Reported by 6 outlets

Timeline

1. original reporting

   Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

   gbhackers.com · 28d ago · September 15th, 2026

   Threat actors are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin that lets unauthenticated attackers upload malicious PHP files and potentially seize full control of vulnerable WordPress sites. The vulnerability , tracked as CVE-2026-27540, affects plugin versions 2.0.3.1 and earlier and has received a CVSS severity score of 9.8 out of […] The post Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from malware.news

   Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin

   malware.news · 29d ago · September 14th, 2026

   On February 20th, 2026, a critical Unauthenticated Arbitrary File Upload vulnerability was publicly disclosed in WooCommerce Wholesale Lead Capture , a premium WordPress plugin with an estimated 6,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution. We added this vulnerability to the Wordfence Intelligence vulnerability database on February 25th, 2026. The Wordfence Firewall has already blocked over 100,000 exploit attempts targeting this vulnerability . Wordfence Premium , Wordfence Care , and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in WooCommerce Wholesale Lead Capture on February 27, 2026. Sites using the free version of Wordfence received the same protection 30 days later on March 29, 2026. Considering this vulnerability is being actively exploited, we urge users to ensure their sites are updated with the latest patched version of WooCommerce Wholesale Lead Capture, version 2.0.3.2 at the time of this writing, as soon as possible.

3. mentioned by securityonline.info

   Attackers are actively exploiting a critical WooCommerce Wholesale Lead Capture vulnerability. Patch WooCommerce Wholesale Lead Capture now.

   securityonline.info · 29d ago · September 15th, 2026

4. update from cyberpress.org

   WooCommerce Plugin Bug Lets Remote Attackers Create Admin Accounts and Take Over Sites

   cyberpress.org · 28d ago · September 15th, 2026

   The premium plugin, used by an estimated 6,000 websites, helps store owners build wholesale-registration forms and supports file uploads as part of the registration process. The vendor has addressed the flaw in version 2.0.3.2, and users are strongly advised to update immediately. According to Wordfence, its firewall has already blocked more than 100,000 exploitation attempts. Attackers have reportedly targeted the weakness for months, with heightened activity observed between June 4 and June 17, as well as on July 1 and August 30. WooCommerce Flaw Enables Site Takeover The issue is an unauthenticated arbitrary file-upload vulnerability. This means an attacker does not need a WordPress account or administrator access to attempt exploitation. WooCommerce Wholesale Lead Capture includes an AJAX upload handler called wwlc_file_upload_handler . WooCommerce Flaw Enables Site Takeover (Source: wordfence) The handler is intended to accept only approved file formats from visitors submitting wh

5. update from bleepingcomputer.com

   Hackers target WordPress sites via third-party WooCommerce plugin

   bleepingcomputer.com · 28d ago · September 15th, 2026

   It is an unauthenticated arbitrary file-upload vulnerability discovered by security researcher Teemu Saarentaus. An attacker can exploit it to upload PHP webshells and execute code, potentially leading to a complete site compromise. From a technical standpoint, the flaw is caused by exposing an unauthenticated AJAX action named wwlc_file_upload_handler, which checks file extensions against an allowlist supplied through the user-controlled file_settings request parameter. This allows adding ‘php’ to the permitted file types, making the plugin accept PHP executable file uploads. However, WordPress security company Defiant is warning that its Wordfence web application firewall blocked over 100,000 attacks linked to CVE-2026-27540. During the attacks, the hackers upload a webshell that conducts reconnaissance but can also introduce additional payloads.

6. mentioned by www.bleepingcomputer.com

   🤖 CVE-2026-27540: unauthenticated arbitrary file upload in the WooCommerce Wholesale Lead Capture plugin (≤ v2.0.3.1) lets attackers drop PH

   www.bleepingcomputer.com · 28d ago · September 15th, 2026

7. update from malware.news

   CVE-2026-27540 WooCommerce Flaw Exploited

   malware.news · 27d ago · September 16th, 2026

   What Is CVE-2026-27540? The vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type . Wordfence rates CVE-2026-27540 9.8, Critical , with a network-accessible attack vector requiring no authentication or user interaction. An attacker could upload executable PHP content to an affected server, potentially enabling remote code execution and site compromise.

8. update from www.bleepingcomputer.com

   Hackers target # WordPress sites via third-party # WooCommerce plugin https://www. bleepingcomputer.com/news/secu rity/hackers-target-wordpr

   www.bleepingcomputer.com · 27d ago · September 16th, 2026

   Hackers target # WordPress sites via third-party # WooCommerce plugin https://www.

9. update from dev.to

   WooCommerce Wholesale Lead Capture CVE-2026-27540: Arbitrary File Upload Leading to Web Shell Deployment # security # threatintel # software

   dev.to · 27d ago · September 16th, 2026

   WooCommerce Wholesale Lead Capture CVE-2026-27540: Arbitrary File Upload Leading to Web Shell Deployment # security # threatintel # software

   via Mastodon https://dev.to/anoymask/woocommerce-wholesale-lead-capture-cve-2026-27540-arbitrary-file-upload-leading-to-web-shell-g6a