CVE-2026-27540 Explained: The WooCommerce Wholesale Lead Capture File Upload Flaw Under Active Attack

A file upload form meant for wholesale registration documents turned out to accept almost anything — including PHP web shells. Attackers have been exploiting it for months.

What happened

Wordfence says it has blocked more than 100,000 exploit attempts[1] targeting a critical flaw in Wholesale Lead Capture, a premium WooCommerce plugin used to collect and manage wholesale-registration applications. The plugin has roughly 6,000 active installations.[1] The vulnerability, tracked as CVE-2026-27540, doesn't require a username, a password, or any prior access to the site. It lives in a file-upload feature that was never supposed to accept executable code — and, because of a flaw in how it validated files, did anyway.

That's the short version. The longer version involves a public disclosure back in February, months of quiet probing, and then a sharp rise in real attack traffic once threat actors realized the door was still open on thousands of sites.

What is the vulnerability

The plugin exposes an AJAX action called wwlc_file_upload_handler, which handles file uploads submitted through its wholesale-registration form.[2] According to BleepingComputer's reporting[2], the handler is supposed to check uploaded files against a list of permitted extensions. The problem is where that list comes from: instead of pulling it from a trusted server-side setting, the handler reads it from a file_settings parameter supplied directly in the visitor's request.

That's the entire bug, really. If an attacker can control the list of "allowed" file types, they can simply add php to it. Submit a crafted request with a forged file_settings value and a file named something like shell.php, and the handler waves it through.[2] The issue is tracked in the CWE taxonomy as CWE-434, Unrestricted Upload of File with Dangerous Type, and it was assigned CVE-2026-27540, publicly disclosed on February 20, 2026, and added to Wordfence's vulnerability database five days later.[3]

Technical details

Wordfence's own writeup, cited by The Hacker News[1], describes the attack pattern it observed in the wild: "the attacker submits a request to the wwlc_file_upload_handler AJAX action containing a forged file_settings parameter and a malicious file with a .php extension." Once uploaded, the resulting file isn't just a static payload sitting on disk — it's a functioning PHP web shell. It reports basic host information back to whoever requests it, and it includes a browser-based upload form that lets the attacker write further files to the compromised site without needing to repeat the original exploit.[1]

Because the AJAX endpoint is unauthenticated by design — it has to be, since site visitors filling out a wholesale application aren't logged-in users — there's no account, role, or session cookie standing between an attacker and the upload handler. Wordfence's advisory record puts it plainly: the flaw makes it possible for unauthenticated attackers to upload arbitrary files[3] on the affected site's server, which can open the door to remote code execution once that file is reachable and executable through the webserver.

Worth flagging: a second, related CVE — CVE-2026-27542, a privilege-escalation issue in the same plugin — has a public proof-of-concept exploit script that combines both bugs, using the file-upload flaw to drop a shell and a separate role-injection technique to create a rogue administrator account. That PoC's existence is documented on exploit-tracking sites, though it isn't a vendor advisory, so treat it as evidence that working exploit code exists rather than as confirmation of how it's actually being used in the wild.

Affected products and versions

The vulnerability affects all versions of WooCommerce Wholesale Lead Capture up to and including 2.0.3.1.[3] The plugin is developed by Rymera Web Co Pty Ltd. and sold as a premium (paid) extension for WooCommerce-powered WordPress stores.

CVSS and severity

Multiple outlets, including The Hacker News and Cyber Security News, cite a CVSS score of 9.8 for this flaw.[1] It's worth being precise here rather than repeating a single number without context, because the sources don't all agree. Wordfence's own record, mirrored by Rapid7, lists a CVSS v2 vector of AV:N/AC:L/Au:N/C:C/I:C/A:C with a severity of 10. NVD's entry for the same CVE shows a different vector — AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H — which implies a somewhat higher attack complexity than the vendor's assessment. That's not necessarily a contradiction; different scoring authorities sometimes weigh attack complexity differently for the same underlying bug, and NVD's page for this CVE is flagged as not yet prioritized for full enrichment. Either way, every source agrees on the practical bottom line: this is a critical-severity, unauthenticated file upload flaw with a realistic path to remote code execution.

