WordPress stores using a WooCommerce plugin are under active attack through a high-severity vulnerability that lets bad actors gain full access with zero authentication. The issue is rooted in the Wholesale Lead Capture extension — specifically its file upload feature in the wholesale registration form — which allows anyone to upload malicious code, including dangerous PHP files, by manipulating which file types are accepted. Because the plugin trusts user-supplied parameters rather than trusting server-side settings, attackers can bypass protections and place executable payloads. Once inside, they can run commands, establish admin accounts, or use other tools to maintain access. This flaw is tracked as CVE-2026-27540 and carries a CVSS score of 9.8.
Analysis by Wordfence shows that this vulnerability affects versions up to and including 2.0.3.1 of Wholesale Lead Capture. Attempts to exploit it date back months, with particularly heavy waves between June 4–17, then again on July 1 and August 30. More than 100,000 exploit requests have been blocked so far. According to estimates, around 6,000 live sites are running the vulnerable plugin, putting a sizable number of stores at risk.
How the Exploit Works
The weakness lies in how the extension handles file uploads during the wholesale registration process. It takes the allowed file types list from HTTP requests sent by users rather than using a secure server-side list. By sending a crafted request altering that list, an attacker can convince the plugin to accept PHP files. Once a PHP file is accepted, it becomes a backdoor — attackers can do things like inspect server info, write further files, create admin accounts, or take other control actions launched via the web shell.
No WordPress user credentials are required — the attacker just needs to hit the vulnerable AJAX endpoint exposed publicly by the plugin. Normal file-type checks are bypassed, which makes this kind of vulnerability especially dangerous because it’s unauthenticated and allows code execution.
What Store Owners Must Do Now
To mitigate, update the Wholesale Lead Capture plugin to version 2.0.3.2 without delay. Also, audit all WordPress sites and staging environments for the plugin’s version history. Before deploying the patch, back up the existing site and preserve the plugin version in use — this helps with any needed forensic work later on.
After patching, store operators should search for unexpected PHP files in upload folders, review all admin accounts for unfamiliar entries, and comb through server logs for any suspicious activity — especially interactions with parameters tied to the plugin’s upload handler. Any unauthorized files found should be removed, unknown accounts disabled, privileged passwords reset, and you should check for persistent or secondary backdoors.
Prevention measures should include using server-side validation for acceptable file types, enforcing size limits, and ensuring no uploaded file can execute as code. Also, maintain trusted backups that are tested and isolated so they can be restored cleanly if an attack occurs. Recognizing unexplained server changes early — even before login alerts are triggered — can greatly reduce damage.
Indicators of compromise include specific IP addresses used in exploit attempts — for example, IPs that sent tens of thousands of blocked requests, such as 92.241.13.213 or 31.59.129.150 — and paths like /wp-admin/admin-ajax.php with request parameters like action=wwlc_file_upload_handler. The presence of files like “shell.php” may also reveal an attack.
For organizations processing orders through affected sites, keep an eye out for weird behavior on checkout pages, unknown scheduled tasks, or unexpected outbound connections. Preserve logs and suspected malicious files if a broader investigation might follow.
This vulnerability is under active abuse. Rapid patching and vigilant site monitoring are your strongest defenses. Even strong defenses like plugin scanning tools help, but cannot substitute for immediate action when a flaw is this serious.
Analysis: This exploit is a stark reminder that even popular third-party extensions can expose critical risk, especially when they allow unauthenticated code execution. With potentially thousands of active stores exposed, the threat isn’t theoretical — it’s material. What to watch now: how quickly plugin maintainers can enforce safer file validation server-side, and whether hosts will start proactively blocking PHP uploads in user-upload folders by default. Site operators should view this as another case where trust in plugin defaults without inspection is a severe liability. The next breach may well start with a flaw just like this — don’t let it happen in yours.
