Full Report
Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs. "This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution," Wordfence said. The WordPress security company said it has blocked over
Analysis Summary
# Vulnerability: Unauthenticated Arbitrary File Upload in WooCommerce Wholesale Lead Capture
## CVE Details
- **CVE ID:** CVE-2026-27540
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-434 (Unrestricted Upload of File with Dangerous Type)
## Affected Systems
- **Products:** WooCommerce Wholesale Lead Capture (Premium WordPress plugin)
- **Versions:** All versions up to, and including, 2.0.3.1
- **Configurations:** Systems utilizing the `wwlc_file_upload_handler` AJAX action.
## Vulnerability Description
The vulnerability stems from a lack of file type validation within the `wwlc_file_upload_handler` AJAX action. Attackers can send crafted requests to `admin-ajax.php` with a forged `file_settings` parameter. Because the plugin fails to verify the extension or content of the uploaded file, unauthenticated users can upload malicious scripts (such as PHP backdoors) directly to the server.
## Exploitation
- **Status:** Exploited in the wild. Wordfence reported over 100,000 blocked attempts since June 2026.
- **Complexity:** Low
- **Attack Vector:** Network (Unauthenticated Remote Code Execution)
## Impact
- **Confidentiality:** High (Full access to site data and server files)
- **Integrity:** High (Ability to modify site content and inject malicious code)
- **Availability:** High (Ability to delete files or take the server offline)
## Remediation
### Patches
- Users should update the plugin to the latest version (greater than 2.0.3.1) immediately.
### Workarounds
- Disable the plugin until a patch is applied.
- Implement Web Application Firewall (WAF) rules to block requests to `admin-ajax.php` containing the `wwlc_file_upload_handler` action from untrusted sources.
## Detection
- **Indicators of Compromise (IoCs):**
- Presence of `shell.php` or other unexpected `.php` files in the `/wp-content/uploads/` directory.
- Log entries showing requests to `/wp-admin/admin-ajax.php` with the parameter `action=wwlc_file_upload_handler`.
- **Known Attacking IPs:**
- 92.241.13.213
- 31.59.129.150
- 92.241.13.140
- 23.137.105.214
- 104.194.9.138
- 187.75.114.36
## References
- **Vendor Advisory:** hxxps[://]www[.]wordfence[.]com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-woocommerce-wholesale-lead-capture-plugin/
- **News Coverage:** hxxps[://]thehackernews[.]com/2026/09/attackers-exploit-woocommerce-wholesale.html