Attackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress, enabling them to upload PHP backdoors to compromised sites. The flaw, identified as CVE-2026-27540, affects plugin versions 2.0.3.1 and older.
The vulnerability is an unauthenticated arbitrary file-upload issue that could lead to complete site compromise through remote code execution. Security researcher Teemu Saarentaus discovered the flaw.
The technical root of the vulnerability lies in the exposure of an unauthenticated AJAX action, `wwlc_file_upload_handler`. This action processes file uploads and checks file extensions against an allowlist. Crucially, the allowlist is supplied through a user-controlled request parameter, `file_settings`, which allows attackers to add `.php` to the permitted file types. This enables the plugin to accept executable PHP file uploads.
During attacks, threat actors submit a request to the `wwlc_file_upload_handler` AJAX action, including a forged `file_settings` parameter and a malicious file with a `.php` extension. The uploaded file, typically named `shell.php`, functions as a PHP webshell. This webshell can perform reconnaissance on the host and provides a browser-based upload form for writing additional malicious files to the compromised site.
The vulnerability was addressed in version 2.0.3.2 of the WooCommerce Wholesale Lead Capture plugin, which was released on February 20.
Despite the availability of a patch, a WordPress security company has reported blocking over 100,000 attacks related to CVE-2026-27540. Exploitation activity has shown significant spikes, particularly between June 4 and June 17, and again on July 1 and August 30.
Administrators of WordPress sites using the affected plugin are strongly advised to upgrade to version 2.0.3.2 or later immediately. Additionally, it is recommended to check upload directories for any unexpected or recently created PHP files and to examine logs for requests to `/wp-admin/admin-ajax.php` that invoke `wwlc_file_upload_handler`. Any unknown administrator accounts should also be removed.
If a compromise is confirmed, the recommended course of action is to restore the website from a safe backup. Attempting to manually remove all persistence mechanisms, malicious users, and backdoors can be complex and may not fully secure the site.
