CVE-2026-275409.0CriticalCWE-434
WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability
Rymera Web Co Pty Ltd. · Woocommerce Wholesale Lead Capture
Not in CISA KEV
2.7%probability of exploitation in the next 30 days
85th percentile
050100
Higher than 85% of scored CVEs
9.0CriticalCVSS 3.1
LowMediumHighCrit.
DescriptionNVD
Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1.
Coverage3 articles · 3 outlets
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 15 Sep.
Quiet for 6 weekslast report 16 Sep3 articles3 outlets
- Tue 15 Sep, 02:21 UTC. SecurityOnline, first report. Hackers Exploit WooCommerce Plugin Flaw to Upload PHP Web Shells.
- Wed 16 Sep, 14:51 UTC. SOCRadar, its first report on the story. Attackers Exploit WooCommerce Plugin Flaw to Upload PHP Web Shells.
- Wed 16 Sep, 15:27 UTC. Infosecurity, its first report on the story. Attackers Exploit Critical WooCommerce Plugin Flaw to Upload Webshells.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 15 Sep 02:21 | SecurityOnline | Hackers Exploit WooCommerce Plugin Flaw to Upload PHP Web Shells |
| 16 Sep 14:51 | SOCRadar | Attackers Exploit WooCommerce Plugin Flaw to Upload PHP Web Shells |
| 16 Sep 15:27 | Infosecurity | Attackers Exploit Critical WooCommerce Plugin Flaw to Upload Webshells |
- Hackers Exploit WooCommerce Plugin Flaw to Upload PHP Web ShellsSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.