Attackers are actively targeting a significant security flaw in the WooCommerce Wholesale Lead Capture plugin, a widely used premium plugin on WordPress, currently installed on over 6,000 websites. Wordfence, a prominent WordPress security firm, revealed that this vulnerability allows unauthorized users to upload arbitrary files, including PHP backdoors, enabling remote code execution. This vulnerability, identified as CVE-2026-27540 with a CVSS score of 9.8, has led to over 100,000 blocked exploit attempts since June 2026, with 99 attempts recorded just in the past 24 hours.
Understanding the WooCommerce Vulnerability
This vulnerability stems from the lack of file type validation in the ‘wwlc_file_upload_handler’ AJAX action of the plugin, affecting all versions up to and including 2.0.3.1. This flaw allows attackers to upload malicious files to the server of the affected site, leading to potential remote code execution. During observed attacks, threat actors have been using the ‘wwlc_file_upload_handler’ AJAX action to send crafted requests with a malicious PHP file, identified as ‘shell.php’.
This uploaded PHP file serves as a web shell, providing attackers with system details and a user interface for uploading additional malicious files. Wordfence has identified several IP addresses from which these attack attempts have been launched, suggesting a coordinated effort to exploit this vulnerability.
Preventive Measures for WordPress Site Owners
Due to the serious nature of this vulnerability, WordPress site owners using the WooCommerce Wholesale Lead Capture plugin are advised to vigilantly check for unexpected or newly created .php files, especially in the uploads directory. Additionally, they should scrutinize any suspicious requests to ‘/wp-admin/admin-ajax.php’ with the action parameter set to ‘wwlc_file_upload_handler’, originating from the identified IP addresses. Prompt action can mitigate the risks of having their sites compromised.
Related Vulnerabilities in The Events Calendar Plugin
In a related development, Wordfence reported critical flaws in The Events Calendar plugin, installed on over 600,000 sites. These vulnerabilities, tracked as CVE-2026-78159 and CVE-2026-78006, both with a CVSS score of 9.8, arise from insufficient validation and protection mechanisms. Exploiting these flaws allows attackers to execute remote code without authentication, potentially taking over the site. The vulnerabilities have been addressed in the latest plugin updates, versions 6.17.3.1 and 6.17.4.1.
Wordfence highlighted that these vulnerabilities could be exploited through WordPress’s pending-comment preview, leading to complete site control, data theft, and malware installation. Users of The Events Calendar plugin are strongly urged to update to the latest versions to protect their sites from these threats.
In conclusion, these incidents underscore the critical importance of maintaining updated plugins and being vigilant about security advisories to safeguard WordPress sites against emerging threats.
