Are Your WordPress Vulnerabilities Letting Chinese Hackers Walk Off with Your Sensitive Data?

If your WordPress site is “just a website,” this is the part where people get blindsided. GreyNoise tracked a Chinese-speaking threat actor tied to the Red Heron cluster exploiting WordPress wp2shell RCE flaws and a Zyxel GS1900 switch bug to steal sensitive government and law-enforcement data. The scary part isn’t the headlines. It’s how fast a small crack (an unpatched core flaw, old credentials, a reachable management interface) turns into database access and real-world records walking out the door. Let’s break down what happened, what it looks like on a compromised box, and what you should do this week—not “someday.”

What happened (and when): a simple timeline that explains the spike

If you’re wondering why this suddenly looks “everywhere,” it’s because the attacker didn’t invent some magic new trick. They waited for reachable systems and fresh exploit code—then moved fast.

GreyNoise tracked a Chinese-speaking threat actor tied to the Red Heron cluster using the same originating IP infrastructure as far back as early June 2026, based on observations from GreyNoise’s Global Observation Grid (GOG) sensors . That matters because it shows pre-positioning: scanning, probing, and lining up targets before the loud part starts.

The timeline (clean and simple)

• Early June 2026: Recon and scanning begins
• GreyNoise records the activity starting in early June 2026, tied to infrastructure associated with this cluster .
• This is the “quiet” stage. Your site might already be getting checked for weak points, and you won’t see a headline yet.
• Mid-July 2026: wp2shell public exploits drop
• Public exploits for WordPress wp2shell RCE (CVE-2026-63030, CVE-2026-60137) became available in mid-July .
• Active exploitation was observed only a few days later .
• Translation: once weaponized exploit code is public, attackers don’t “schedule it.” They hit what’s patch-lagging right now.
• July → onward: Real compromise at scale via WordPress
• Using wp2shell, the actor breached at least 49 organizations across 29 countries .
• In one documented intrusion, they ultimately stole at least 18,566 records from a backend SQL database . GreyNoise says those records included accounts, plaintext passwords, and PII tied to government and law-enforcement agencies .
• August 17, 2026: Zyxel GS1900 exploitation kicks off
• On August 17, the same threat actor began exploiting CVE-2026-7273 in Zyxel GS1900 Smart Managed Switches .
• GreyNoise reports 996 devices compromised across 48 countries .

Why this created a “spike”

The pattern is painfully predictable:

1. Pre-scan in June to map soft targets
2. Public exploit in mid-July for wp2shell
3. Exploitation days later (patch gap = attacker window)
4. Expansion in August to edge/network gear (Zyxel GS1900) for deeper access

If your WordPress security posture is “we patch when we get to it,” this is exactly how a simple WordPress vulnerability turns into sensitive data theft—fast.

How wp2shell turns “site bug” into “data theft”: the attacker’s playbook in plain English

A WordPress RCE like wp2shell isn’t “just a WordPress problem.” It’s a foothold. Once an attacker can run commands on the box hosting WordPress, they start treating it like any other internal machine they want to own.

Here’s the chain GreyNoise described, translated into normal language.

1) WordPress wp2shell RCE → command execution

The actor used a custom wp2shell exploit (CVE-2026-63030 / CVE-2026-60137) to get remote code execution, meaning they could run commands as whatever user the web server runs under .

That’s enough to:

• drop a webshell or stager
• run built-in Windows commands
• start collecting system info fast

2) Fast Windows recon: “What security is running, and what can I touch?”

GreyNoise notes the attacker ran extensive Windows and security reconnaissance, specifically checking :

• Microsoft Defender (am I being watched?)
• AMSI (will my scripts get scanned?)
• available services
• listening ports
• local accounts
• application restrictions
• database configuration

This step is why compromise can look “quiet.” It’s not noisy ransomware behavior. It’s inventory.

3) Bypass attempts → privilege moves (token impersonation/theft)

Next comes the part most WordPress owners never expect: Windows post-exploitation.

