Hackers Exploit WooCommerce Plugin Flaw to Upload PHP Web Shells

A critical vulnerability in the WooCommerce Wholesale Lead Capture WordPress plugin is being actively exploited, according to the report and Wordfence. Tracked as CVE-2026-27540, the flaw has a CVSS v3 score of 9.0 and affects versions up to and including 2.0.3.1. The plugin is estimated to be installed on about 6,000 websites. Wordfence said its firewall had blocked more than 100,000 exploit attempts targeting the issue.

The weakness is an unauthenticated arbitrary file-upload flaw in the public `wwlc_file_upload_handler` AJAX endpoint, which processes registration attachments. The plugin’s extension check takes its permitted file-type list from request parameters supplied by the user, rather than trusted server configuration. Attackers can therefore add `php` to that list and upload a PHP web shell, potentially enabling remote code execution and server takeover. The report says exploitation has been confirmed across multiple hosting providers, although it does not provide details of specific compromised sites.

Version 2.0.3.2 fixes the vulnerability. Site administrators should update immediately and investigate for unfamiliar PHP files, particularly in the usual uploads directory, as well as repeated requests to the vulnerable AJAX handler in web-server logs. The article also warns that a successful compromise could expose customer and financial data, enable payment-skimming code, or result in administrator-account hijacking.