CVE-2026-27540 is an unauthenticated arbitrary file upload vulnerability affecting WooCommerce Wholesale Lead Capture 2.0.3.1 and earlier. Severity scores range from 9.0 to 9.8 across vendors.
The flaw sits in the wwlc_file_upload_handler AJAX action, which trusts a user-controlled file_settings parameter to decide allowed file types. Attackers add PHP to that list.
Wordfence has blocked over 100,000 exploitation attempts since June 2026, with spikes in June, July, and August. Attackers upload PHP web shells for reconnaissance and follow-on payloads.
The vendor patched the flaw in version 2.0.3.2 on February 20, 2026. Administrators should update immediately and check for unauthorized files or admin accounts.
Attackers are actively exploiting CVE-2026-27540, a critical WooCommerce plugin vulnerability in WooCommerce Wholesale Lead Capture. The flaw lets unauthenticated attackers upload files with any extension to a vulnerable WordPress site. Security researcher Teemu Saarentaus discovered the arbitrary file upload issue, which affects plugin versions 2.0.3.1 and earlier.
Once inside, attackers drop a PHP web shell to run reconnaissance, harvest host details, and stage further payloads. Wordfence has blocked more than 100,000 exploitation attempts tied to this WordPress web shell campaign since June 2026.
This matters for any organization running WooCommerce for ecommerce, wholesale, or lead-generation workflows. A single unpatched plugin can hand attackers a foothold inside business-critical infrastructure.
The wwlc_file_upload_handler AJAX action normally checks uploaded files against an allowlist of permitted extensions. That allowlist comes from a file_settings parameter that the request itself supplies, not from a server-side setting. An attacker simply adds “php” to the permitted list and submits a crafted upload request.
The plugin then accepts the file. Wordfence documented the resulting payload as shell.php, a PHP web shell with specific functions:
Reports host and server details back to the attacker
Provides a browser-based form for writing additional files to the site
Enables follow-on reconnaissance and payload deployment
Vulnerability trackers classify the flaw as CWE-434, unrestricted upload of a file with a dangerous type. Severity ratings vary by source. Wordfence rates it 9.8, while the CVE record from Patchstack lists 9.0, a gap that partly reflects differing views on attack complexity.
Cybersecurity essentials for any organization
Guide to cybersecurity essentials, core functions, and organizational protection practices.
Scale and timing of attacks
Rymera Web Co, the plugin vendor, patched the vulnerability in version 2.0.3.2 on February 20, 2026. Exploitation did not stop after the patch shipped. Wordfence reported exploitation spikes between June 4 and June 17, and again on July 1 and August 30.
The plugin has an estimated 6,000 active installations. Any site still running version 2.0.3.1 or earlier remains exposed to unauthenticated file upload attacks.
Indicators of compromise
Indicator
Where to Check
Recommended Action
Unexpected PHP files (e.g., shell.php)
Plugin upload directories
Remove the file and investigate how it arrived
Requests invoking wwlc_file_upload_handler
admin-ajax.php access logs
Review source IPs and block confirmed malicious addresses
Unrecognized administrator accounts
WordPress user list
Remove the account and rotate admin credentials
Plugin version 2.0.3.1 or earlier
Plugin settings page
Update to version 2.0.3.2 or later immediately
Why this matters beyond the plugin itself
WordPress and WooCommerce sites often support customer portals, marketing funnels, and lead-generation forms. A compromised public site can become infrastructure attackers reuse for other purposes:
Harvesting credentials entered on the compromised site
Serving as a pivot point toward connected business systems
None of these outcomes are confirmed in the current reporting. They represent the general risk a web shell introduces once attackers gain a foothold, not a claim about what happened at any specific site.
Featured resource
Cybersecurity kit
Download this cybersecurity kit for blueprints, frameworks, checklists, policy templates, and UEM security guides today.
Update WooCommerce Wholesale Lead Capture to version 2.0.3.2 or later without delay
Search upload directories for recently created or unfamiliar PHP files
Review admin-ajax.php logs for requests targeting wwlc_file_upload_handler
Audit administrator accounts and remove any that were not provisioned by IT
If compromise is confirmed, restore the site from a known-clean backup, since fully removing every persistence mechanism can be difficult to verify
Plugin patch management is separate from server or endpoint patching. Updating the WooCommerce plugin does not address vulnerabilities elsewhere in the hosting stack.
FAQs
Is CVE-2026-27540 still being actively exploited?
Yes. Wordfence has blocked over 100,000 attack attempts since June 2026, with activity spikes in June, July, and August.
How can administrators tell if their site was compromised?
Check upload directories for unexpected PHP files and review admin-ajax.php logs for requests to wwlc_file_upload_handler. Also look for unrecognized administrator accounts.
What should administrators do if they find a web shell?
Wordfence recommends restoring the site from a clean backup. Removing every persistence mechanism and backdoor account individually can be difficult to verify.
Conclusion
CVE-2026-27540 shows how one unpatched WordPress plugin can expose an entire site to unauthenticated compromise. Organizations running WooCommerce Wholesale Lead Capture should update to version 2.0.3.2 or later and check for the indicators above.
Plugin security deserves the same operational priority as any other internet-facing system. Delayed patching on a third-party plugin can carry the same consequences as delayed patching anywhere else.
Stay ahead of active plugin exploits.
Get security briefings like this delivered to your inbox weekly.
A storyteller for practical people. Breaks down complicated topics into steps, trade-offs, and clear next actions—without the buzzword fog. Known to replace fluff with facts, sharpen the message, and keep things readable—politely.
