ACSC Issues Fresh Warning on CMS Vulnerabilities: What Australian SMBs Need to Know

The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) recently warned of an active, large-scale campaign targeting web content management systems (CMS) such as WordPress and similar platforms. Attackers are scanning for known vulnerabilities in CMS platforms and plugins, then deploying webshells that give them remote access to compromised servers.

For Australian SMBs that rely on a website for leads, bookings or customer service, this is a timely reminder that even modest online presences can become entry points for bigger problems. The good news is that the fixes are mostly straightforward and don’t require an enterprise budget.

Why this matters for 10–100 person businesses

Many smaller Australian companies run their own sites or use simple hosted CMS setups. These sites often handle customer data, integrate with accounting tools, or sit behind the same credentials used elsewhere. A successful webshell can lead to data theft, ransomware deployment, or the site being used to attack others.

The ACSC notes that the campaign is exploiting issues that allow unauthenticated file uploads, remote code execution and similar attacks. Businesses that have not applied updates recently are particularly exposed.

What to do about it this week

Start with an inventory of every website your business owns or manages. Note the CMS platform, key plugins and the date of the last update.

Apply all available security updates immediately, especially for the core CMS and any plugins that handle forms, file uploads or user logins. Enable automatic updates where possible, but test them on a staging copy first if the site is business-critical.

Review user accounts and remove any that are no longer needed. Enforce strong, unique passwords and consider adding multi-factor authentication to the CMS admin area.

If you use a managed hosting provider, ask them what monitoring and patching they perform. Many Australian hosts now offer free or low-cost malware scanning and automatic updates.

Longer-term habits that reduce risk

Schedule a quarterly review of your websites alongside your other IT tasks. Keep a simple spreadsheet listing each site, its CMS version and responsible person.

Limit the number of people who can log in as administrators and use the principle of least privilege. Consider moving high-traffic or sensitive sites to a managed WordPress host that includes security hardening as standard.

Finally, make sure your backup solution covers the website files and database. Test a restore at least once a year so you know it works when you need it.

Staying on top of these basics keeps your business out of the headlines and focused on serving customers instead of recovering from incidents.