WooCommerce Wholesale Lead Capture Plugin Exploited for PHP Backdoor – CVE‑2026‑27540

WordPress sites using the WooCommerce Wholesale Lead Capture premium plugin are under fire. A newly disclosed vulnerability (CVE‑2026‑27540) lets attackers upload PHP files without authentication, effectively installing a webshell that can execute any code on the host.

How the Exploit Works

• The flaw centers on an unauthenticated AJAX action named wwlc_file_upload_handler.
• It checks the file type against an allowlist supplied by the attacker via the file_settings parameter.
• By injecting php into that list, the plugin accepts a .php upload and stores it in the site’s upload directory.
• The attacker then uses the uploaded shell to gather host information and upload additional malicious files.

Attack Volume

Wordfence’s WAF recorded more than 100,000 exploitation attempts. Peaks were noted on June 4‑17, July 1, and August 30, with a single IP address responsible for tens of thousands of requests.

Mitigation Steps

• Upgrade to plugin version 2.0.3.2 or later (released February 20).
• Add the high‑offender IPs to your firewall blocklist.
• Scan the upload directories for newly created .php files.
• Review wp‑admin/admin‑ajax.php logs for calls to wwlc_file_upload_handler.
• Audit user accounts and remove any unknown administrators.
• If a compromise is confirmed, restore the site from a known‑good backup and re‑apply the patch.

"The uploaded shell reports host details and provides a browser‑based upload form for writing additional malicious files to the site," Wordfence explains.

Bottom Line

WooCommerce users should act fast. The flaw is straightforward to exploit but can lead to full site takeover. Keeping the plugin current, hardening file uploads, and monitoring for suspicious activity are the best defenses against this threat.