“Wordfence said it has blocked over 100,000 exploit attempts targeting the vulnerability since June 2026.” That tally — and the steady stream of hits continuing through the last day — frames a pair of urgent security problems affecting popular WordPress plugins.
WooCommerce Wholesale Lead Capture: an arbitrary-file-upload hole in wwlc_file_upload_handler
WooCommerce Wholesale Lead Capture, a premium WordPress plugin with more than 6,000 active installs, contains a critical flaw tracked as CVE-2026-27540 (CVSS score: 9.8). Wordfence, the WordPress security company, reported that the issue is “a case of arbitrary file uploads due to missing file type validation in an AJAX action named 'wwlc_file_upload_handler' that impacts all versions of the plugin up to, and including, 2.0.3.1.”
The missing validation allows unauthenticated attackers to upload arbitrary files — including PHP backdoors — and thereby achieve remote code execution on affected sites. In observed attacks, threat actors submitted crafted requests to the AJAX action with a forged file_settings parameter and a malicious PHP file named “shell.php.”
Observed web shell behavior and concrete indicators
Wordfence’s analysis shows the uploaded file functions as a web shell: it reports host details and provides a browser-based upload form that can write additional malicious files to the compromised WordPress site. Because the successful exploit permits arbitrary PHP uploads, Wordfence advises site owners to check for unexpected or recently created .php files, mainly in the uploads directory.
Investigators should also review server logs for suspicious requests to /wp-admin/admin-ajax.php where the action parameter is set to wwlc_file_upload_handler. Wordfence lists attack attempts originating from the following addresses:
- 92.241.13.213
- 31.59.129.150
- 2a0f:85c1:840:5389::1
- 92.241.13.140
- 23.137.105.214
- 23.180.120.140
- 104.194.9.138
- 187.75.114.36
- 114.10.43.203
- 37.114.144.209
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWordfence telemetry: scale and cadence of exploitation attempts
Wordfence reports more than 100,000 exploit attempts against CVE-2026-27540 since June 2026, and recorded 99 attempts in the 24 hours prior to its bulletin. That volume underlines active, automated scanning and exploitation attempts in the wild against this particular file-upload flaw.
The Events Calendar: two distinct RCE chains, two CVEs, and fixes
Separately, Wordfence detailed two critical vulnerabilities in The Events Calendar plugin, installed on over 600,000 sites. Both require that the target event page have comments enabled and that the plugin option “Show comments on event pages” be active. The flaws are:
- CVE-2026-78159 (CVSS score: 9.8) — arising from insufficient validation of the widget 'classes' map in the parse_array function; affects versions <= 6.17.3 and can lead to unauthenticated remote code execution via PHP Object Injection.
- CVE-2026-78006 (CVSS score: 9.8) — arising from insufficient protection in the is_safe_widget_instance function; affects versions <= 6.17.4 and can lead to unauthenticated remote code execution through an alternate chain.
Wordfence described two separate exploitation chains: the first leverages PHP Object Injection to execute arbitrary operating-system commands; the second bypasses an object-injection guard and abuses an arbitrary-callable primitive to reset an administrator’s password, after which an attacker can upload a malicious plugin and take complete control of the site. Wordfence warned that both chains can be triggered through WordPress's pending-comment preview without moderator approval.
StellarWP, the plugin developer, addressed the flaws in versions 6.17.3.1 and 6.17.4.1 respectively.
What this means for WordPress site owners, StellarWP, and security teams
WordPress site owners: Inspect the uploads directory for unexpected .php files and search logs for requests to /wp-admin/admin-ajax.php?action=wwlc_file_upload_handler, paying particular attention to the IP addresses listed by Wordfence. Ensure that plugin versions do not remain at or below the affected releases (WooCommerce Wholesale Lead Capture ≤ 2.0.3.1; The Events Calendar ≤ 6.17.3 / ≤ 6.17.4 for the respective chains).
StellarWP and plugin maintainers: The Events Calendar fixes — released as 6.17.3.1 and 6.17.4.1 — demonstrate rapid patching for these severe chains; maintainers of other plugins should review AJAX upload handlers and widget-rendering code for missing validation or insufficient protection against object injection and arbitrary-callable abuse.
Security teams and defenders: Treat the WooCommerce Wholesale Lead Capture exploit as active and automated: Wordfence’s 100,000+ blocked attempts since June 2026 indicate broad scanning. Monitor for web-shell indicators and the listed attacker IPs, and consider blocking or otherwise mitigating traffic that matches the observed exploit patterns while sites are being patched.
Two separate plugin families, both widely installed, now carry the same consequence: an unauthenticated path to remote code execution unless sites are inspected and updated. The immediate task is concrete and procedural: find unwanted .php files, review the specific admin-ajax.php requests, verify plugin versions, and apply the fixes that StellarWP has released. For the sites that remain unpatched, the window for a complete takeover — as described by Wordfence — is open.
