A critical vulnerability in a popular third-party plugin for WordPress has been exploited by hackers to upload malicious code and gain control over websites. The issue, tracked as CVE-2026-27540, affects versions 2.0.3.1 and older of the WooCommerce Wholesale Lead Capture premium plugin.
The flaw was discovered by security researcher Teemu Saarentaus and allows attackers to upload PHP webshells, which can execute code on the compromised site. This type of vulnerability is particularly concerning because it enables an attacker to gain complete control over a website, potentially leading to financial loss or reputational damage for the affected business.
From a technical standpoint, the issue arises from an unauthenticated AJAX action named wwlc_file_upload_handler, which checks file extensions against a list supplied through a user-controlled parameter. An attacker can exploit this weakness by adding ‘php’ to the permitted file types, allowing them to upload PHP executable files.
The vulnerability was addressed in version 2.0.3.2 of the WooCommerce Wholesale Lead Capture plugin, released on February 20. However, WordPress security company Defiant reports that its web application firewall, Wordfence, has blocked over 100,000 attacks linked to CVE-2026-27540. The firm notes that exploitation activity spiked between June 4 and June 17, and again on July 1 and August 30.
In most cases, the attackers upload a webshell that conducts reconnaissance but can also introduce additional payloads. Wordfence explains that the attacker submits a request to the wwlc_file_upload_handler AJAX action containing a forged file_settings parameter and a malicious file with a .php extension. The uploaded shell.php is a PHP webshell that reports host details and provides a browser-based upload form for writing additional malicious files to the site.
Administrators are advised to take immediate action to protect their websites. This includes upgrading to plugin version 2.0.3.2 or later, which addresses the security problem. Wordfence also recommends adding high-offender IP addresses to a blocklist and checking upload directories for unexpected or recently created PHP files.
If compromise is confirmed, it’s essential to restore the website from a safe backup as removing all persistence mechanisms, users, and backdoors may be complicated. The incident serves as a reminder of the importance of keeping software up-to-date, monitoring logs regularly, and staying informed about potential security threats in the WordPress ecosystem.
In conclusion, the recent exploitation of CVE-2026-27540 highlights the need for website administrators to remain vigilant and proactive when it comes to cybersecurity. Regularly updating plugins and monitoring system activity can help prevent such incidents from occurring.
Source: Bleeping Computer — 2026-09-15