Cybersecurity experts are sounding the alarm after hackers began exploiting a critical vulnerability in a popular WooCommerce plugin for WordPress, leaving thousands of websites potentially exposed to takeover.
The vulnerability, tracked as CVE-2026-27540, affects older versions (2.0.3.1 and below) of the WooCommerce Wholesale Lead Capture premium plugin, which is used by many online stores to manage their wholesale business. An attacker can exploit this flaw to upload a PHP webshell and execute code on the affected site, potentially leading to a complete compromise.
The issue lies in an unauthenticated AJAX action named wwlc_file_upload_handler, which allows uploading files with specific extensions. However, when an attacker manipulates the file settings request parameter, they can add ‘php’ to the allowed list of file types, effectively allowing them to upload executable PHP files. This is a classic example of a file inclusion vulnerability, where an attacker injects malicious code that is then executed by the server.
Security company Defiant, which operates the Wordfence web application firewall (WAF), has reported blocking over 100,000 attacks linked to CVE-2026-27540. According to their data, exploitation activity spiked in June and July, with a smaller surge in August. In most cases, hackers are uploading a webshell that conducts reconnaissance but can also introduce additional payloads.
Wordfence provides valuable insights into the tactics used by attackers, explaining how they submit a forged request to the wwlc_file_upload_handler AJAX action containing a malicious file with a .php extension. The uploaded shell.php is then used as a PHP webshell, which reports host details and allows the attacker to upload additional files.
Administrators are advised to take immediate action to protect their sites. Firstly, they should add the high-offender IP addresses provided by Wordfence to their blocklist to prevent further attacks. Secondly, they must upgrade to plugin version 2.0.3.2 or later, which patches the security issue. Finally, administrators should review their upload directories for any unexpected or recently created PHP files and examine logs for requests to /wp-admin/admin-ajax.php invoking wwlc_file_upload_handler.
In the worst-case scenario where a site has been compromised, restoration from a safe backup is recommended, as removing all persistence mechanisms, users, and backdoors can be complex. It’s essential that website owners prioritize security updates and regularly monitor their logs for suspicious activity to prevent such attacks in the future.
Source: Bleeping Computer — 2026-09-15