Active Exploits Target WooCommerce Wholesale Lead Capture Plugin: The Patch Gap

Threat actors are actively exploiting CVE-2026-27540, an unauthenticated arbitrary file upload vulnerability in the WordPress WooCommerce Wholesale Lead Capture plugin. The patch has been available since February 20, 2026, yet Wordfence recorded over 100,000 blocked exploit attempts between June and September. The discrepancy between the fix release and hostile activity reveals a recurring pattern in the commercial WordPress plugin ecosystem.

How the Bypass Works: Trusting the Attacker with the Check

The vulnerability lies in how the plugin handles file uploads via the wwlc_file_upload_handler AJAX action. The check on permitted extensions does not rely on a trusted server-side configuration but reads the file_settings parameter sent in the user's HTTP request.

An attacker can forge this parameter to include php in the list of allowed types, thereby bypassing the extension filter. According to the vulnerable code cited in the Wordfence advisory, the plugin uses $_REQUEST['file_settings'] directly to determine which files to accept. This architecture turns the security mechanism into a bypass vehicle: the attacker defines the very rules meant to block them.

The payload observed in the wild is a shell.php file that, once uploaded, executes php_uname() to gather information on the host system and presents an HTML form for browser-based upload of additional files. The presence of this graphical interface in the web shell indicates a design geared toward persistence and subsequent expansion of the compromise.

"The Wordfence firewall has blocked over 100,000 exploit attempts" — Wordfence, via The Hacker News

Timeline and Attack Trajectory: Peaks Measured in 2026

Wordfence telemetry documents three main waves: June 4–17, July 1, and August 30. This temporal distribution suggests non-continuous but concentrated activity, possibly linked to automated scanning cycles or the refinement of exploit toolchains.

IP address 92.241.13.213 is the most active origin with over 24,900 blocked requests, followed by 31.59.129.150 with over 24,000, and IPv6 address 2a0f:85c1:840:5389::1 with over 16,000. This geographic and infrastructural concentration, while not permitting attribution to a specific group, indicates the activity is not sporadic but sustained by operators with resources and persistence in targeting.

The Hacker News reported 99 attempts in the 24 hours preceding September 16, 2026: the campaign is ongoing as of publication.

The Seven-Month Gap: Patch Available, Exploit Active

The flaw was discovered by researcher Teemu Saarentaus through the Patchstack Bug Bounty Program. The fix was distributed on February 20, 2026, with plugin version 2.0.3.2. Despite this, the first documented attack wave struck in June, four months after release.

This interval reproduces a structural dynamic of the WordPress ecosystem. The platform core benefits from consolidated automatic updates, but third-party plugins — especially commercial ones distributed outside the official wordpress.org repository — depend on manual notification and action flows by site administrators. The result is a population of vulnerable installations that remains exposed even after the patch is available, fueling targeting by threat actors.

For the roughly 6,000 sites using the plugin, the combination of e-commerce data (customer registrations, payment information, B2B price catalogs) and unauthenticated RCE access exposes them to risks of data theft, phishing infrastructure hosting, payment skimmer injection, or downstream supply-chain compromise toward end customers.

Immediate Actions

• Verify the installed version: update immediately to WooCommerce Wholesale Lead Capture 2.0.3.2 or later, the only version that fixes CVE-2026-27540.
• Inspect server logs: look for POST requests to the wwlc_file_upload_handler endpoint with anomalous file_settings parameters, particularly php extensions inserted into lists that normally expect only image formats.
• Search for suspicious files: locate any shell.php or undocumented PHP files in the plugin's upload directories, paying attention to timestamps between February and June 2026.
• Assess the pre-patch period: if the site ran vulnerable versions between February 20 and the actual update date, consider the possibility of prior compromise and proceed with forensic investigation rather than limiting remediation to applying the fix.

The WordPress Ecosystem and the Limit of Selective Auto-Updates

The Wholesale Lead Capture case exemplifies a technical and governance contradiction. The WordPress platform has implemented automatic update mechanisms for core over the years, but fragmentation in commercial plugin distribution channels leaves gaps open. When a component handles sensitive data and transactions — as in B2B e-commerce — the latency between patch availability and actual application becomes a risk parameter measurable in compromises.

No infrastructure overlaps emerge in the dossier linking active IPs to known threat groups, nor is systematic use of secondary payloads beyond the initial web shell documented. These limits do not reduce the severity of the vector: unauthenticated remote code execution on e-commerce platforms remains a priority attack surface for both opportunistic and targeted operators.

Frequently Asked Questions

My site is updated: am I safe?

Updating to 2.0.3.2 closes the vulnerability but does not remove any compromises that occurred in prior months. If the site ran vulnerable versions during the February–June 2026 window, the patch alone is insufficient to rule out persistence of unauthorized access.

Why does the CVSS score differ between sources?

The official CVE.org record assigns 9.0, while specialist outlets such as The Hacker News, GBHackers, and CyberSecurityNews report 9.8. Both values place the vulnerability in the critical band, but the discrepancy reflects possible differing assessments of the attack vector or conditional complexity. The official CVE.org vector specifies AC:H (high attack complexity), which may explain the more conservative score compared to initial estimates.

Is the plugin part of official WooCommerce?

No. WooCommerce Wholesale Lead Capture is a third-party extension developed by Rymera Web Co, not a component of the WooCommerce core or WordPress. The vulnerability does not affect installations that do not include this specific plugin.

Sources

• https://thehackernews.com/2026/09/attackers-exploit-woocommerce-wholesale.html
• https://www.bleepingcomputer.com/news/security/hackers-target-wordpress-sites-via-third-party-woocommerce-plugin/
• https://securityonline.info/woocommerce-wholesale-lead-capture-vulnerability/
• https://malware.news/t/attackers-actively-exploiting-critical-vulnerability-in-woocommerce-wholesale-lead-capture-plugin/125575
• https://the420.in/woocommerce-wholesale-lead-capture-cve-2026-27540-wordpress-attacks/
• https://cybersecuritynews.com/hackers-exploit-woocommerce-plugin/
• https://gbhackers.com/woocommerce-plugin-vulnerability/
• https://www.cve.org/CVERecord?id=CVE-2026-27540
• https://thehackernews.com/
• https://thehackernews.com/p/upcoming-hacker-news-webinars.html
• https://thehackernews.com/search/label/Threat%20Intelligence
• https://thehackernews.com/search/label/Vulnerability

Information verified against cited sources and current as of publication.

Sources