PHP Webshell Campaign Targets WordPress Through Critical WooCommerce Plugin Bug
Wordfence blocked over 100,000 exploitation attempts against CVE-2026-27540 in WooCommerce Wholesale Lead Capture, letting attackers upload PHP webshells to WordPress sites.
Wordfence reported more than 100,000 blocked exploitation attempts against CVE-2026-27540 in the WooCommerce Wholesale Lead Capture plugin (roughly 6,000 active installs), which was disclosed and patched on February 20 in version 2.0.3.2. The unauthenticated AJAX handler wwlc_file_upload_handler reads permitted file extensions from the attacker-controlled request, enabling arbitrary file upload of PHP files such as shell.php that report host details and serve further upload forms. Attack activity peaked between June 4 and June 17, 2026, with additional waves on July 1 and August 30. Wordfence rates the flaw CVSS 9.8, while Patchstack's CVE record lists 9.0.
- Unauthenticated AJAX action wwlc_file_upload_handler trusts an attacker-supplied allowed-extensions list
- Arbitrary file upload enables PHP webshell deployment and remote code execution
- Exploitation peaked June 4-17, 2026, with further waves on July 1 and August 30
- Owners should update to 2.0.3.2+, inspect uploads for rogue PHP, and review admin-ajax.php logs
- Wordfence firewall rule blocks known attempts but does not patch vulnerable versions
- CVEs
- CVE-2026-27540
- Malware
- PHP webshell
- Organizations
- WordfenceRymera Web CoPatchstack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-27540 | Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd | 9.0 | 3% | PoC |
From the original article
2 min read at infosecurity-magazine.com
Attackers are exploiting a critical flaw in a third-party WooCommerce plugin to upload PHP webshells
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.