Hackers are actively targeting WordPress sites that use the WooCommerce Wholesale Lead Capture premium plugin and can take over vulnerable servers by uploading malicious PHP files. The flaw, CVE-2026-27540, affects versions 2.0.3.1 and older and was fixed in version 2.0.3.2 on February 20. It is an unauthenticated arbitrary file-upload bug in the plugin’s wwlc_file_upload_handler AJAX endpoint, which lets attackers bypass file-type checks and upload webshells for remote code execution and persistence.
Why it matters: Sites using this plugin may already be compromised, and attackers do not need to log in to exploit the bug. Administrators should update to 2.0.3.2 or later immediately, check upload directories and logs for suspicious PHP files and wwlc_file_upload_handler requests, and consider full restoration from a clean backup if a webshell is found.
info@thehackernews.com (The Hacker News)
2026.09.16
98% relevant
This article appears to cover the same underlying event: active exploitation of the WooCommerce Wholesale Lead Capture plugin vulnerability to plant PHP web shells on affected WordPress sites.
Bill Toulas
2026.09.15
100% relevant
This article establishes a distinct story about active exploitation of CVE-2026-27540 in a specific third-party WooCommerce plugin, including attack volume, exploit details, and remediation guidance.
← Back to all stories