Small business websites hacked in Australia: what ASD's 2026 warnings mean for your WordPress site
Small business website hacked in Australia? ASD's 2026 alerts flag webshells planted via plugins and fake CAPTCHAs on WordPress. Get the owner checklist.
Small business websites in Australia are being hacked, often through outdated plugins, and the Australian Signals Directorate (ASD) issued two warnings about compromised websites in 2026. Its ACSC flagged hacked WordPress sites showing visitors fake CAPTCHA checks that trick them into installing password-stealing malware, then a large-scale campaign planting webshells through vulnerable CMS plugins that hit many small and medium Australian businesses.
Owners see marketing. Attackers see a computer that sits on the internet around the clock, runs code from dozens of authors and often has no clear owner, much like the printers and cameras most offices forget they own. Below, both warnings become a one-page owner checklist.
What did ASD warn about in 2026?
May: fake CAPTCHAs on hacked WordPress sites. On 7 May 2026, ASD's ACSC published an advisory on ClickFix activity distributing Vidar Stealer through WordPress. Attackers broke into legitimate WordPress sites and added code that sent visitors to a fake Cloudflare or CAPTCHA check, which told them to copy and run a PowerShell command that installed Vidar, a password stealer. The ACSC said Australian organisations across multiple sectors were being targeted.
July: webshells planted through CMS plugins. On 9 July 2026 the ACSC issued an alert on a large-scale exploitation campaign targeting website content management systems, saying many small to medium-sized Australian businesses had been impacted. Attackers exploit known flaws such as unauthenticated file uploads and remote code execution, then plant webshells: hidden scripts that let them control your web server, deface the site, capture logins, serve malicious content to visitors or reach into your wider network. The ACSC also pointed to AI as one reason the gap between a flaw's publication and its exploitation keeps shrinking.
Why plugins? WordPress security firm Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025: 91% in plugins, 9% in themes and just six in WordPress core. Almost half (46%) had no developer fix by the time they were made public, and for heavily targeted vulnerabilities the weighted median time to first exploit was five hours.
Is your website affected?
Check your plugin list against the products the ACSC named. In WordPress that is the Plugins screen; if you can't log in, finding out who can is job one. These are the products and CVE numbers (public IDs for vulnerabilities) cited in the July alert, as reported by BleepingComputer.
| Product | Platform | CVE as reported |
|---|---|---|
| Simple File List | WordPress | CVE-2025-34085, CVE-2020-36847 |
| WavePlayer | WordPress | CVE-2025-12057 |
| BerqWP | WordPress | CVE-2025-7443 |
| WPBookit | WordPress | CVE-2025-7852 |
| Ninja Forms | WordPress | CVE-2026-0740 |
| ThemeREX Addons | WordPress | CVE-2026-1969 |
| Breeze Cache | WordPress | CVE-2026-3844 |
| pay-uz | WordPress | CVE-2026-31843 |
| ACF Extended | WordPress | CVE-2025-13486 |
| Sneeit Framework | WordPress | CVE-2025-6389 |
| WPvivid Backup | WordPress | CVE-2026-1357 |
| Gravity Forms | WordPress | CVE-2025-12352 |
| GutenKit / Hunk Companion | WordPress | Likely CVE-2024-9234 |
| Craft CMS | Standalone CMS | CVE-2025-32432 |
| MaxSite CMS | Standalone CMS | CVE-2026-3395 |
| MetInfo CMS | Standalone CMS | CVE-2026-29014 |
| JCE editor | Joomla | CVE-2026-48907 |
The list covers what was seen being exploited, not everything vulnerable, so absence from it isn't a clean bill of health. Update each product or remove it. Updating won't evict anyone already inside, though: if an affected plugin sat unpatched for months, get someone to check for webshells, since the ACSC says to treat any server with one as compromised.
Why is a hacked website a risk to your customers and staff?
Your visitors are the people who already know you: customers, suppliers, staff and job applicants. In the May campaign, legitimate websites were the bait. Vidar, as BleepingComputer's report on the advisory describes, goes after saved browser passwords and cookies, autofill data, crypto wallets and system details.
The cookies matter most. A session cookie keeps you signed in after the password and MFA check, and IT Brief reported that a stolen one can let an attacker into an account without the password, weakening MFA where a session is already active. That is how a fake CAPTCHA on a supplier's site becomes a stranger reading your email. If that has already happened, follow our hacked Microsoft 365 account recovery steps; a free dark web scan checks if staff addresses on your email domain have turned up in known breaches.
Website security checklist for owners
Run through this with whoever manages your site. None of it needs code; it needs an owner for each line.
Inventory plugins and themes.
Every one installed, with its version and last update, checked against the table above.
Delete what you don't use.
A deactivated plugin still leaves its files on the server. Both ACSC warnings say to remove unused components.
Turn on automatic updates.
Since WordPress 5.5 you can enable auto-updates plugin by plugin and theme by theme; by default they run twice a day, and WordPress emails the site owner when an update succeeds or fails.
Put MFA on every admin login.
WordPress, the hosting panel, the domain registrar and DNS. Remove accounts belonging to former staff and past developers.
Watch for new files.
The ACSC's detection advice starts with recently created files in CMS and plugin folders. File-change monitoring flags them automatically.
Make web directories read-only where possible.
If the server can't write to those folders, a webshell upload has nowhere to land.
