Attackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin for WordPress, with Wordfence saying it has already blocked more than 100,000 exploit attempts. The flaw, tracked as CVE-2026-27540, can let unauthenticated attackers upload arbitrary files, including PHP webshells, and potentially take over affected sites.
What the WooCommerce Wholesale Lead Capture flaw does
The issue affects WooCommerce Wholesale Lead Capture, a premium plugin used to add a wholesale registration form and file upload support. Wordfence says the vulnerability exists in versions up to and including 2.0.3.1 and carries a CVSS score of 9.8, placing it in the critical range.
According to the disclosure, the problem is an unauthenticated arbitrary file upload caused by missing file type validation. Because the plugin exposes an AJAX handler called wwlc_file_upload_handler to visitors who are not logged in, attackers can reach the upload routine directly.
How the bypass works
The plugin does check the uploaded file’s extension against a list of permitted types, but Wordfence says that list is taken from a request parameter instead of trusted server-side settings. That means an attacker can supply a forged list that includes php, then upload a file with a .php extension.
Once a malicious PHP file lands on the server, it may be executed by the web server. From there, an attacker could create administrator accounts, steal data, plant backdoors, or otherwise gain full control of the WordPress site.
Attack activity has already been observed
Wordfence says its firewall has blocked more than 100,000 attempts to exploit the flaw since public disclosure. The company also says exploitation has been underway for months, with especially heavy activity recorded between June 4 and June 17, as well as on July 1 and August 30.
To protect customers, Wordfence Premium, Wordfence Care, and Wordfence Response users received a blocking rule on February 27, 2026. Sites using the free version of Wordfence received the same protection 30 days later, on March 29, 2026.
Examples of malicious requests
In the attack data shared by Wordfence, threat actors submit a multipart request to /wp-admin/admin-ajax.php with the action set to wwlc_file_upload_handler. The forged file_settings field includes php as an allowed file type, and the uploaded file is named something like shell.php.
The example payload shown in the advisory includes a PHP webshell that prints host information and provides a browser-based upload form for writing additional files to the server. That kind of tool can make post-compromise activity much easier for an attacker.
Who is affected
The advisory describes WooCommerce Wholesale Lead Capture as a plugin with an estimated 6,000 active installations. Wordfence lists the patched version as 2.0.3.2, and says that version is the one site owners should be running.
Teemu Saarentaus is credited as the researcher behind the disclosure.
- Affected versions: WooCommerce Wholesale Lead Capture 2.0.3.1 and earlier
- Patched version: 2.0.3.2
- CVE: CVE-2026-27540
- Severity: Critical, CVSS 9.8
What site owners should do now
Wordfence urges users to update to the latest patched release of WooCommerce Wholesale Lead Capture as soon as possible, even if firewall protection is already in place. Security rules can block known exploit patterns, but they do not replace a software update.
Because successful exploitation can leave behind a PHP file on the server, administrators should also look for unexpected or recently created .php files, especially in upload directories. Wordfence says filenames like shell.php have appeared in observed attacks, though other names are possible.
It also recommends reviewing web server access logs for requests to /wp-admin/admin-ajax.php with the wwlc_file_upload_handler action, particularly if traffic originated from the IP addresses identified in the advisory.
Signs of compromise to check
- Unexpected PHP files in uploads or other writable directories
- Unknown administrator accounts
- Suspicious requests to
admin-ajax.phpusingwwlc_file_upload_handler - Backdoors or other files that were not placed there by your team
Wordfence notes that the absence of suspicious log entries does not prove a site is clean. If there is any sign of compromise, the advice is to remove unknown files, delete unauthorized admin accounts, and inspect the site for persistence mechanisms or backdoors.
Why this vulnerability matters
Arbitrary file upload bugs are among the most dangerous WordPress plugin flaws because they can turn a simple form submission into remote code execution. In this case, the attacker does not need an account, and the vulnerable handler can be reached from the public internet.
Given the number of blocked attempts already seen, this is not a theoretical problem. Site owners running the affected plugin should treat it as an active incident, not just a routine update item.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More WordPress & CMS Tech News
Last Modified: September 15, 2026 at 10:32 pm
0 views
