Exploit / PoChighExploited in the wild

CVE-2026-27540 WooCommerce Flaw Exploited

SOCRadarby ameerSep 16, 2026 · 11:49 UTC (Sep 16, 2026)2 · 1 read

AI summary · glm-5.3-flashSummaries by Vani AI

Attackers are actively exploiting CVE-2026-27540, a critical arbitrary file-upload flaw in the WooCommerce Wholesale Lead Capture WordPress plugin.

Attackers are actively exploiting CVE-2026-27540 in the WooCommerce Wholesale Lead Capture plugin for WordPress. The critical arbitrary file-upload vulnerability lets attackers place malicious files on vulnerable sites, typically enabling webshell deployment or code execution. WordPress sites running the plugin should update immediately.

Key facts

CVE-2026-27540 is a critical arbitrary file-upload vulnerability
Affects the WooCommerce Wholesale Lead Capture plugin for WordPress
Exploitation has been observed in the wild
Successful upload can lead to site compromise

Analyze CVE-2026-27540 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2026-27540

ATT&CK: T1190 Exploit Public-Facing Application T1505.003 Web Shell

Tags: exploitation file-upload plugin woocommerce wordpress

Vendors: WooCommerce
Products: WooCommerce Wholesale Lead Capture WordPress

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-27540	Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd	9.0	3%	PoC	Mar 19, 2026

From the original article

CVE-2026-27540 WooCommerce Flaw Exploited Attackers are actively exploiting CVE-2026-27540 , a critical arbitrary file-upload vulnerability in the WooCommerce Wholesale Lead Capture plugin for WordPress. The flaw allows

SOCRadar

By ameer · socradar.io

Read the full article at SOCRadar

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.