55
60
60
60
60
47
42
60
Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors
Attackers actively exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture plugin to upload PHP webshells; patch shipped in version 2.0.3.2.
CVE-2026-27540 (CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin affects versions 2.0.3.1 and earlier across roughly 6,000 active installations. The unauthenticated AJAX handler wwlc_file_upload_handler trusts a client-supplied file_settings allowlist, letting attackers upload shell.php for remote code execution. Wordfence has blocked more than 100,000 exploit attempts since disclosure, with spikes in June, July, and August 2026. The vendor fixed the flaw in version 2.0.3.2.
75
42
55
60
55
60
60
Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin
Attackers are actively exploiting an unauthenticated arbitrary file upload flaw in the WooCommerce Wholesale Lead Capture plugin, enabling PHP backdoors and remote code execution.
A critical unauthenticated arbitrary file upload vulnerability in WooCommerce Wholesale Lead Capture, a premium WordPress plugin with an estimated 6,000 active installations, was publicly disclosed on February 20, 2026. Wordfence reports attackers are now actively exploiting the flaw to upload arbitrary files, including PHP backdoors, and achieve remote code execution. No CVE ID was cited in the report.
65
60
[webapps] WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload
An unauthenticated arbitrary file upload exploit was released for a WooCommerce component version 1.5.0, risking site compromise.
Exploit-DB published exploit #52642 targeting WooCommerce 1.5.0. The flaw allows unauthenticated arbitrary file uploads, which can lead to remote code execution on affected web servers. The disclosure text does not report exploitation in the wild.
23
47
60
60
60
60
60
57
47
45
60
60
Network Security Trends: August
60
42
30
55
30
42
60
60
57
Hackers expose donor data from Russian fundraisers for Ukrainians, political prisoners
Hackers breached the Stripe-WooCommerce integrations of Russian fundraisers Davayte and You Are Not Alone, exposing donor emails and partial card details.
Unknown hackers accessed the payment accounts of two Russian fundraising projects, Davayte and You Are Not Alone, in mid-August via a shared Stripe-WooCommerce integration used to run online auctions. Exposed data included donor email addresses and, in some cases, the last four digits of payment cards and issuing bank names; full card numbers, cardholder names, and donation details were not taken. Stripe blocked the unauthorized access before the entire donor email database could be downloaded and found no evidence of fraudulent transactions. Attribution remains unclear, with organizers unable to rule out Russian security services; both groups are designated 'undesirable' organizations in Russia, making donor identities sensitive, and a separate alleged leak of data from 669 Stripe merchants by a hacker named 'Satanic' has no confirmed connection.
50
55