts for persistence, lateral movement, account creation, exfiltration attempts or malware deployment.
• Patch vulnerable systems to prevent reinfection, remove or quarantine webshells and malware, remove persistence mechanisms, and only bring systems back online when safe.
• Restore websites from a recent known-good backup where compromise is indicated.

Additional protections include keeping CMS software and plugins up to date, applying security patches automatically where acceptable, disabling plugins with actively exploited vulnerabilities until patched, using cloud services where providers rapidly remediate vulnerabilities, monitoring or blocking web directory file creation, restricting file and path access, monitoring unexpected webserver child processes, applying application control, and limiting unnecessary network communication between internet-facing websites and corporate devices.

If a service provider maintains your website, point them to the advisory. Organisations that have been impacted, suspect impact or require advice and assistance can notify ASD's ACSC via https://www.cyber.gov.au/report.

Credits

Templates were collected from or derived from:

• ProjectDiscovery nuclei-templates: https://github.com/projectdiscovery/nuclei-templates
• topscoder nuclei-wordfence-cve: https://github.com/topscoder/nuclei-wordfence-cve
• Wordfence Intelligence: https://www.wordfence.com/threat-intel/
• rxerium templates: https://github.com/rxerium/rxerium-templates
• ASD's ACSC advisory above

Use only on assets you own or are authorised to assess. Validate findings manually before treating a host as vulnerable.