Hackers target WordPress sites via third-party WooCommerce plugin
Attackers exploit unauthenticated file-upload flaw CVE-2026-27540 in WooCommerce Wholesale Lead Capture plugin to install PHP webshells; Wordfence blocked 100,000+ attacks.
CVE-2026-27540 is an unauthenticated arbitrary file-upload vulnerability in the WooCommerce Wholesale Lead Capture premium plugin (versions 2.0.3.1 and older), caused by the exposed wwlc_file_upload_handler AJAX action trusting a user-controlled file_settings allowlist. Discovered by researcher Teemu Saarentaus, it was fixed in version 2.0.3.2 released February 20. Defiant reports Wordfence blocked over 100,000 attacks, with exploitation spikes between June 4-17, July 1, and August 30, delivering shell.php webshells for reconnaissance and additional payload uploads.
- Unauthenticated AJAX handler accepts PHP uploads via forged file_settings allowlist
- Wordfence blocked 100,000+ exploitation attempts across multiple spikes
- Uploaded shell.php reports host details and enables further malicious file writes
- Patched in plugin version 2.0.3.2; admins urged to upgrade and audit uploads
- CVEs
- CVE-2026-27540
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-27540 | Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd | 9.0 | 3% | PoC |
From the original article
2 min read at bleepingcomputer.com
Hackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress to upload a PHP backdoor. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.