Hacker Server Leak Exposes WP-SHELLSTORM's Backdoor Operations on WordPress Sites

Overview of the Incident

A cybercrime crew, identified as WP-SHELLSTORM, accidentally exposed one of their servers for three weeks. This incident unveiled their hacking tools and logs, showing their operations against WordPress sites. Although the target list contained 1.4 million sites, they were not all successfully hacked.

Details of the Exposed Server

The server, located at 137.175.93[.]126, was found by security teams due to its lack of basic password protection. Inside, approximately 800MB of files was publicly accessible, including webshells, exploit scripts, and command history. This careless leak was due to the operator running a Python web server for file transfers without securing it.

Exploitation of Vulnerabilities

WP-SHELLSTORM utilized known vulnerabilities in outdated plugins to launch automated attacks against a large number of websites. Their primary target was the Breeze caching plugin, specifically exploiting CVE-2026-3844, which allowed them to backdoor more than 17,000 sites when certain conditions were met.

Implications for the WordPress Community

This incident serves as a critical reminder for website administrators to regularly update their plugins to mitigate risks from such mass hacking operations. The findings also underline the importance of monitoring and securing web servers to avoid similar exposures in the future.