Affected Systems

WooCommerce Wholesale Lead Capture WordPress plugin, all versions up to and including 2.0.3.1. Approximately 6,000+ active installations. CVE-2026-27540 (CVSS 9.8) - arbitrary file upload due to missing validation in wwlc_file_upload_handler AJAX action.

Exploitation Status

Active exploitation confirmed. Wordfence has blocked over 100,000 exploit attempts since June 2026, with 99 attempts in the past 24 hours. Attackers are uploading PHP web shells (shell.php) to achieve remote code execution. Attack traffic originates from 10 known IP addresses.

Business Impact

Unauthenticated attackers can upload arbitrary PHP files to compromised WordPress sites, enabling full remote code execution, persistent backdoor access, and complete site takeover. No authentication required. Premium plugin with limited install base (6,000+) reduces overall exposure, but affected sites face immediate compromise risk. Patch status unclear from article.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately disable or uninstall WooCommerce Wholesale Lead Capture plugin version 2.0.3.1 and earlier until vendor releases patched version
  • Search WordPress uploads directory and all web-accessible directories for unexpected .php files, especially shell.php, created since June 2026
  • Review web server logs for POST requests to /wp-admin/admin-ajax.php with action parameter wwlc_file_upload_handler, particularly from IPs: 92.241.13.213, 31.59.129.150, 92.241.13.140, 23.137.105.214, 23.180.120.140, 104.194.9.138, 187.75.114.36, 114.10.43.203, 37.114.144.209
  • Block listed attacker IP addresses at firewall or WAF level if WooCommerce Wholesale Lead Capture is in use
  • If compromise suspected, perform full incident response including credential rotation, malware scan, and integrity verification of WordPress core and plugin files