Exposed Server Reveals 25,000 Compromised WordPress Websites

An exposed WP-SHELLSTORM server revealed a large-scale, financially motivated campaign that automated exploitation of known WordPress and Joomla vulnerabilities to deploy obfuscated webshells (down.php), install persistence (SNOWLIGHT, VShell), steal enterprise cloud and database credentials, and resell site access; researchers found tooling, target lists (1.4M scanned, ~25k confirmed compromises per analysis, >17k webshells logged), and operational errors that exposed internal logs and infrastructure, and recommend patching, removing unused plugins, monitoring for IOCs, rotating credentials, and testing incident response.