ATTACKERS are actively exploiting a critical arbitrary file-upload vulnerability in Rymera Web Co Pty Ltd’s WooCommerce Wholesale Lead Capture WordPress plugin. Tracked as CVE-2026-27540 and rated 9.0 (Critical) under CVSSv3, the flaw affects all versions up to and including 2.0.3.1. The plugin is estimated to run on about 6,000 WordPress websites, although the article does not confirm how many have been compromised.
The vulnerable `wwlc_file_upload_handler` AJAX endpoint is publicly accessible and processes registration attachments without adequate server-side file-type validation. Although the plugin attempts to enforce an allowed-extension list, that list is taken from attacker-controlled request parameters. Unauthenticated attackers can therefore add `php` to the list and upload executable PHP files, including webshells, potentially enabling server takeover. Wordfence said its firewall had blocked more than 100,000 exploit attempts, and researchers reported exploitation across multiple hosting providers.
Version 2.0.3.2 fixes the issue, and administrators should update immediately. Site operators should also inspect website directories, particularly the standard uploads directory, for unfamiliar PHP files such as `shell.php`, and review web-server logs for repeated requests to the vulnerable AJAX handler.