A serious vulnerability in WooCommerce Wholesale Lead Capture — a premium WordPress plugin used by more than 6,000 sites — is being actively leveraged by attackers to install PHP web shells and gain remote code execution. The issue, tracked as CVE-2026-27540, carries a CVSS score of 9.8 (Critical). The flaw allows unauthenticated actors to upload arbitrary files due to weak validation in all versions up to and including 2.0.3.1. Users are urged to upgrade immediately.
How the Exploit Works
The core problem lies in the plugin’s AJAX endpoint named wwlc_file_upload_handler. The plugin uses a parameter, file_settings, to determine which file types are allowed — but attackers can manipulate this value to include dangerous extensions like “php,” bypassing file type restrictions entirely. They then submit crafted requests with malicious files (commonly shell.php) that establish a web shell providing both system details and a browser-based interface for adding further malicious files. Successful exploitation yields full remote code execution on the server.
Scale of Attack & Ongoing Threat
Wordfence reports its firewall has blocked over 100,000 attempted exploits targeting this plugin since the vulnerability was disclosed. Recent activity includes dozens of attacks per day — 99 in the last 24 hours alone. Attack parallels have spiked during specific windows: early June, July 1st, and around August 30.
Mitigation Steps
The fix was issued in version 2.0.3.2, released February 20, 2026. Plugin installations running version 2.0.3.1 or earlier are vulnerable. Users should update now.
Administrators should audit their server uploads directory for unknown or recently added PHP files, particularly in /wp-content/uploads/. Checking logs for POST requests to /wp-admin/admin-ajax.phpwith action parameter wwlc_file_upload_handlermay reveal suspicious activity. Also delete any unrecognized administrator accounts. Those using Wordfence Premium, Care, or Response had rules protecting against CVE-2026-27540 since February 27, 2026; free users got the same protections as of March 29.
Attackers behind the exploits are operating from IP addresses including 92.241.13.213; 31.59.129.150; 2a0f:85c1:840:5389::1; among others. Blocking these addresses may reduce exposure.
A related note: two similar critical vulnerabilities exist in another popular WordPress plugin, The Events Calendar, that also allow unauthenticated remote code execution via widget vulnerabilities. These too have received fixes in recent versions.
Why this matters:Even plugins with relatively modest user bases are prime targets when exploits bypass basic validation. Every WordPress site — especially e-commerce — needs constant vigilance. Running outdated plugins or underestimating response timelines only increases risk.