Over 36 minutes, the attacker tried 17 scripts aimed at :

• bypassing AMSI
• escalating privileges using token impersonation or token theft
• creating a local administrator
• extracting registry data

If you’re running WordPress on Windows (or you have Windows servers reachable from that host), this is where “site bug” becomes “network incident.”

4) Credential hunting → the data theft step people miss

This campaign didn’t stop at the website. GreyNoise says the attacker located credentials for a backend SQL database .

Then they did something that hits a lot of orgs hard: they reused those credentials in a password-spraying attack that got them into an internal SQL server .

Once they’re in SQL, it’s simple:

• query tables
• export rows
• walk out with real records

GreyNoise reports they stole at least 18,566 records, including accounts, plaintext passwords, and personally identifiable information (PII) linked to government and law-enforcement agencies .

What to take from this (no panic, just clarity)

The “wp2shell → data theft” path works when two things are true:

1. Your WordPress host can reach valuable systems (like SQL).
2. Credentials are stored where attackers can find them—or reused across systems.

That’s why hardening WordPress alone isn’t the finish line. It’s the starting line.

The “it’s not just WordPress” reality: switches, VPN edges, and why KEV won’t save you

Once an attacker gets momentum, they don’t stay married to one exploit. They move to whatever gets them persistence, internal reach, and creds. GreyNoise’s reporting on this cluster makes that point painfully clear: WordPress was one lane, not the whole highway.

GreyNoise-confirmed targets you should recognize in your own stack

GreyNoise confirmed this threat activity wasn’t limited to wp2shell-style WordPress RCE. They observed targeting across a mix of internet-facing “edge” and admin-heavy platforms :

• Zyxel GS1900 Smart Managed Switches (CVE-2026-7273)
• PAN-OS GlobalProtect
• Ubiquiti UniFi OS (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) — GreyNoise noted attempts to chain these for root-level RCE
• FlowiseAI (CVE-2026-56271)
• Gitea (CVE-2026-60004)
• Nuclio (CVE-2026-79756)
• Proxmox VE (CVE-2023-54391)
• Linux kernel Dirty Pipe (CVE-2022-0847)
• SENAITE LIMS (CVE-2026-54569)

If you’re reading that list thinking, “We don’t run half of this,” good. The point is the shape of the targeting: website layer + remote access layer + infrastructure layer. That’s how “a web issue” becomes “a business issue.”

Why “patch what’s on CISA KEV” is a losing plan

A lot of teams treat CISA’s Known Exploited Vulnerabilities (KEV) catalog like a safety net: if it’s not on KEV, it can wait.

GreyNoise explicitly highlighted that not all security issues leveraged in attacks linked to this threat cluster have been added to CISA’s KEV catalog .

What that means in plain terms:

• KEV is helpful for prioritization.
• KEV is not a full map of what’s being exploited this month.
• If your patch program is “KEV-only,” you’re accepting blind spots as a strategy.

A quick self-audit question that catches real exposure

Ask one uncomfortable question: Which of our admin interfaces are reachable from the internet?

That includes:

• switch management (yes, even “smart managed” gear)
• VPN portals
• hypervisor panels
• dev tools and dashboards

If any of those are exposed and not patched quickly, you’ve recreated the exact conditions these campaigns thrive on.

What to do now (checklist): contain, patch, rotate, verify

If you’re treating this like a “WordPress cleanup,” you’ll miss the point. GreyNoise’s write-up shows post-exploitation steps and stolen SQL access in the same chain, plus infrastructure targeting and IoCs (hashes + C2) tied to the cluster  . Your response has to be tight and immediate.

1) Contain (stop the bleed before you “fix”)

1. Isolate the WordPress host (or the whole VM) from anything internal that matters (SQL, file shares, admin subnets).
2. Block known bad infrastructure if you have it. GreyNoise published IoCs including backdoor hashes and command-and-control (C2) infrastructure .
3. If you have network gear management exposed, pull it off the public internet right now. This cluster also hit Zyxel GS1900 switches .

