On 9 July 2026, the Australian Cyber Security Centre (ACSC) issued a critical alert - its highest severity rating - warning that hackers are running a large-scale, automated campaign against websites around the world, and that many small to medium sized Australian businesses have already been compromised.
This isn’t a vague “stay vigilant” advisory. A critical rating means the vulnerabilities are being actively exploited right now, the attack tools are publicly available, and the ACSC expects real damage to Australian networks. And the overwhelming majority of the software being targeted is WordPress plugins - the exact stack most Australian small business websites run on.
If you own a WordPress website and you’re wondering whether this affects you, this article walks through what the alert says, how to check if your site has been hacked, and what to do about it.
What Is the ACSC Alert Actually About?
Attackers are using automated scanners to sweep the internet for websites running vulnerable content management system (CMS) software and plugins. When they find one, they exploit it to plant something called a webshell.
A webshell is a small malicious file hidden on your web server that gives the attacker remote control of it. Once it’s in place, they don’t need your password, your login page, or any further vulnerability. They can come back whenever they like and use your website to:
- Deface or take down your site
- Steal credentials and data your customers enter into forms
- Upload additional malware that targets and scams your legitimate visitors
- Use your server as a stepping stone into the rest of your business network
The nasty part is that a webshell is designed to be invisible. Your site keeps loading normally. Your customers see nothing wrong. Meanwhile someone else has the keys.
Which WordPress Plugins Are Being Exploited?
The ACSC lists 17 pieces of software being actively exploited in this campaign. 13 of them are WordPress plugins, and several are among the most widely installed plugins in the ecosystem:
- Ninja Forms and Gravity Forms - two of the most popular contact form plugins on the planet
- WPvivid Backup - a backup plugin, ironically installed to make sites safer
- ThemeREX Addons - bundled with thousands of premium themes sold on ThemeForest
- ACF Extended - an add-on to the hugely popular Advanced Custom Fields
- Breeze Cache, BerqWP - performance and caching plugins
- Simple File List, WavePlayer, WPBookit, GutenKit, Hunk Companion and the Sneeit Framework
The remainder are standalone platforms: Craft CMS, MaxSite CMS, MetInfo CMS and the Joomla JCE editor.
Every one of these vulnerabilities is public and known, and patches already exist for them. The attackers aren’t using secret techniques - they’re betting that small business owners haven’t updated their plugins. Based on the ACSC’s warning that many Australian SMBs are already impacted, that bet is paying off.
How Do I Know If My WordPress Site Has Been Hacked?
You usually can’t tell by looking at the front of your website, which is exactly why these campaigns succeed. The ACSC’s guidance for checking is technical, but in plain English:
- Look for files that shouldn’t be there. Webshells are files an attacker created on your server. Check your web directories - especially inside plugin folders - for recently added or modified files you don’t recognise.
- Check your access logs. Requests hitting strange file paths (particularly POST requests to files inside plugin directories) are a red flag.
- Assume compromise if you find one. The ACSC advises treating any server with a webshell as fully compromised: isolate it, audit your logins and network activity, and work out what else the attacker touched.
- Restore from a known-good backup once the vulnerability is patched - cleaning a hacked site in place is unreliable, because attackers routinely plant more than one way back in.
If that list feels beyond your comfort zone, that’s a fair response - it’s beyond most business owners’ comfort zone. This is a job for whoever manages your website or hosting. Send them the ACSC alert and ask them directly: have you checked our site against this?
What Should Small Business Owners Do Right Now?
If your site runs WordPress, do these things this week, not next quarter:
- Update everything - WordPress core, your theme, and every single plugin. The vulnerabilities in this campaign all have patches available.
- Delete plugins you don’t use. Deactivated plugins can still be exploitable. If it’s not earning its place, remove it.
- Check whether any listed plugin is on your site. If you’re running one and can’t patch it immediately, the ACSC recommends disabling it until you can.
