A critical vulnerability in WooCommerce Wholesale Lead Capture is being actively exploited by malicious actors and allows PHP web shells to vulnerable WordPress sites. The vulnerability, tracked as CVE-2026-27540, allows unauthenticated attackers to upload arbitrary files and gain complete control of the server via remote code execution. The scope of the threat is significant, as the plugin is used in more than 6,000 active installations worldwide.
Cybersecurity firm Wordfence , which specializes in WordPress security, announced that it has blocked over 100,000 attempts to exploit the vulnerability since June 2026. In the last 24 hours alone, 99 attacks were recorded , proving that the threat remains active and evolving. The vulnerability has a CVSS score of 9.8 , ranking it in the most critical risk categories.
The issue concerns a “missing file type validation” in an AJAX action called wwlc_file_upload_handler. This vulnerability affects all versions of the plugin up to 2.0.3.1, opening the way for malicious file uploads without any authentication requirements. This is a classic arbitrary file upload that can lead to a complete server compromise.
See also: FireBox RCE: Critical vulnerability in WordPress WooCommerce plugin
How Attackers Exploit WooCommerce Wholesale Lead Capture
In the attacks observed by Wordfence, malicious actors submit specially crafted requests to the AJAX action wwlc_file_upload_handler, using a forged file_settings along with a malicious PHP file , usually named shell.php. The uploaded file acts as a web shell, reporting host details and providing a browser-based form for uploading additional malicious files to the compromised site.
The attack attempts come from a variety of IP addresses, indicating organized and distributed activity.
- 92.241.13.213
- 31.59.129.150
- 2a0f:85c1:840:5389::1
- 92.241.13.140
- 23.137.105.214
- 23.180.120.140
- 104.194.9.138
- 187.75.114.36
- 114.10.43.203
- 37.114.144.209
Once an attacker manages to upload a PHP backdoor, they gain essentially full access to the server: they can execute commands, steal data, install ransomware , or use the server as a base for further attacks on other systems. The absence of any login requirement makes the vulnerability particularly dangerous, as anyone can exploit it without credentials.
WordPress site administrators using WooCommerce Wholesale Lead Capture should immediately check for suspicious or newly created .php files , especially in the uploads directory . It is also recommended to review the logs for suspicious requests to /wp-admin/admin-ajax.php with the action parameter set to wwlc_file_upload_handler . Updating the plugin to the latest version immediately is absolutely necessary.
See also: CVE-2026-15369: Critical WooCommerce vulnerability grants administrator privileges
Critical WooCommerce and The Events Calendar Vulnerabilities: Double Threat
Alongside the WooCommerce Wholesale Lead Capture, Wordfence has uncovered two additional critical vulnerabilities affecting The Events Calendar, one of the most popular WordPress plugins with over 600,000 active installations. These vulnerabilities, tracked as CVE-2026-78159 and CVE-2026-78006, both have a CVSS score of 9.8.
CVE -2026-78159 results from insufficient validation of the widget 'classes' map in the parse_array function and affects versions up to 6.17.3 . CVE-2026-78006 concerns insufficient protection in the is_safe_widget_instance function and affects versions up to 6.17.4 . Both vulnerabilities can lead to unauthenticated remote code execution.
According to Wordfence, both attack chains start in the plugin's widget-rendering pipeline . The first chain uses PHP Object Injection to execute arbitrary operating system commands on the underlying server. The second chain bypasses object injection protection and abuses an arbitrary-callable primitive to reset an administrator's password, which then allows the attacker to upload a malicious plugin and gain full control of the site.
Successful exploitation could lead to a complete site takeover, theft of sensitive data, and malware. StellarWP, the company that develops the plugin, has addressed the vulnerabilities in versions 6.17.3.1 and 6.17.4.1 respectively.
See also: WebToffee WooCommerce: New vulnerability allows reading files
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
These vulnerabilities once again highlight the importance of regularly updating WordPress pluginsand implementing least access principles. Using a Web Application Firewall (WAF), such as the one provided by Wordfence, can prevent many of these attacks, even before the official update is applied. In addition, regularly monitoring server logs and using malware detection tools are essential security practices for any WordPress administrator.
Source: thehackernews.com
