Attackers have been uploading PHP webshells to WordPress sites by exploiting a critical flaw in the third‑party WooCommerce plugin WooCommerce Wholesale Lead Capture, according to a technical write‑up published September 14. The vulnerability, disclosed and patched on February 20 in version 2.0.3.2, persisted in live sites and was actively probed and weaponized months after the fix became available.
Scale and timing of the exploitation attempts
Wordfence reported that its firewall blocked more than 100,000 exploitation attempts aimed at CVE-2026-27540. Exploit activity was heaviest between June 4 and June 17, with additional waves on July 1 and August 30. The plugin has an estimated 6,000 active installations, and all versions up to and including 2.0.3.1 are affected.
How an attacker-controlled allowlist turned file upload into RCE
The plugin exposes an unauthenticated AJAX action named wwlc_file_upload_handler that accepts uploads from the wholesale registration form. That handler performs an extension check against a list of permitted types — but critically, Wordfence found the list is read directly from the incoming request rather than from server‑side configuration. An unauthenticated attacker can therefore include php in a forged list of allowed types and bypass server controls.
The vulnerability is compounded by how the code calls WordPress's upload functionality: it disables WordPress's own type checking and leaves the extension whitelist as the only barrier. Wordfence observed attackers sending crafted requests that included a forged settings parameter plus a PHP file (often named shell.php). Successful uploads produced webshells that report host details and present a browser‑based file upload form, enabling the attacker to write further files to the compromised site.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadSeverity scores, single‑request exploitation, and the reporter
Wordfence rated the flaw CVSS 9.8. The CVE record, issued by Patchstack, carried a 9.0 score — a difference that, Patchstack noted, partly reflects a different judgment about how complex the attack is. Wordfence's data indicated the exploit can be executed with a single unauthenticated request. Researcher Teemu Saarentaus reported the flaw.
What Wordfence and Rymera Web Co must contend with
Rymera Web Co maintains the WooCommerce Wholesale Lead Capture plugin; the vendor released version 2.0.3.2 on February 20 to address the issue. Wordfence has implemented a firewall rule to block known exploit attempts, but explicitly cautioned that a firewall rule is not a substitute for applying the patch: "a firewall rule blocks known exploit attempts but does not patch the plugin, and all versions up to 2.0.3.1 remain vulnerable underneath." The persistence of probing months after the patch underscores that detection rules and signatures alone do not remove the underlying vulnerability from installed plugins.
What site owners should do
Wordfence advised site owners to update to version 2.0.3.2 or later. In addition, it recommended reviewing the uploads directory for unexpected or recently created PHP files and checking web server access logs for requests to admin-ajax.php carrying the wwlc_file_upload_handler action. Anyone finding evidence of compromise should remove unexpected files and unknown administrator accounts and review the site for backdoors. Wordfence also warned that an absence of matching log entries does not prove a site is clean.
How Wordfence, Rymera Web Co, and site owners are affected
- Wordfence: has deployed firewall rules and published analysis showing scale and tactics, but its own controls are presented as mitigation rather than remediation.
- Rymera Web Co: issued the patch in version 2.0.3.2 on February 20; their update remains the definitive fix for installations running vulnerable versions up to 2.0.3.1.
- Site owners and administrators: must both apply the vendor patch and perform forensic checks (uploads directory and admin-ajax.php logs) because blocked exploit attempts do not eliminate prior compromises or backdoors.
The technical chain here is stark and simple: an attacker‑controlled allowlist plus disabled WordPress type checks turned what should have been a constrained file upload into remote code execution. The remedy exists in an updated plugin release, yet the blocked but persistent exploitation attempts recorded by Wordfence show that patch publication and patch installation are distinct events — and that the latter remains the critical step for affected sites.
