CTI · reported · 2026-09-15

WooCommerce Wholesale Lead Capture Plugin Actively Exploited

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1100 Web Shell Persistence
• T1059 Command and Scripting Interpreter Execution

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: WooCommerce Wholesale Lead Capture Unauthenticated File Upload
id: e5f6a7b8-9c0d-1e2f-3a4b-5c6d7e8f9a0b
status: experimental
description: Detects suspicious PHP file creation in WordPress upload directories consistent with exploitation of the WooCommerce Wholesale Lead Capture unauthenticated arbitrary file upload vulnerability.
references:
  - https://malware.news/woocommerce-wholesale-lead-capture-exploit
  - https://securityonline.info/woocommerce-plugin-rce
author: Tia N. List
date: 2026-09-15
tags:
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1100
logsource:
  category: file_event
  product: windows
detection:
  selection_wp_php_upload:
    TargetFilename|contains: '\wp-content\uploads\'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.php7'
  selection_wp_themes_upload:
    TargetFilename|contains:
      - '\wp-content\themes\'
      - '\wp-content\plugins\'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
  condition: selection_wp_php_upload or selection_wp_themes_upload
falsepositives:
  - Legitimate WordPress plugin or theme installation
  - WordPress content management operations
level: high

References

• https://malware.news/woocommerce-wholesale-lead-capture-exploit
• https://securityonline.info/woocommerce-plugin-rce