Attackers Exploit Critical WooCommerce Plugin Flaw to Upload Webshells

Attackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin for WordPress to upload PHP webshells. Wordfence said its firewall blocked more than 100,000 attempts targeting CVE-2026-27540, which affects the plugin’s estimated 6,000 active installations. The flaw was disclosed and fixed on 20 February in version 2.0.3.2; all versions up to and including 2.0.3.1 are vulnerable. Wordfence rated it CVSS 9.8, while the Patchstack-issued CVE record gives it a 9.0 score. Exploitation was heaviest between 4 and 17 June, with additional activity reported on 1 July and 30 August.

The vulnerable plugin exposes an unauthenticated AJAX upload function, `wwlc_file_upload_handler`, used by the wholesale registration form. Its permitted file-extension list is taken from attacker-controlled request data, allowing an attacker to add `php` and upload an executable file. The plugin also disables WordPress’s built-in type checking, enabling remote code execution through a single unauthenticated request.

Wordfence observed attackers submitting forged settings parameters and files commonly named `shell.php`; uploaded webshells could reveal host information and provide a browser-based form for writing additional files.

Site owners should update to version 2.0.3.2 or later. Wordfence said its firewall rule blocks known attempts but does not fix the underlying vulnerability. Administrators should inspect upload directories for unexpected PHP files, review logs for requests to `admin-ajax.php` using the vulnerable action, remove suspicious files and unknown administrator accounts, and check for backdoors. An absence of matching log entries does not prove that a site is unaffected.