Exploitation status

This is not a theoretical bug sitting in a disclosure database. Wordfence's telemetry — the same firewall that protects a large share of WordPress sites — recorded genuine attack traffic. The company reported blocking over 100,000 exploit attempts since June 2026, including 99 attempts in a single 24-hour window as of the mid-September report.[1] BleepingComputer's reporting adds more granularity: exploitation activity spiked between June 4 and June 17, then again on July 1 and August 30.[4]

That pattern — a February disclosure followed by exploitation that doesn't pick up until June and then keeps recurring in bursts — is fairly typical for WordPress plugin vulnerabilities. Attackers often build and refine automated scanning tools weeks or months after a disclosure, then run them in waves against the pool of sites that haven't updated. It's worth being precise about terminology here too: this is confirmed, reported active exploitation based on firewall-blocked attack traffic, not merely a published proof of concept. That distinction matters, because plenty of vulnerabilities have PoC code available without ever seeing this volume of real-world attack attempts.

CISA KEV status

CISA's Known Exploited Vulnerabilities catalog could not be independently verified as listing CVE-2026-27540 during the research performed for this article. A third-party CVE aggregator (OpenCVE) marked the KEV field for this CVE as "No" at the time of writing, but that reflects a downstream mirror rather than a direct check of cisa.gov. Given how the KEV catalog is scoped — primarily toward vulnerabilities affecting products with meaningful federal-agency exposure — the absence of a KEV listing for a WordPress plugin extension is not unusual and shouldn't be read as evidence against active exploitation, which is separately well documented by Wordfence's own blocked-attack figures.

Who is affected

Any WordPress site running WooCommerce with the Wholesale Lead Capture plugin installed at version 2.0.3.1 or earlier is exposed. Because the plugin is a premium product rather than a free one distributed through the WordPress.org repository, some sites may not receive the same automatic-update prompts that free plugins get, which can mean vulnerable installations linger longer than they would otherwise.

Patch and mitigation

The vendor fixed the issue in version 2.0.3.2, released the same day the vulnerability was publicly disclosed — February 20, 2026.[4] The immediate fix is straightforward: update the plugin. But given that exploitation has been ongoing since June, an update alone isn't sufficient for a site that was vulnerable during that window.

What defenders should do

• Update WooCommerce Wholesale Lead Capture to version 2.0.3.2 or later immediately.
• Search the site's file system and uploads directories for unfamiliar PHP files, particularly anything resembling shell.php or files with unexpected names in upload-handler directories.
• Review WordPress user accounts for any unexpected administrator additions, given the related privilege-escalation issue (CVE-2026-27542) documented in public exploit tooling.
• Check server access logs for requests to the wwlc_file_upload_handler AJAX action, especially ones carrying an unusual file_settings parameter.
• If evidence of compromise is found, treat it as a full incident: rotate WordPress admin and database credentials, and consider a clean reinstall of core files rather than just deleting the shell.

Security takeaway

The mechanism behind CVE-2026-27540 is almost mundane, which is part of why it's dangerous. There's no exotic memory corruption or complicated exploit chain here — just a file-type allowlist that trusted a value the visitor was allowed to set. That kind of mistake is common in plugin ecosystems where upload features get bolted onto forms without a second look at who controls the validation logic. The bigger lesson for site owners running premium, non-repository plugins is that "the update is out" doesn't mean "the update happened." Months passed between the fix landing and the exploitation numbers climbing, which is exactly the gap attackers are counting on.

---

Sources & References

• [1] The Hacker News — "Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells" — Sep 16, 2026 — View source
• [2] BleepingComputer — "Hackers target WordPress sites via third-party WooCommerce plugin" — Sep 15, 2026 — View source
• [3] Wordfence Threat Intelligence / Rapid7 vulnerability mirror — "woocommerce-wholesale-lead-capture: CVE-2026-27540" — Published Feb 20, 2026 — View source
• [4] BleepingComputer — patch version and disclosure timeline detail — View source
• [5] NVD — CVE-2026-27540 Detail — View source

Disclaimer: Images in this article are original conceptual illustrations generated by UnpanicTech to aid understanding. They do not depict confirmed real-world compromise events and should be read as explanatory diagrams, not documentary evidence.