Cybersecurity vulnerabilities are a pressing concern for website owners and WordPress users alike. Recently, a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin has been identified, allowing attackers to exploit the system for unauthorized file uploads. This vulnerability, tracked as CVE-2026-27540, has a high severity rating with a CVSS score of 9.8. It affects all versions of the plugin up to and including 2.0.3.1, with over 6,000 active installations globally.
Details of the Vulnerability
The vulnerability arises from a lack of proper file type validation in an AJAX action named “wwlc_file_upload_handler.” This oversight enables unauthenticated attackers to upload arbitrary files, including potentially malicious PHP scripts capable of enabling remote code execution on targeted servers.
Wordfence, a prominent WordPress security company, reported that it has blocked over 100,000 exploit attempts targeting this flaw since June 2026. In a particularly concerning trend, 99 of these attack attempts were recorded within a mere 24-hour period, highlighting the urgency of addressing the issue before it leads to significant data breaches or system compromises.
How Attackers are Exploiting the Vulnerability
In observed attacks, threat actors have been utilizing crafted requests to exploit the “wwlc_file_upload_handler” AJAX action. These requests include a forged file_settings parameter that allows them to upload a malicious PHP file, commonly referred to as “shell.php.” This uploaded file serves as a web shell, designed to facilitate further malicious actions such as gaining access to sensitive server details and enabling the upload of additional harmful files.
Key IP addresses involved in these attacks include:
- 92.241.13.213
- 31.59.129.150
- 2a0f:85c1:840:5389::1
- 92.241.13.140
- 23.137.105.214
- 23.180.120.140
- 104.194.9.138
- 187.75.114.36
- 114.10.43.203
- 37.114.144.209
Mitigation Strategies
Website owners using the WooCommerce Wholesale Lead Capture plugin are urged to take immediate action in response to this vulnerability. Key recommendations include:
- Audit your WordPress site for unexpected or recently created .php files, particularly within the uploads directory.
- Review site logs for suspicious requests involving /wp-admin/admin-ajax.php with the action parameter set to wwlc_file_upload_handler.
- Consider disabling the plugin until a patch is released or the site can be updated to eliminate the risk.
What’s Next?
As the situation evolves, Wordfence continues to monitor attempts to exploit this vulnerability. Site owners are advised to stay informed by regularly checking for updates and patches to the WooCommerce Wholesale Lead Capture plugin. Ongoing vigilance in the face of emerging threats is essential for maintaining the integrity and security of WordPress websites.
For those interested in broader security issues, Wordfence has also reported on two critical flaws affecting the Events Calendar plugin, another popular WordPress tool. This is a reminder of the importance of keeping all plugins updated and being proactive in securing your digital assets.
In conclusion, the discovery of the WooCommerce Wholesale Lead Capture plugin’s vulnerability underscores the critical nature of cybersecurity within the WordPress ecosystem. As cyber threats continue to evolve, staying informed and taking precautionary measures can help protect sensitive data and maintain website integrity.
