Affected Systems
WooCommerce Wholesale Lead Capture premium plugin for WordPress, versions 2.0.3.1 and older. CVE-2026-27540: unauthenticated arbitrary file upload vulnerability allowing PHP webshell deployment.
Exploitation Status
Active exploitation confirmed. Wordfence blocked over 100,000 attacks. Major attack waves observed June 4-17, July 1, and August 30, 2026. Attackers uploading PHP webshells for reconnaissance and additional payload delivery.
Business Impact
Complete site compromise possible. Attackers exploit unauthenticated AJAX action (wwlc_file_upload_handler) to bypass file extension allowlist and upload executable PHP files. Webshells enable host reconnaissance, file uploads, and persistent backdoor access. Patch available since February 20, 2026 (version 2.0.3.2), but widespread exploitation continues months later.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade WooCommerce Wholesale Lead Capture plugin to version 2.0.3.2 or later on all WordPress sites
- Search upload directories (wp-content/uploads) for unexpected PHP files, especially shell.php or recently created executables
- Review web server logs for POST requests to /wp-admin/admin-ajax.php with action=wwlc_file_upload_handler parameter
- Block high-offender IP addresses published by Wordfence (reference their advisory for current list)
- Audit WordPress administrator accounts for unknown or unauthorized users; remove any suspicious accounts
- If compromise confirmed, restore site from clean backup taken before February 2026 rather than attempting manual remediation