Attackers are actively exploiting a critical security vulnerability in the WooCommerce Wholesale Lead Capture plugin, a premium WordPress extension used by online stores to manage wholesale customer registrations. The flaw is tracked as CVE-2026-27540 and has a CVSS score of 9.8, placing it in the critical category. The plugin has more than 6,000 active installations, which means a large number of websites could potentially be exposed if they are still running an affected version of the plugin.
The main problem is an unauthenticated arbitrary file upload vulnerability that allows attackers to upload files to a vulnerable WordPress website without needing to log in. The issue affects WooCommerce Wholesale Lead Capture versions up to and including 2.0.3.1. Researchers found that the plugin’s AJAX upload function, called wwlc_file_upload_handler, does not properly validate the types of files that can be uploaded. Because of this weakness, attackers can manipulate the upload process and make the website accept files that should normally be blocked.
According to security researchers, attackers are abusing the vulnerable upload function to send specially crafted requests containing a modified file_settings parameter. This parameter can be manipulated to allow PHP files, which can then be uploaded to the targeted website. In observed attacks, threat actors have uploaded a malicious file named shell.php. The file works as a PHP web shell that can provide information about the compromised server and also give the attacker a way to upload additional malicious files to the website.
The activity has already reached a significant scale. Wordfence reported that its security systems have blocked more than 100,000 attempts to exploit CVE-2026-27540 since June 2026, including 99 attempts during a recent 24-hour period. Researchers also observed noticeable increases in attack activity between June 4 and June 17, followed by additional spikes on July 1 and August 30. These numbers show that attackers are actively scanning websites for vulnerable installations and attempting to take advantage of sites that have not yet been updated.
The vulnerability was fixed in version 2.0.3.2 of WooCommerce Wholesale Lead Capture, which was released on February 20, 2026. However, the continued exploitation shows that many websites may still be running older versions. Website administrators using this plugin should update to version 2.0.3.2 or a newer release. They should also check their websites for unexpected PHP files, particularly recently created files in upload directories, and review server logs for suspicious requests involving the wwlc_file_upload_handler action.
Security teams should also look for unknown administrator accounts or other unexpected changes because a successful attack can provide attackers with a foothold inside the website. Simply removing one malicious file may not be enough if additional backdoors or persistence mechanisms were created after the initial compromise. If a website is confirmed to have been compromised, restoring it from a known-clean backup may be necessary. The incident is another reminder that third-party WordPress plugins can become a serious security risk when they contain vulnerabilities and are left unpatched.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