Keep off-site backups you have test-restored.
Recovering from a webshell means restoring a known-good copy the attacker couldn't reach.
Know who holds the keys.
Record who holds the hosting, registrar and DNS logins and whose name is on each; a lapsed domain or a DNS login held by a departed developer is an incident waiting to happen.
Separate the website from the office network.
The ACSC recommends limiting traffic between web servers and internal networks.
Get scanned from outside.
Monthly vulnerability scanning checks your website, email and remote access for known weaknesses, so they are flagged before an attacker finds them.
The staff rule: no real website asks you to paste a command
ClickFix gets the victim to do the attacker's work. As Microsoft's threat intelligence team explains, a fake verification page quietly copies a command to the clipboard, then tells the visitor to paste and run it in the Windows Run box (Windows key + R), Windows Terminal or PowerShell. Because the person runs it themselves, it can slip past conventional security tools.
The sticky-note rule for staff: no genuine website or CAPTCHA will ever ask you to open Run, PowerShell or Terminal and paste something in. Close the tab. Anyone who has already run the command should disconnect that computer, call IT so their active sessions can be signed out, and change their passwords from another device. A phishing simulation shows who would have followed the steps.
Back it with technical controls:
Restrict PowerShell and scripts for staff who don't need them, as the ACSC's May advisory recommends.
Use application control, one of the Essential Eight strategies, so unapproved programs and scripts can't run.
Remove the Run box via Group Policy where it isn't needed and turn on PowerShell script block logging, as Microsoft's ClickFix guidance suggests.
Use phishing-resistant MFA and least privilege to limit what a stolen login can reach.
Who looks after website security: your web developer or your IT provider?
Often, honestly, nobody. The developer built the site and moved on. The host may keep the server running without touching your plugins, depending on the plan. Your IT provider runs the laptops, Microsoft 365 and the network, and assumes the website is the developer's job. Ask whoever manages your site what they did about the July alert, then confirm who owns each job:
| Job | The usual assumption | Confirm in writing |
|---|---|---|
| Plugin, theme and core updates | "The host does that" | Who updates, how often, and whether auto-updates are on |
| Backups | "The host backs it up" | Where copies live and when a restore was last tested |
| Domain, DNS and hosting | "The developer handles it" | Accounts in the business's name, and who gets renewal notices |
| Acting on ACSC alerts | "Someone will tell us" | Who reads alerts and checks your site against them |
| Cleaning up a hack | "The developer will fix it" | Who investigates, restores and reports, and at what cost |
The simplest answer is one accountable team. That is how our Melbourne team approaches secure website development: for sites Key IT builds or takes over, we offer secure hosting with HTTPS, patched software, MFA on all admin logins and automatic off-site backups. Happy with your developer? Keep them and agree who owns each row above. For portals and booking systems, a penetration test shows what an attacker could actually do, and our early threat intelligence post explains how Key IT matches advisories against what each client runs.
Frequently asked questions
How do I know if my small business website has been hacked?
Look for redirects to strange sites, pop-ups asking visitors to run commands, admin accounts nobody created, unfamiliar files in plugin folders, or warnings from Google, your host or customers. Many compromises show no visible sign, so the ACSC's advice starts with checking for recently created files and unusual requests in web server logs.
What should I do if my website has been hacked?
Don't just delete the suspicious file. Take the site offline, keep the logs, change every related password from a clean device, restore a backup from before the compromise and update everything before relaunching. Report it through ReportCyber on cyber.gov.au; for urgent help, ring 1300 CYBER1 (1300 292 371), ASD's Australian Cyber Security Hotline, which runs 24 hours a day. Key IT's incident response team can help.
What is ClickFix?
ClickFix is a social engineering trick: a fake verification page or error message loads a command onto your clipboard, then tells you to run it on your own computer. In 2026 the ACSC linked it to hacked WordPress sites spreading the Vidar password stealer. A real CAPTCHA never asks you to open Run, PowerShell or Terminal.
How often should website plugins be updated?
Apply security updates as soon as they are released; automatic updates do this for you. As a benchmark, the Essential Eight sets a 48-hour patching window for online services where a vulnerability is rated critical by the vendor or already has a working exploit. Review the plugin list every few months and delete anything unused.
Will a vulnerability scan find a webshell on my website?
Not on its own. An external scan finds outdated software, known vulnerabilities and exposed services, which is how you prevent the break-in. Finding a webshell already planted needs file-change monitoring, log review or a hands-on investigation. Most sites need both: scanning to close the doors, monitoring to spot anyone already inside.
Can Key IT secure a website someone else built?
Yes. We can review and improve an existing site, take over its hosting and maintenance, or rebuild it while protecting your search rankings. Prefer to keep your current developer? Key IT can run monthly vulnerability scanning across your website, email and remote access from $149 per month alongside them, so security has a clear owner.
More insights
SMS Sender ID Register explained
SMS Sender ID Register explained: why branded texts and appointment reminders now show…
Read article →CybersecurityEDR vs MDR vs XDR vs SIEM vs SOC
EDR vs MDR vs XDR vs SIEM vs SOC in one table: what each one is, who watches it, and which a 10, 30…
Read article →Managed ITThe meter effect: included vs ad-hoc support
Included IT support vs ad-hoc comes down to behaviour: when every call costs money, staff sit on…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.