- Confirm your backups actually work. A backup you’ve never test-restored is a hope, not a plan.
- Ask your web provider what they’ve done about this alert. If your site is managed by an agency or freelancer, patching this is their job - but only if they’re actually doing it.
The stakes are worth spelling out. According to the Australian Signals Directorate’s latest Annual Cyber Threat Report, the average self-reported cost of cybercrime for an Australian small business is now $56,600 per incident - up 14 per cent in a year - and a cybercrime is reported in Australia every six minutes. For a small business, a hacked website isn’t an IT inconvenience. It’s a five-figure problem that can take your email, your Google rankings and your customer trust down with it.
Why Does This Keep Happening to WordPress Sites?
Because the architecture invites it. WordPress powers roughly 43 per cent of the web, and its real attack surface isn’t WordPress itself - it’s the sprawling ecosystem of third-party plugins, each one a separate piece of software written by a separate developer on a separate update schedule. Your website is only as secure as the least-maintained plugin on it.
The ACSC also flagged something new in this alert: the Five Eyes cyber security agencies recently warned that AI is accelerating the speed and scale of these attacks, shrinking the gap between a vulnerability being disclosed and being mass-exploited. The old assumption - “I’ll get to the updates eventually” - was already risky. In 2026 it’s untenable, because “eventually” is now measured against attackers who automate exploitation within hours of a disclosure.
We’ve written before about what happens when you don’t maintain your WordPress website, and this alert is that article playing out at national scale.
The Longer-Term Fix: Have Nothing to Hack
Here’s the question worth sitting with: does your business website actually need WordPress at all?
Most small business sites are brochure sites - a home page, services, about, contact. They don’t need a database, a login page, or 20 plugins. And this is a problem we’ve been telling small business owners how to prevent at the source. A month before the ACSC issued this alert, we published the full case for why small business websites in 2026 should be static - and the single biggest reason was exactly this: a static site gives hackers nothing to actually target.
Every attack in this campaign depends on something a static site doesn’t have. There’s no CMS to exploit, no plugins to patch, no login page to brute-force, no database to raid, no server-side code for a webshell to run on. Look at the ACSC’s own mitigation list - monitor file creation, restrict paths, watch for rogue processes, isolate the web server from your network. It’s a checklist of ongoing chores that exist purely to defend an attack surface WordPress creates. A static site doesn’t defend that attack surface. It deletes it.
That’s the difference between the two approaches. Patching is a race you have to win every single week, against attackers who now automate exploitation within hours. Going static means not entering the race at all. You can’t be on the next exploitation list if there’s nothing to exploit.
Frequently Asked Questions
Does updating WordPress core alone protect me from this campaign?
No. This campaign specifically targets plugins, not WordPress core itself. A fully updated core install running even one outdated plugin from the list above is still exposed. Every plugin needs to be checked and patched individually - updating core is necessary but not sufficient.
Am I still at risk if I use a WordPress security plugin?
Yes, if the vulnerable plugin itself is still installed and outdated. A security plugin can help detect suspicious activity after the fact, but it doesn’t patch the specific vulnerabilities this campaign exploits - only updating or removing the affected plugin does that.
Does this affect my site if I don’t take payments or store customer data?
Yes. A webshell gives an attacker control of your server, not access to a specific database table - it’s used to deface your site, host malware that targets your visitors, or pivot into your wider network, regardless of what data your site holds. Having “nothing worth stealing” doesn’t make a site an unattractive target for this kind of campaign.
How quickly do I actually need to act?
This week, not next quarter. The ACSC alert specifically flags that AI is now shrinking the gap between a vulnerability being disclosed and being mass-exploited - the patches for every vulnerability in this campaign already exist, which means the only businesses still exposed are the ones that haven’t applied them yet.
If you’re not sure whether your website is affected by this alert - or you’re tired of worrying about WordPress security altogether - get in touch to find out how YourStuff can help.
