Suspected China-Linked Hackers Stole Government Records Through WordPress Flaw

A cybersecurity research firm has traced a monthslong hacking campaign that stole tens of thousands of records from a Western government agency and breached dozens of other organizations worldwide, using a critical flaw in WordPress that was patched only in July. The firm, GreyNoise, said in a report published Monday, that a suspected Chinese-speaking attacker exploited the vulnerability chain, nicknamed "wp2shell," to break into 49 WordPress sites in 29 countries and pull a government agency's user database within hours of gaining access.

The intrusions are the latest evidence that state-linked hacking groups are moving faster than defenders can patch. GreyNoise, a Washington-based threat-intelligence company that watches for exploitation attempts through a global network of internet sensors, said it found the activity not by waiting for a victim to report a breach but by observing the attacker's infrastructure scanning the open internet in real time.

The numbers

According to the report, the attacker compromised 49 WordPress installations across 29 countries, with the heaviest concentrations in Germany, Colombia and Switzerland. In one intrusion, logged on July 22, the attacker moved from initial access to a full database extraction in roughly two and a half hours, according to a timestamped log GreyNoise reconstructed from its sensor data. The haul from that single government target came to 18,566 records, including administrator accounts and passwords stored in plain text. GreyNoise did not name the government or the agency involved and said it was withholding the target's IP address, citing "victim sensitivities and operational risk."

A separate, related intrusion set hit 996 network switches made by the Taiwanese manufacturer Zyxel across 48 countries, led by victims in Italy, the United States and Taiwan. The underlying software flaws carry some of the highest severity ratings vendors assign: the SQL-injection bug at the center of the WordPress chain, tracked as CVE-2026-60137, has a base severity score of 9.1 out of 10, while its companion flaw scores 7.5.

GreyNoise reconstructed the government intrusion in detail from log data. Within roughly ten minutes of the initial exploit, the attacker had dumped a table listing 13 administrator accounts. Over the following two hours the intruder deployed a reconnaissance plugin, attempted to escalate privileges, searched the compromised system for credentials stored in plain text, and staged an archive of files before running the SQL injection that pulled the full records database. GreyNoise tracked the operator under the usernames "kapibala" and "kapibala2," which is also how the firm titled its report.

• 49 WordPress sites breached across 29 countries
• 18,566 records stolen from one Western government agency
• 996 Zyxel network switches compromised across 48 countries
• Roughly two and a half hours from first access to stolen database, in one logged case

A patch that came too late for some

The WordPress vulnerabilities were not secret. A researcher at the security firm Assetnote found the flaws and reported them through WordPress's bug-bounty program, and the WordPress.org security team shipped an emergency release on July 17, pushing version 7.0.2 and matching updates for older branches and triggering forced automatic updates on hosted sites because of how easily the bug could be exploited by an anonymous visitor. Four days later, the Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog, a listing that requires U.S. federal civilian agencies to patch on a government-mandated deadline. Security researchers had already begun circulating working exploit code by the time public proof-of-concept attacks appeared online, giving site operators who had not yet updated a narrow window before automated scanning began.

WordPress software runs a substantial share of the public web, from small nonprofit sites to portals maintained by government agencies and police departments, which is part of why a vulnerability that requires no login and no plugins beyond a stock installation drew such urgent attention. Sites that missed the forced update, disabled automatic updates, or ran an unsupported version remained exposed for weeks after a fix existed. The gap between disclosure and exploitation has been the recurring theme of this year's biggest breaches: attackers now routinely build working exploit chains within days of a patch shipping, reverse-engineering the fix itself to figure out what it was protecting against, then scanning the internet for every server that has not yet applied it.

Part of a broader pattern

GreyNoise said the WordPress campaign shares command-and-control infrastructure and malware traits with a separate operation that the backup and security vendor Acronis had already linked to a group it calls Red Heron. In a report last week, Acronis's threat-research unit described Red Heron weaponizing a flaw in the self-hosted code-management tool Gitea within days of its disclosure, compromising organizations in Canada, Argentina, Taiwan, the United States and Sri Lanka that spanned defense, energy, elections and telecommunications work, and deploying a custom Linux rootkit designed to hide the intrusion from system administrators. Independent reporting on that campaign similarly described it as fast-moving and opportunistic, hitting whichever internet-facing systems ran the vulnerable software rather than pursuing a narrow target list.

GreyNoise researchers Andrew Thompson and Mark Mager wrote that the group's tooling showed signs of being written with the help of a large language model, based on how the code evolved across versions.

"These types of superficial changes are generally a waste of time for a human and a strong indicator the code was likely generated by a LLM," the researchers wrote, describing repetitive edits in the attacker's custom scripts that added no new functionality.

Who is exposed

The organizations at risk fall into two overlapping groups: anyone running an unpatched WordPress installation exposed to the internet, and anyone operating one of the affected Zyxel switch models on a network reachable from outside. GreyNoise's victim list skewed toward government bodies and small and midsize businesses rather than large enterprises, which security researchers have said often lag in patching internet-facing infrastructure because it is not centrally managed by a dedicated security team. The stolen government database is the most acute harm identified so far, since plaintext credentials and personal records tied to law-enforcement and government accounts can be reused in follow-on fraud or espionage well after the original intrusion is closed off. GreyNoise said it assessed the link to Red Heron with moderate rather than high confidence, based on shared infrastructure and tradecraft rather than direct confirmation that the same operators are behind both campaigns.

What happens next

Neither GreyNoise nor Acronis has said the campaigns they are tracking have stopped, and the range of software involved, spanning firewall, networking, code-repository and Linux kernel products, indicates the same actor or a closely affiliated one has the ability to keep rotating through newly disclosed vulnerabilities as they surface. For site owners, the near-term guidance from researchers who have studied the campaign echoes what WordPress and CISA said when they first flagged the flaw in July: confirm that automatic updates are enabled, verify the installed version is 7.0.2, 6.9.5 or later, and treat any WordPress instance that went unpatched through the summer as potentially compromised rather than merely vulnerable.