WordPress site owners using WooCommerce Wholesale Lead Capture should treat the latest exploitation reports as an urgent incident-response trigger, not just a routine plugin update notice. Attackers are actively abusing a critical arbitrary file upload vulnerability in the premium plugin to place PHP web shells on affected servers, creating a direct path to remote code execution and long-term site compromise.
The issue is tracked as CVE-2026-27540 and carries a critical CVSS score of 9.8. According to reporting based on Wordfence observations, the vulnerable component is an AJAX upload handler in WooCommerce Wholesale Lead Capture. The affected versions include all releases up to and including 2.0.3.1. Because exploitation does not require authentication, any internet-facing WordPress site running a vulnerable version should be considered exposed.
What is being exploited
The vulnerability stems from missing file type validation in the plugin’s wwlc_file_upload_handler AJAX action. In practical terms, the handler can be manipulated to accept files that should never be uploaded through a public-facing workflow, including executable PHP files. Once a PHP file lands in a web-accessible location, an attacker may be able to call it directly from a browser and execute code on the server.
That is why arbitrary file upload bugs in WordPress plugins often escalate quickly from “upload problem” to full site takeover. A small PHP web shell can provide an attacker with host information, a file upload form, command execution helpers, or a staging point for additional malware. From there, the intruder may modify themes, add backdoor administrator accounts, inject SEO spam, harvest customer data, or pivot deeper into the hosting environment.
Wordfence reportedly observed attackers sending crafted requests to the vulnerable AJAX action with manipulated upload settings and a malicious file commonly named shell.php. The campaign has already generated a large volume of blocked attempts, making this an active exploitation case rather than a theoretical proof of concept.
Why e-commerce sites are high-value targets
WooCommerce sites are attractive because they combine public exposure, customer trust, and business-critical data. Even when payment processing is delegated to a third-party gateway, a compromised store can still leak names, addresses, emails, order history, session cookies, discount logic, API keys, and administrative credentials. Attackers can also modify checkout pages, insert malicious JavaScript, redirect customers to phishing pages, or use the domain’s reputation to distribute malware.
Wholesale lead capture functionality can be especially sensitive because it often handles business registration details and may be enabled on sites that support B2B purchasing workflows. If an attacker compromises the underlying WordPress installation, the impact can extend beyond the plugin itself to the entire store and its connected systems.
Immediate actions for site owners
First, identify whether WooCommerce Wholesale Lead Capture is installed and confirm the exact version. If the installed version is 2.0.3.1 or older, remove or disable it immediately if a fixed version is not already available in your environment. Do not rely only on the absence of visible defacement; web shells are typically designed to stay quiet.
Next, review the WordPress uploads directory and other writable paths for unexpected PHP files. PHP files generally should not appear inside normal media upload folders. Pay particular attention to recently created files, unfamiliar filenames, and files with minimal code that reference upload functions, system information, encoded strings, or form-based file writers.
Administrators should also inspect access logs for requests to wp-admin/admin-ajax.php where the action parameter is set to wwlc_file_upload_handler. Reported attack infrastructure includes the IP addresses 92.241.13.213, 31.59.129.150, 2a0f:85c1:840:5389::1, 92.241.13.140, 23.137.105.214, 23.180.120.140, 104.194.9.138, 187.75.114.36, 114.10.43.203, and 37.114.144.209. These indicators are useful for triage, but defenders should not assume the campaign is limited to that list.
Hardening and detection tips
If you run WordPress at scale, consider adding a server-side control that prevents PHP execution in upload directories. On Apache and Nginx, this can often be enforced at the virtual host or directory level. This mitigation does not fix the plugin flaw, but it can reduce the blast radius of future upload bugs.
Security teams should also verify file integrity for WordPress core, themes, and plugins; rotate credentials for WordPress administrators and hosting panels if compromise is suspected; and review scheduled tasks, newly created users, modified theme files, and unknown plugins. A web application firewall can help block commodity exploitation, but it should complement patching and cleanup rather than replace them.
Backups are useful only if they predate the compromise and can be restored safely. Before restoring, capture forensic evidence where possible, preserve relevant logs, and determine whether the attacker changed database content or added persistence outside the web root. For stores processing customer information, legal and regulatory notification requirements may also apply depending on the data exposed.
Related WordPress plugin risk
The same reporting also highlights critical remote code execution issues in The Events Calendar plugin, a widely deployed WordPress plugin. Those vulnerabilities have separate prerequisites and fixes, but they reinforce the broader lesson: WordPress risk is often concentrated in third-party extensions. Site owners should maintain a live inventory of plugins, remove unused components, monitor vendor advisories, and prioritize emergency updates for flaws that are unauthenticated, remotely exploitable, or already being attacked.
For QloudBlog readers managing WooCommerce deployments, the practical takeaway is simple: check for the vulnerable plugin today, hunt for PHP files where they do not belong, and treat suspicious upload activity as a potential compromise.
Source: The Hacker News