Critical Unauthenticated File‑Upload Vulnerability (CVE‑2026‑27540) in WooCommerce Wholesale Lead Capture Plugin Enables WordPress Site Takeover
What Happened — Hackers are exploiting CVE‑2026‑27540, an unauthenticated arbitrary file‑upload flaw in the WooCommerce Wholesale Lead Capture premium plugin (versions ≤ 2.0.3.1). The vulnerability lets an attacker upload a PHP webshell via an AJAX endpoint, giving full control of the compromised WordPress site. Wordfence reports more than 100 000 attempted exploits since June 2026.
Why It Matters for Trust & Control Assurance —
- Continuous monitoring of third‑party components is essential; a single outdated plugin can invalidate an organization’s audit evidence.
- Timely patch management and documented remediation provide the defensible trail required across frameworks.
- Logging of file‑upload activity and WAF enforcement are core controls that demonstrate due diligence in a control‑assurance program.
Who Is Affected — E‑commerce operators, SaaS platforms, and any organization running WordPress sites that rely on the WooCommerce Wholesale Lead Capture plugin.
Recommended Actions — Upgrade to plugin version 2.0.3.2 or later, scan for unexpected PHP files, block malicious IPs, enforce WAF rules against unauthenticated uploads, and maintain a centralized, continuously‑updated inventory of all WordPress plugins. Source: https://www.bleepingcomputer.com/news/security/hackers-target-wordpress-sites-via-third-party-woocommerce-plugin/
Technical Notes — The flaw resides in the unauthenticated AJAX action wwlc_file_upload_handler, which improperly validates the file_settings parameter, allowing attackers to add “php” to the allowed extensions list. Exploitation results in remote code execution and full site compromise. Source: same article