2) Patch (close the exact doors being used)

• Patch WordPress core immediately for wp2shell RCE: CVE-2026-63030 and CVE-2026-60137 .
• Patch exposed edge/infrastructure that’s relevant to your environment, especially Zyxel GS1900 (CVE-2026-7273) .

Rule: patching is not a monthly chore when public exploit code is already circulating.

3) Hunt (look for what attackers leave behind)

Your goal is to find webshells/backdoors and confirm whether the attacker ran follow-on tooling.

• Search web roots and upload paths for unexpected executables/scripts and recently modified files.
• Compare file hashes against GreyNoise’s published IoCs where possible .
• On Windows-based hosting, treat the box as a real endpoint. GreyNoise described the actor running lots of recon and security checks and attempting bypass activity .

4) Verify logs (catch the part that turns into a breach notification)

GreyNoise reports the attacker used located backend SQL credentials and then performed password spraying to reach an internal SQL server and steal data .

Look for:

• Repeated login attempts across many accounts (classic password spraying)
• New SQL logins from your web server / WordPress host
• Large or unusual SQL reads/exports, especially off-hours
• Outbound connections from the WP host that don’t match normal behavior

5) Rotate credentials (assume exposure once code execution happened)

This is where teams hesitate and lose time.

• Rotate, in this order:

1. WordPress admin passwords (and remove unknown admins)
2. Database user passwords used by WordPress
3. Any service accounts stored on the host or used for internal access

• If there’s any chance plaintext passwords were exposed (GreyNoise says stolen data included plaintext passwords) treat it as a full reset event:
• force password resets
• invalidate active sessions/tokens
• review privileged access and audit logs

6) Lock down management interfaces (especially “smart” network gear)

• Put switch/VPN/admin panels behind:
• VPN access only, or
• strict allowlists
• Disable direct internet exposure wherever possible. This cluster’s Zyxel GS1900 targeting shows why “it’s just a switch” is a bad assumption .

Reducing blast radius next time: stop letting one compromise expose everything

If this campaign taught anything, it’s that attackers don’t need “total control” to cause total damage. They need one weak point, then enough internal connectivity and stored secrets to keep going. GreyNoise even tied this cluster to backdoors and C2 infrastructure via published IoCs, which is a reminder that persistence is often the goal, not a quick smash-and-grab .

1) Treat your WordPress host like a hostile network (because it can become one)

Goal: A WordPress RCE should not be able to “see” your database server like it’s on the same desk.

Hardening moves that hold up:

• Network segmentation between web tier and database tier
• Allow DB connections only from the exact web server IP(s).
• Allow only the DB port you need (and only inbound, not broad internal access).
• Admin panels behind VPN or strict allowlists
• wp-admin is one thing. Your switch UI, hypervisor UI, and VPN portals are another.
• Keep management interfaces off the public internet whenever possible.
• Egress controls for the web server
• Limit outbound traffic to what the app actually needs (updates, APIs).
• This makes “phone home to C2” noisier and easier to block .

2) Least-privilege database access (so stolen creds don’t equal stolen tables)

Your WordPress DB user should be boring:

• Only the permissions required for WordPress to run
• No admin-level DB permissions
• No access to other databases on the same SQL server

If an attacker steals that credential, you want them stuck in a small room, not roaming the building.

3) Monitor what attackers can’t hide

You don’t need perfect detection. You need a few high-signal tripwires:

• New admin accounts (WordPress admins, local OS admins, SQL logins)
• Changes to authentication settings and plugin/theme file modifications
• Unusual outbound connections from the web server (new destinations, odd ports)
• Matches on known IoCs (hashes/domains/IPs) when threat intel is available

4) Limit real-world fallout when the database leaks

Even with good controls, breaches happen. When they do, the ugly part isn’t just “someone read a table.” It’s users dealing with spam, phishing, and SIM-swap attempts tied to exposed emails and phone numbers.

This is one place Cloaked can fit without any hype: using masked emails and masked phone numbers for sign-ups and user communications can reduce how much real contact data gets exposed if your WordPress database is ever dumped. It won’t stop an RCE, but it can shrink the personal impact on customers when the worst-case scenario hits.

‍