Software & Platforms

Active Exploitation Hits WooCommerce Wholesale Lead Capture CVE-2026-27540

Unauthenticated file upload CVE-2026-27540 in WooCommerce Wholesale Lead Capture is under active exploitation. Update to 2.0.3.2 and inspect uploads.

E-commerce 4 Internet Marketers Editorial

Office security analyst reviewing WordPress upload logs on dual monitors at dusk
Illustration of an office analyst checking late-day WordPress upload and admin-ajax logs after a wholesale plugin alert.

By E-commerce 4 Internet Marketers Editorial

Wordfence reports that attackers are actively exploiting CVE-2026-27540, a critical unauthenticated arbitrary file-upload flaw in the WooCommerce Wholesale Lead Capture premium plugin for WordPress. In coverage republished from Wordfence’s September 2026 advisory and confirmed by BleepingComputer and The Hacker News, Wordfence says its firewall has blocked more than 100,000 exploit attempts targeting the bug, with attack spikes between June 4 and June 17, 2026, and further spikes on July 1 and August 30.

Wholesale and B2B regulated merchants often run lead-capture plugins on the same WordPress install that hosts checkout. A PHP webshell on that host can steal order data, plant payment skimmers, create rogue administrators, and trigger processor forensic reviews.

What is vulnerable

CVE-2026-27540 affects WooCommerce Wholesale Lead Capture versions 2.0.3.1 and earlier. Wordfence rates the issue 9.8 (Critical). Security researcher Teemu Saarentaus is credited with the finding. The vendor fixed the flaw in version 2.0.3.2, released on February 20, 2026, according to BleepingComputer and Wordfence’s vulnerability summary.

The plugin is a premium wholesale registration tool with file-upload fields on the registration form. Wordfence estimates about 6,000 active installs. Premium distribution means many sites will not see an automatic WordPress.org update prompt and must update through the vendor’s channel.

How the flaw works (high level)

Wordfence’s advisory describes an unauthenticated AJAX action, wwlc_file_upload_handler, reachable by visitors. The handler compares the uploaded file’s extension against an allowlist. In vulnerable versions, that allowlist comes from a user-controlled file_settings request parameter rather than a server-side form configuration. An attacker can include php in the forged allowlist and upload a .php webshell.

Observed attack traffic, per Wordfence, posts to /wp-admin/admin-ajax.php with action=wwlc_file_upload_handler, a forged file_settings JSON blob, and a malicious shell.php payload. The uploaded shell reports host details and presents a browser upload form for dropping additional files. This article does not reproduce exploit steps beyond what is needed to understand triage.

Active exploitation timeline

Wordfence says it added the vulnerability to Wordfence Intelligence on February 25, 2026. Premium, Care, and Response firewall customers received a blocking rule on February 27, 2026. Free Wordfence users received the same rule 30 days later, on March 29, 2026.

Despite that patch window, exploitation continued for months. Wordfence reports more than 100,000 blocked attempts since public disclosure, including recent 24-hour counts cited in September 2026 secondary reporting (those rolling totals change as new telemetry arrives). Top offending source addresses published by Wordfence for administrator blocklists include 92.241.13.213, 31.59.129.150, 2a0f:85c1:840:5389::1, 92.241.13.140, 23.137.105.214, 23.180.120.140, 104.194.9.138, 187.75.114.36, 114.10.43.203, and 37.114.144.209.

Why high-risk WooCommerce stores should treat this as checkout risk

A webshell on a wholesale lead-capture site is not only a content-integrity problem. The same WordPress database and filesystem often hold order records, customer PII, gateway tokens or plugin settings, age-verification artifacts, and admin sessions. For CBD, supplements, telehealth-adjacent, nicotine, or other regulated catalogs, a compromise can force chargeback spikes, card-brand inquiries, and MID holds even when the attacker never touches the payment page directly.

B2B wholesale lead forms are attractive because they sit on public endpoints and are less monitored than checkout. Operators who layered Wholesale Lead Capture onto a production store with weak staging or backup discipline face a longer recovery path if PHP files were written under uploads.

What operators should do now

  1. Confirm whether WooCommerce Wholesale Lead Capture is installed. If it is, update to 2.0.3.2 or later immediately through the vendor’s update path.
  2. Do not treat a Wordfence firewall rule as a substitute for patching. Wordfence itself says sites should still update to maintain normal functionality.
  3. Search the uploads directory (and other writable paths) for unexpected or recently created .php files, including names such as shell.php.
  4. Review web server access logs for requests to /wp-admin/admin-ajax.php with action=wwlc_file_upload_handler, especially from the published high-volume IPs.
  5. Audit administrator users, scheduled tasks, must-use plugins, and theme/plugin file modification dates. If compromise is confirmed, Wordfence recommends restoring from a known-good backup rather than attempting piecemeal cleanup alone.
  6. After remediation, rotate secrets that lived on the host (WordPress salts if warranted, gateway API keys, SMTP credentials) and retest checkout on staging before trusting production settlement.

Closing

CVE-2026-27540 in WooCommerce Wholesale Lead Capture (fixed in 2.0.3.2) is an unauthenticated file-upload path that attackers have used to drop PHP webshells, with Wordfence reporting more than 100,000 blocked attempts since mid-2026 spikes. Wholesale and regulated WooCommerce operators should patch immediately, hunt for unexpected PHP in uploads, and treat any confirmed webshell as a full-host incident that can spill into payments and underwriting.

Sources