Chinese Hackers Exploit WordPress Flaws to Steal Government Data and Passwords
A Chinese-speaking threat actor leveraged two WordPress vulnerabilities to compromise 49 organizations, stealing 18,566 government records including plaintext passwords and PII.
A sophisticated campaign orchestrated by a suspected Chinese-speaking threat actor has resulted in the compromise of at least 49 organizations across 29 countries, with a significant breach impacting a western government agency. The attackers exploited a chain of WordPress vulnerabilities, identified as CVE-2026-63030 and CVE-2026-60137, to gain initial access to vulnerable WordPress installations. This allowed them to deploy a custom webshell, establish a hidden administrator account, and subsequently exfiltrate sensitive data from backend systems.
The attackers' methodology involved a multi-stage approach. After gaining a foothold via the webshell, they enumerated the WordPress installation using a custom plugin, dumped the user table to steal administrator accounts, and created a disguised administrator account to maintain persistence. Their reconnaissance efforts extended to examining security tools, listening ports, and database configuration files before attempting privilege escalation. A key element of their success was the use of a custom credential-searching tool that identified usable database access details within readable files, enabling them to access an internal SQL server.
The most severe impact was observed in the breach of a western government organization, where the attackers successfully downloaded 18,566 records from a backend SQL database. This stolen data included account credentials, personally identifiable information (PII), and plaintext passwords belonging to individuals associated with law enforcement and government agencies. The attackers staged the exfiltrated files in a ZIP archive before downloading them, and the operation concluded with further password-spraying attempts.
In parallel to the WordPress compromises, the same threat actor was observed targeting other technologies. Notably, 996 ZyXEL GS1900 switches in 48 countries were compromised, with sensitive information being exfiltrated from these devices. This dual targeting suggests a broad operational scope, aiming to exploit various entry points into victim networks.
The campaign highlights the persistent risk posed by unpatched WordPress vulnerabilities, which can serve as a gateway from public-facing websites to deep server-level access. GreyNoise, which identified the activity, noted that the actor's code was rapidly changing, potentially indicating the use of large language models for development, although no specific AI tools were directly observed.
To mitigate the risks associated with this campaign, organizations are advised to promptly patch WordPress core, themes, and plugins. Additionally, removing any unknown administrator accounts, rotating all passwords and database secrets, and invalidating active sessions are crucial steps. Security teams should also inspect web directories for unauthorized PHP files, review authentication logs for suspicious activity, and isolate affected servers for thorough investigation and restoration from trusted backups.
Given the exposure of plaintext credentials, addressing password reuse across connected services is an urgent concern. Implementing multifactor authentication, restricting database access from web servers, and monitoring for unusual administrator creation and unexpected archive downloads can significantly limit an attacker's ability to escalate a website compromise into a broader network intrusion. Continuous monitoring of internet-facing systems is essential for detecting repeated scanning patterns and suspicious access attempts.