PHP Webshell Campaign Targets WordPress Through Critical WooCommerce Plugin Bug
Wordfence blocked over 100,000 exploitation attempts against CVE-2026-27540 in WooCommerce Wholesale Lead Capture, letting attackers upload PHP webshells to WordPress sites.
Wordfence reported more than 100,000 blocked exploitation attempts against CVE-2026-27540 in the WooCommerce Wholesale Lead Capture plugin (roughly 6,000 active installs), which was disclosed and patched on February 20 in version 2.0.3.2. The unauthenticated AJAX handler wwlc_file_upload_handler reads permitted file extensions from the attacker-controlled request, enabling arbitrary file upload of PHP files such as shell.php that report host details and serve further upload forms. Attack activity peaked between June 4 and June 17, 2026, with additional waves on July 1 and August 30. Wordfence rates the flaw CVSS 9.8, while Patchstack's CVE record lists 9.0.
- Unauthenticated AJAX action wwlc_file_upload_handler trusts an attacker-supplied allowed-extensions list
- Arbitrary file upload enables PHP webshell deployment and remote code execution
- Exploitation peaked June 4-17, 2026, with further waves on July 1 and August 30
- Owners should update to 2.0.3.2+, inspect uploads for rogue PHP, and review admin-ajax.php logs
- Wordfence firewall rule blocks known attempts but does not patch vulnerable versions
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-27540 | Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1. NVD description · AI analysis pending | 9.0 | 2% |
| — |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 2.0.3.1 | y on July 1 and August 30. All versions up to and including 2.0.3.1 are affected. Researcher Teemu Saarentaus reported the flaw |
| ipv4 | 2.0.3.2 | Authentication Bypass What Site Owners Should Do Update to 2.0.3.2 or later. A firewall rule blocks known exploit attempts but |
Full article393 words · extracted from infosecurity-magazine.com · click to collapse
Attackers have been uploading PHP webshells to WordPress sites through a critical flaw in a third-party WooCommerce plugin, four months after a fix was released.
In a technical write-up published on September 14, Wordfence said its firewall had blocked more than 100,000 exploitation attempts against CVE-2026-27540 in WooCommerce Wholesale Lead Capture, a premium plugin from Rymera Web Co with an estimated 6000 active installations. The flaw was disclosed and patched on February 20 in version 2.0.3.2.
Wordfence rated it CVSS 9.8. The CVE record, issued by Patchstack, carried a 9.0 score, a difference that turns partly on how complex the attack is judged to be. Wordfence's data shows a single unauthenticated request.
An Allowlist the Attacker Controls
The plugin exposes an AJAX action, wwlc_file_upload_handler, that handles uploads from its wholesale registration form and is reachable by unauthenticated visitors.
That handler checks a file's extension against a list of permitted types. Wordfence found the list is read straight from the request rather than from the form's server-side configuration, so an unauthenticated attacker can include php in a list of their own and upload an executable, turning an arbitrary file upload into remote code execution.
The code compounds it by calling WordPress's upload function with type checking switched off, leaving the extension check as the only barrier.
Wordfence said attackers submitted crafted requests carrying a forged settings parameter and a PHP file, often named shell.php. The resulting webshell reports host details and serves a browser-based upload form for writing further files to the site.
Exploit attempts were heaviest between June 4 and June 17, with further activity on July 1 and August 30. All versions up to and including 2.0.3.1 are affected. Researcher Teemu Saarentaus reported the flaw.
What Site Owners Should Do
Update to 2.0.3.2 or later. A firewall rule blocks known exploit attempts but does not patch the plugin, and all versions up to 2.0.3.1 remain vulnerable underneath.
Wordfence advised reviewing the uploads directory for unexpected or recently created PHP files, and checking web server access logs for requests to admin-ajax.php carrying the vulnerable action.
Anyone finding evidence should remove unexpected files and unknown administrator accounts, and review the site for backdoors.
Wordfence added that an absence of matching log entries does not prove a site is clean.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/woocommerce-wholesale-lead-capture/