Attackers are actively exploiting a critical vulnerability in the premium WooCommerce Wholesale Lead Capture plugin to compromise WordPress sites and gain full control of the underlying server.
The flaw, identified as CVE-2026-27540 and rated CVSS 9.8, permits unauthenticated file uploads. Attackers can plant a PHP web shell and execute arbitrary commands remotely. The issue impacts all installations running version 2.0.3.1 and earlier.
The technical vector centers on the publicly accessible AJAX endpoint wwlc_file_upload_handler. This handler validates file extensions against an allowlist that an attacker can override by manipulating the file_settings parameter, enabling PHP files to be accepted. Once uploaded, the shell can be executed directly from the browser to deploy additional payloads, steal credentials, or establish persistence.
Telemetry shows more than 100,000 exploitation attempts blocked since June 2026, with notable spikes between 4–17 June, on 1 July, and on 30 August. Multiple repeat IP addresses have generated tens of thousands of requests, consistent with automated scanning campaigns targeting vulnerable sites across the internet.
The developer published WooCommerce Wholesale Lead Capture 2.0.3.2 on 20 February 2026. Sites that cannot update immediately should disable or remove the plugin. Administrators must also scan wp-content/uploads for unexpected or recently created .php files and review logs for requests to /wp-admin/admin-ajax.php with the action wwlc_file_upload_handler.
Additional defensive measures include deploying WAF rules to block malicious uploads via admin-ajax.php and monitoring for repeated failed or successful requests from the same sources. In cases of confirmed intrusion, simply deleting a single file is insufficient; unknown administrator accounts should be removed, credentials rotated, and the site restored from a verified clean backup after hardening.
