Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

Threat actors are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin that lets unauthenticated attackers upload malicious PHP files and potentially seize full control of vulnerable WordPress sites.

The vulnerability , tracked as CVE-2026-27540, affects plugin versions 2.0.3.1 and earlier and has received a CVSS severity score of 9.8 out of 10.

The vulnerability was publicly disclosed on February 20, 2026, and impacts an estimated 6,000 active installations.

Site administrators are urged to update immediately to WooCommerce Wholesale Lead Capture version 2.0.3.2, which contains the security fix.

WooCommerce Wholesale Lead Capture is a premium WordPress extension designed to help online stores collect and manage wholesale-registration applications.

Its functionality includes configurable registration forms, approval workflows, lead management, automated email notifications, customer-role assignment, and optional file-upload fields for business documents and similar materials.

The security issue exists in the plugin’s unauthenticated AJAX upload handler, wwlc_file_upload_handler.

In affected releases, the handler accepts a file_settings parameter from the incoming request and uses the user-supplied value to determine which file extensions are permitted.

Although the code attempts to restrict uploads to approved file types, it does not reliably retrieve that allowlist from server-side form configuration.

Instead, an attacker can submit a forged request containing an attacker-controlled configuration that explicitly permits the php extension.

The plugin subsequently processes the upload with MIME-type validation disabled, allowing the malicious file to be written to the server.

This weakness gives an unauthenticated remote attacker a path to upload a PHP webshell, then execute arbitrary commands by accessing the uploaded file through a browser.

Wordfence added the issue to its vulnerability, intelligence database on February 25 and has since blocked more than 100,000 exploit attempts targeting exposed sites.

The result can be full remote code execution without needing a valid WordPress account, administrator privileges, or interaction from a site user.

WooCommerce Plugin Vulnerability

Observed exploit traffic targets WordPress’s standard wp-admin/admin-ajax.php endpoint and invokes the vulnerable wwlc_file_upload_handler action.

Attackers submit a multipart form request with a manipulated file_settings value, such as an allowlist containing php and a deliberately inflated maximum file size, alongside a file named shell.php.

The uploaded payloads include compact PHP backdoors capable of exposing host details and presenting browser-based upload functionality.

Such a webshell can become an initial foothold for a broader compromise, allowing operators to plant additional malware, steal application data, modify storefront content, create rogue administrator accounts, or deploy spam and phishing infrastructure.

Wordfence telemetry indicates that exploitation began rapidly and continued for months after disclosure.

A substantial spike in blocked requests was recorded between June 4 and June 17, with further bursts observed on July 1 and August 30.

The most active sources reportedly included 92.241.13.213 and 31.59.129.150, each responsible for more than 24,000 blocked requests, followed by the IPv6 address 2a0f:85c1:840:5389::1 with more than 16,000 blocked requests.

The vendor addressed the vulnerability in WooCommerce Wholesale Lead Capture version 2.0.3.2. Administrators should verify the installed plugin version, apply the update, and review their environments for signs of prior compromise.

Sites protected by Wordfence Premium, Care, and Response received a firewall rule for known exploit attempts on February 27, 2026. Wordfence free users received the same protection on March 29 under the provider’s delayed rule-release model.

Firewall coverage is valuable, but it should not be treated as a replacement for removing the vulnerable code through patching.

Administrators should also inspect WordPress upload directories, plugin-specific temporary upload paths, and web-server logs for suspicious .php files or unusual POST requests to admin-ajax.php using the wwlc_file_upload_handler action.

Any unauthorized PHP file should be treated as a potential compromise indicator and investigated before deletion, with credentials, WordPress salts, API keys, and payment-related secrets rotated where exposure is suspected.

The incident illustrates a recurring WordPress security failure: client-controlled validation data must never determine whether a server accepts executable content.

Upload restrictions need to be enforced from trusted server-side configuration, with strict extension and MIME validation, randomized non-executable storage locations, and web-server rules that prevent PHP execution in upload directories.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.