A wide-reaching exploitation campaign against WordPress sites has compromised dozens of organizations worldwide, with a Western government agency suffering the most damaging breach: 18,566 internal records, including plaintext passwords, pulled straight out of its backend database. Researchers tracking the activity believe the operator is a Chinese-speaking threat actor who chained two separate vulnerabilities together to gain a foothold.

Two bugs, one exploit chain

The campaign relies on a pairing of vulnerabilities, tracked as CVE-2026-63030 and CVE-2026-60137 and referred to by researchers as the “wp2shell chain,” that together let an attacker move from a WordPress installation’s exposed surface to full webshell access. Once the chain lands, the attacker has the ability to enumerate the site, dump database contents, and execute further commands, all from a custom-built toolset rather than off-the-shelf malware.

Threat intelligence firm GreyNoise, which has been tracking the operation, has linked it to accounts named “kapibala” and “kapibala2.” Notably, GreyNoise’s researchers observed that the actor’s code changes rapidly between iterations in a way that “may have been produced with help from a large language model,” a detail that fits a broader pattern of attackers using AI tools to speed up development of their exploit and post-exploitation code.

Scale: 49 organizations, 29 countries, and a side campaign against network switches

GreyNoise counts at least 49 compromised organizations spread across 29 countries tied to this campaign. The same actor was also observed targeting nearly a thousand ZyXEL GS1900 network switches, 996 of them across 48 countries, suggesting a broad, opportunistic scanning-and-exploiting operation rather than a narrowly targeted one.

Within that wide net, one victim stands out. A Western government agency suffered what researchers describe as the campaign’s most serious intrusion, beginning around July 22, 2026. The attacker dumped the site’s WordPress user table, making off with 13 administrator accounts, and then created an additional hidden administrator account designed to mimic the agency’s own legitimate domain address so it would blend in during routine review.

Inside the intrusion

From there, the attacker used a custom enumeration plugin and webshell to conduct reconnaissance and run commands on the compromised server. A purpose-built credential-search tool was used to pull database access details out of readable configuration files, which the attacker then used to reach the backend SQL database directly. That database yielded 18,566 records containing account information, plaintext passwords, and personal data tied to law enforcement and government personnel.

The intrusion didn’t stop at data theft. Investigators observed the attacker staging stolen files into ZIP archives ahead of exfiltration, then pivoting to sustained password-spraying attempts against internal systems over several hours, along with privilege escalation attempts, an indication they were trying to expand their foothold well beyond the initial WordPress compromise.

Recommended response

Given the scale and the sensitivity of the data involved, organizations running WordPress, especially government and public-sector sites, should treat this as an urgent patching and hygiene issue. Recommended steps include:

• Patch WordPress core, themes, and plugins to current versions immediately
• Audit administrator accounts for anything unrecognized, paying close attention to accounts with usernames or emails designed to look legitimate
• Rotate all passwords and database credentials, and invalidate active sessions
• Search web directories for unexpected PHP files that may indicate a webshell
• Restrict database access from web servers wherever architecturally possible
• Enable multi-factor authentication for all administrative accounts
• Treat any plaintext credential exposure as an active incident and audit for password reuse across other services

The plaintext password exposure is especially concerning given how often credentials are reused across systems; affected organizations should assume those passwords are already circulating and force resets everywhere they may have been reused, not just on the breached site.