CVE-2026-27540: Active Exploits Hit WooCommerce Lead Plugin

Attackers are actively exploiting CVE-2026-27540, a critical WooCommerce plugin vulnerability in WooCommerce Wholesale Lead Capture. The flaw lets unauthenticated attackers upload files with any extension to a vulnerable WordPress site. Security researcher Teemu Saarentaus discovered the arbitrary file upload issue, which affects plugin versions 2.0.3.1 and earlier.

Once inside, attackers drop a PHP web shell to run reconnaissance, harvest host details, and stage further payloads. Wordfence has blocked more than 100,000 exploitation attempts tied to this WordPress web shell campaign since June 2026.

This matters for any organization running WooCommerce for ecommerce, wholesale, or lead-generation workflows. A single unpatched plugin can hand attackers a foothold inside business-critical infrastructure.

How the exploit works

The wwlc_file_upload_handler AJAX action normally checks uploaded files against an allowlist of permitted extensions. That allowlist comes from a file_settings parameter that the request itself supplies, not from a server-side setting. An attacker simply adds “php” to the permitted list and submits a crafted upload request.

The plugin then accepts the file. Wordfence documented the resulting payload as shell.php, a PHP web shell with specific functions:

• Reports host and server details back to the attacker
• Provides a browser-based form for writing additional files to the site
• Enables follow-on reconnaissance and payload deployment

Vulnerability trackers classify the flaw as CWE-434, unrestricted upload of a file with a dangerous type. Severity ratings vary by source. Wordfence rates it 9.8, while the CVE record from Patchstack lists 9.0, a gap that partly reflects differing views on attack complexity.

Scale and timing of attacks

Rymera Web Co, the plugin vendor, patched the vulnerability in version 2.0.3.2 on February 20, 2026. Exploitation did not stop after the patch shipped. Wordfence reported exploitation spikes between June 4 and June 17, and again on July 1 and August 30.

The plugin has an estimated 6,000 active installations. Any site still running version 2.0.3.1 or earlier remains exposed to unauthenticated file upload attacks.

Indicators of compromise

Why this matters beyond the plugin itself

WordPress and WooCommerce sites often support customer portals, marketing funnels, and lead-generation forms. A compromised public site can become infrastructure attackers reuse for other purposes:

• Staging additional malware or tools for later use
• Hosting phishing pages under a trusted domain
• Harvesting credentials entered on the compromised site
• Serving as a pivot point toward connected business systems

None of these outcomes are confirmed in the current reporting. They represent the general risk a web shell introduces once attackers gain a foothold, not a claim about what happened at any specific site.

Featured resource

Cybersecurity kit

Download this cybersecurity kit for blueprints, frameworks, checklists, policy templates, and UEM security guides today.

DOWNLOAD

Containment and patch steps

• Update WooCommerce Wholesale Lead Capture to version 2.0.3.2 or later without delay
• Search upload directories for recently created or unfamiliar PHP files
• Review admin-ajax.php logs for requests targeting wwlc_file_upload_handler
• Audit administrator accounts and remove any that were not provisioned by IT

If compromise is confirmed, restore the site from a known-clean backup, since fully removing every persistence mechanism can be difficult to verify

Plugin patch management is separate from server or endpoint patching. Updating the WooCommerce plugin does not address vulnerabilities elsewhere in the hosting stack.

Conclusion

CVE-2026-27540 shows how one unpatched WordPress plugin can expose an entire site to unauthenticated compromise. Organizations running WooCommerce Wholesale Lead Capture should update to version 2.0.3.2 or later and check for the indicators above.

Plugin security deserves the same operational priority as any other internet-facing system. Delayed patching on a third-party plugin can carry the same consequences as delayed patching anywhere else.