Hackers are exploiting a critical flaw in a third-party WooCommerce plugin to upload PHP web shells and gain remote code execution on vulnerable WordPress sites.
The flaw, tracked as CVE-2026-27540, affects WooCommerce Wholesale Lead Capture version 2.0.3.1 and earlier. According to The Hacker News, Wordfence has blocked more than 100,000 exploit attempts since June, even though a patched version has been available since February.
Successful attacks can leave behind web shells that give intruders continued access to the compromised server.
How attackers turn an upload into remote code execution
Infosecurity Magazine reported that the vulnerability sits in an AJAX action called wwlc_file_upload_handler, which handles uploads from the plugin’s wholesale registration form and can be reached by unauthenticated visitors.
The publication noted that the handler checks a file’s extension against a list of permitted types supplied in the request itself rather than a trusted server-side configuration. An attacker can therefore add PHP to the allowed list. The plugin also calls WordPress’s upload function with file-type checking disabled, leaving the attacker-controlled extension check as the main barrier.
The Hacker News said attackers observed by Wordfence sent crafted requests containing a forged file_settings parameter and a malicious PHP file named shell.php. The resulting web shell reports host details and provides a browser-based form for uploading additional malicious files. The plugin has more than 6,000 active installations, according to the report.
Wordfence rated CVE-2026-27540 at CVSS 9.8. The Hacker News also noted that 99 exploit attempts had been recorded during the previous 24 hours when its report was published on Sept. 16.
Months-old patch has not stopped attacks
According to BleepingComputer, developer Rymera Web Co fixed the vulnerability in WooCommerce Wholesale Lead Capture version 2.0.3.2, released on Feb. 20. Wordfence nevertheless recorded its heaviest exploitation between June 4 and June 17, followed by additional activity on July 1 and Aug. 30.
The timeline means updating the plugin is only one part of the response. A web shell planted before the update can remain on the server after the vulnerable upload path is closed, so administrators who ran an affected version should also check whether attackers reached the site before it was patched.
What WordPress administrators should check now
BleepingComputer said administrators should upgrade WooCommerce Wholesale Lead Capture to version 2.0.3.2 or later. Wordfence also recommended several checks for sites that may have been exposed.
- Check upload directories for PHP files. Look for unexpected or recently created .php files, particularly in WordPress upload directories.
- Review server logs for exploit attempts. Look for requests to /wp-admin/admin-ajax.php with the action parameter set to wwlc_file_upload_handler.
- Search for signs of persistence. Remove unexpected files and unknown administrator accounts, and inspect the site for additional backdoors if evidence of compromise is found.
Infosecurity Magazine noted that the absence of matching entries in available logs does not necessarily mean a site was never compromised. A web application firewall can block known exploit attempts, but it does not patch the vulnerable plugin itself.
For sites that remained vulnerable after February, installing the update closes the original flaw, but it does not establish that the server is clean. Administrators should confirm both that the plugin is patched and that attackers did not leave another route back into the site.
For another WordPress plugin risk, read how CVE-2026-19949 leaves 3.25 million sites exposed through vulnerable versions of All-in-One WP Migration, with the flaw potentially leading to site compromise.