Tag: cve 2026 27540
3 articles
WooCommerce Plugin Flaw Exploited to Upload PHP Webshells on WordPress Sites
Hackers have been actively exploiting a critical flaw in the WooCommerce Wholesale Lead Capture plugin to upload malicious PHP webshells to WordPress sites, despite a patch being available since February. Over 100,000 exploitation attempts were blocked by Wordfence's firewall, with multiple waves of attacks occurring over several months.
WordPress Plugin Flaw Exploited to Plant PHP Web Shells
A critical flaw in the popular WooCommerce Wholesale Lead Capture plugin has left over 6,000 active installs vulnerable to attacks, with over 100,000 exploit attempts blocked since June 2026. This urgent security issue allows hackers to upload malicious files, putting websites at risk.
Hackers Exploit WooCommerce Plugin to Upload PHP Backdoors on WordPress Sites
A single flaw in a third-party WooCommerce plugin has sparked over 100,000 attacks, allowing hackers to upload PHP backdoors and take control of WordPress sites - a stark reminder of the importance of keeping your plugins up to date!