Critical WooCommerce Bug Lets Attackers Take Over WordPress Sites

Key Takeaways

• A critical vulnerability (CVE-2026-27540) in the WooCommerce Wholesale Lead Capture plugin is under active exploitation.
• Attackers can leverage a file upload flaw to execute arbitrary code on vulnerable WordPress sites without authentication.
• The vulnerability carries a CVSS score of 9.8 (Critical) and affects plugin versions up to 2.0.3.1.
• Over 100,000 exploit attempts have been blocked, targeting approximately 6,000 active sites using the extension.
• Immediate patching to version 2.0.3.2 and a thorough security review are essential for affected site owners.

Cybersecurity researchers have identified a critical vulnerability in a widely used WooCommerce extension that attackers are actively exploiting to gain unauthorized control over WordPress websites. The flaw, present in the Wholesale Lead Capture plugin, enables malicious actors to bypass authentication and upload executable code, leading to complete site compromise.

Designated as CVE-2026-27540, this vulnerability has been assigned a CVSS severity score of 9.8, indicating its critical nature. It impacts all versions of the Wholesale Lead Capture plugin up to and including 2.0.3.1. Exploiting this weakness allows an attacker to interact with an exposed file upload function, planting malicious code directly onto an unpatched web server. This means that an e-commerce platform could be compromised even before its legitimate owner logs in, highlighting the severity of the threat.

Security firm Wordfence has observed and reported extensive abuse of this vulnerability, blocking more than 100,000 exploit attempts. According to Wordfence said in a report, this malicious activity has been ongoing for several months, with significant spikes recorded between June 4 and June 17, and further surges on July 1 and August 30. Given that the affected extension is estimated to be active on approximately 6,000 websites, the potential scale of compromise is substantial.

A successful intrusion can have severe consequences, including the exposure of sensitive customer data, facilitation of payment fraud, or the transformation of a legitimate online store into a launchpad for further cyberattacks. This incident underscores the urgent need for site administrators to address unauthenticated vulnerabilities, a concern echoed by recent reports on flaws in other WordPress migration plugins.

Understanding the WooCommerce Plugin Vulnerability

The core of the vulnerability resides within the Wholesale Lead Capture plugin’s wholesale registration form, which permits users to upload files. The issue stems from the plugin’s file upload process, which validates allowed file types based on information supplied by the client’s request rather than relying on a secure, server-side configuration. This critical design flaw allows attackers to manipulate the list of acceptable file extensions.

By tampering with the file type validation, an attacker can trick the website into accepting a PHP file. Since PHP code is executable on a WordPress server, uploading such a file effectively creates a backdoor, granting the intruder remote access. From this foothold, attackers can execute commands, establish new administrator accounts, exfiltrate stored data, or implement persistent mechanisms to regain access later. This type of compromise mirrors the persistent risks associated with malicious WooCommerce site malware.

Crucially, exploiting this upload mechanism does not require any prior authentication or a WordPress account. The attacker merely needs to send a specially crafted request to the plugin’s public handler. The flawed upload logic also circumvents standard file-type checks, removing a fundamental security layer designed to prevent the execution of malicious files.

This vulnerability is not merely theoretical; observed attack payloads demonstrate sophisticated capabilities. The deployed web shells offer a browser-based interface for viewing host system details and uploading additional files, enabling attackers to escalate their privileges and deepen their access post-initial breach. Site owners should therefore treat any unexplained server modifications as a potential indication of compromise.

What You Should Do

• Update Immediately: Upgrade the Wholesale Lead Capture plugin to version 2.0.3.2 without delay.
• Inventory Plugins: Conduct a comprehensive inventory of all WordPress extensions across production and staging environments, noting current versions.
• Backup and Preserve: Ensure recent, tested backups exist. Before updating, consider preserving a copy of the affected site for forensic analysis if needed.
• Inspect for Intrusion:
  • Examine upload directories for any unexpected or recently created PHP files.
  • Review administrator accounts for any unfamiliar or unauthorized entries.
  • Scrutinize server logs for the attack patterns detailed in the Indicators of Compromise (IoCs) below.
• Remediate Compromise: If a compromise is confirmed, remove all malicious files, revoke unknown user accounts, reset privileged passwords, and search for any secondary backdoors.
• Monitor for Anomalies: For e-commerce sites, pay close attention to unusual changes on checkout pages, new scheduled tasks, or unexpected outbound network connections.
• Preserve Evidence: Before any cleanup, preserve logs and copies of suspicious files if an incident investigation may be required.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.