CVE-2026-48907
Known exploited · CISA KEV
EPSS 78% (100th percentile).
CISA federal remediation date Jun 19 · date passed
Vulnerabilities · 66 days ago
The break is not the initial intrusion. The real risk is that a planted webshell can keep a site usable as a commodity asset, so a cleanup that only removes the obvious malware can leave the operator with access they can reuse or sell again. That shifts the problem from one-time compromise to repeat monetization of the same site.
Researchers exposed a WP-SHELLSTORM server and found tools, logs, target lists, and evidence tied to 25,195 validated compromises. The operation targeted outdated WordPress and Joomla plugins, with the biggest activity around the Breeze cache plugin and Joomla's JCE editor.
The exposed material shows a webshell access-brokering model, not just mass exploitation. That means defenders have to think about surviving footholds and reused access, because a site that looks cleaned can still be part of the market if the backdoor or stolen entry point remains.
Known exploited · CISA KEV
EPSS 78% (100th percentile).
CISA federal remediation date Jun 19 · date passed
CVSS 9.8 CRITICAL: the Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in… EPSS 28% (98th percentile).
1 source covering this story
Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites
An open WP-SHELLSTORM server exposed tools, logs, and target lists naming 1.4 million sites, with researchers validating 25,195 compromises.
Part of the PlainSec briefing for 2026-07-10