Defiant’s Wordfence web application firewall blocked over 100,000 attacks tied to a single flaw, tracked as CVE-2026-27540, in a third‑party WooCommerce plugin — a striking tally that underscores how rapidly an unauthenticated file‑upload bug can be weaponized against WordPress sites.
The vulnerability: CVE-2026-27540 in WooCommerce Wholesale Lead Capture
The flaw affects the WooCommerce Wholesale Lead Capture premium plugin for WordPress, versions 2.0.3.1 and older. Security researcher Teemu Saarentaus discovered an unauthenticated arbitrary file‑upload vulnerability that permits attackers to upload PHP webshells and execute code, a condition the source describes as potentially leading to a complete site compromise. The plugin vendor released version 2.0.3.2 on February 20 to address the issue.
How attackers exploit wwlc_file_upload_handler
At the technical level, the vulnerability stems from an exposed, unauthenticated AJAX action named wwlc_file_upload_handler. That action checks file extensions against an allowlist supplied through a user‑controlled file_settings request parameter — effectively letting an attacker add “php” to the permitted file types so the plugin will accept executable PHP uploads. As Wordfence explains: “The attacker submits a request to the wwlc_file_upload_handler AJAX action containing a forged file_settings parameter and a malicious file with a .php extension.”
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadWhat the uploaded webshell does and observed attack cadence
Wordfence analyzed the malicious file commonly uploaded as shell.php. “The uploaded shell.php is a PHP webshell that reports host details and provides a browser‑based upload form for writing additional malicious files to the site,” the company wrote. That capability lets attackers conduct reconnaissance and then introduce follow‑on payloads or persistence mechanisms.
Defiant’s Wordfence recorded concentrated exploitation activity: spikes between June 4 and June 17, and additional bursts on July 1 and August 30. The company also supplied a set of high‑offender IP addresses that deployed tens of thousands of exploitation attempts and recommended administrators add those addresses to a blocklist.
Immediate mitigation steps administrators should take
- Upgrade the WooCommerce Wholesale Lead Capture plugin to version 2.0.3.2 or later — that release addresses CVE-2026-27540.
- Add the high‑offender IP addresses provided by Wordfence to local or perimeter blocklists, per the vendor recommendation.
- Search upload directories for unexpected or recently created PHP files — the presence of shell.php or similar files is a strong indicator of compromise.
- Examine server and application logs for requests to /wp-admin/admin-ajax.php that invoke wwlc_file_upload_handler.
- Remove unknown administrator accounts that may have been created following an upload and execution of a webshell.
- If compromise is confirmed, restore the website from a safe backup; Wordfence warns that “removing all persistence mechanisms, users, and backdoors may be complicated.”
What this means for technologists, site owners, and incident responders
- Technologists and security teams: patch immediately to 2.0.3.2 or later, ingest the high‑offender IP list from Wordfence where feasible, and hunt for webshell indicators such as shell.php and anomalous admin‑ajax.php requests.
- Site owners and administrators: prioritize locating unexpected PHP files in upload folders and verifying administrator accounts; if you find evidence of a webshell, plan a restore from a known good backup rather than attempting ad hoc cleanup.
- Incident responders: expect that attackers used uploaded webshells for reconnaissance and to stage additional payloads; because persistence mechanisms can be subtle, restoration from a safe backup is the recommended containment and remediation step.
The record in this case is straightforward: an unauthenticated AJAX action, a user‑controlled allowlist parameter, and an effective weaponization campaign that Wordfence counted in the six figures. The named next step for vulnerable WordPress sites is immediate patching to version 2.0.3.2 or later and an urgent search for uploaded PHP files and suspect admin activity. A concrete unanswered question remains: how many sites, despite the high number of blocked attempts, were fully compromised and required full restores?
Source: Bleeping Computer — Hackers target WordPress sites via third‑party WooCommerce plugin
