Critical WooCommerce plugin flaw exploited to upload PHP backdoors

A critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress is being actively exploited, according to BleepingComputer. The flaw, tracked as CVE-2026-27540, affects plugin versions 2.0.3.1 and older. It is an unauthenticated arbitrary file-upload vulnerability discovered by security researcher Teemu Saarentaus. Attackers can upload PHP webshells and execute code, potentially leading to complete site compromise.

The technical cause is an exposed unauthenticated AJAX action named wwlc_file_upload_handler. That action checks file extensions against an allowlist supplied through the user-controlled file_settings request parameter. This allows an attacker to add ‘php’ to permitted file types, so the plugin accepts PHP executable file uploads. The vulnerability was addressed in version 2.0.3.2, released on February 20.

Wordfence, a WordPress security company, blocked over 100,000 attacks linked to CVE-2026-27540. Exploitation activity spiked between June 4 and June 17, and on July 1 and August 30. During attacks, hackers upload a webshell that conducts reconnaissance but can also introduce additional payloads. The uploaded shell.php reports host details and provides a browser-based upload form for writing additional malicious files to the site.

Administrators are recommended to add high-offender IP addresses provided by Wordfence to a blocklist and upgrade to plugin version 2.0.3.2 or later. Researchers advise checking upload directories for unexpected or recently created PHP files, examining logs for requests to /wp-admin/admin-ajax.php invoking wwlc_file_upload_handler, and removing unknown administrator accounts. If compromise is confirmed, the recommended action is to restore the website from a safe backup, as removing all persistence mechanisms, users, and backdoors may be complicated.