{"id":2888,"date":"2026-09-16T07:17:01","date_gmt":"2026-09-16T07:17:01","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2888"},"modified":"2026-09-16T07:17:01","modified_gmt":"2026-09-16T07:17:01","slug":"attackers-exploit-woocommerce-wholesale-lead-capture-flaw-to-plant-php-web-shells","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2888","title":{"rendered":"Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Sep 16, 2026<\/span><\/span>Vulnerability \/ Web Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Threat actors are exploiting a critical security flaw in WooCommerce Wholesale Lead Capture, a premium WordPress plugin that has more than 6,000 active installs.<\/p>\n

\u00abThis vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution,\u00bb Wordfence said<\/a>.<\/p>\n

The WordPress security company said it has blocked over 100,000 exploit attempts targeting the vulnerability since June 2026, with 99 of those attack attempts recorded over the past 24 hours. The vulnerability is tracked as CVE-2026-27540<\/strong> (CVSS score: 9.8).<\/p>\n

The issue is a case of arbitrary file uploads due to missing file type validation in an AJAX action named \u00abwwlc_file_upload_handler\u00bb that impacts all versions of the plugin up to, and including, 2.0.3.1. This opens the door for an unauthenticated attacker to upload arbitrary files on the affected site’s server, paving the way for remote code execution.<\/p>\n

In the attack observed by Wordfence, threat actors have been observed submitting crafted requests to the \u00abwwlc_file_upload_handler\u00bb AJAX action with a forged file_settings parameter and a malicious PHP file (\u00abshell.php\u00bb).<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The uploaded PHP file is a web shell that reports host details and offers a browser-based upload form for writing additional malicious files to the compromised WordPress site. Attack attempts have originated from the following IP addresses –<\/p>\n

<\/p>\n