ATTACKERS have been exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture WordPress plugin to upload PHP webshells, despite a fix being released four months earlier. In a technical write-up published on 14 September 2026, Wordfence said its firewall had blocked more than 100,000 attempts targeting CVE-2026-27540. The premium plugin, developed by Rymera Web Co, has an estimated 6,000 active installations. The flaw was disclosed and fixed in version 2.0.3.2 on 20 February. Wordfence rated it CVSS 9.8, while the Patchstack-issued CVE record gives it a 9.0 score.
The vulnerable `wwlc_file_upload_handler` AJAX action accepts unauthenticated uploads from the wholesale registration form. Wordfence found that attackers can supply their own permitted-file list, add `php` to it and upload an executable file. The plugin also disables WordPress’s type checking, allowing the uploaded webshell to run and potentially provide remote code execution. Observed attacks commonly used a forged settings parameter and a file named `shell.php`. Exploitation was heaviest from 4–17 June, with further activity on 1 July and 30 August. All versions up to and including 2.0.3.1 are affected.
Site owners should update to version 2.0.3.2 or later. Wordfence recommends checking upload directories for unexpected PHP files, reviewing logs for requests to `admin-ajax.php` involving the vulnerable action, removing suspicious files and unknown administrator accounts, and looking for backdoors. A firewall rule can block known attempts but does not fix the underlying vulnerability; missing log entries do not prove that a site is unaffected.