Attackers Exploit Woo Commerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
Summary: Threat actors are exploiting CVE-2026-27540, a critical arbitrary file upload flaw (CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin, which has more than 6,000 active installs and is affected in all versions up to and including 2.0.3.1. Wordfence said it has blocked over 100,000 exploit attempts since June 2026, with attackers submitting crafted requests to the "wwlc_file_upload_handler" AJAX action carrying a forged file_settings parameter and a malicious PHP file that acts as a web shell.
What's compelling: An unauthenticated attacker needs no credentials to upload a PHP backdoor and take remote code execution on any unpatched site running this plugin, and Wordfence logged 99 attempts in a single 24-hour window. Site owners should check the uploads directory for unexpected .php files and review requests to /wp-admin/admin-ajax.php with the wwlc_file_upload_handler action.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-27540
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026