Attackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress to upload PHP backdoors, according to Defiant, whose Wordfence web application firewall has blocked more than 100,000 attacks linked to the flaw. The vulnerability is tracked as CVE-2026-27540 and affects plugin versions 2.0.3.1 and older; it is an unauthenticated arbitrary file-upload flaw discovered by researcher Teemu Saarentaus and addressed in version 2.0.3.2, released on 20 February. The mechanism is a classic allowlist bypass: the plugin exposes an unauthenticated AJAX action named wwlc_file_upload_handler, which checks file extensions against an allowlist supplied through the user-controlled file_settings request parameter. Because the caller supplies the allowlist it is checked against, adding php to the permitted types makes the plugin accept executable PHP uploads. In the observed attacks the actor submits a forged file_settings parameter alongside a malicious .php file; the uploaded shell.php is a PHP webshell that reports host details and presents a browser-based upload form for writing further malicious files to the site. Wordfence reports exploitation activity spiked between 4 and 17 June, and again on 1 July and 30 August — a pattern of repeated automated waves rather than a single campaign, which is consistent with a published exploit being reused by multiple operators. The remediation guidance is unusually blunt about the limits of cleaning: after checking upload directories for unexpected or recently created PHP files, examining logs for requests to /wp-admin/admin-ajax.php invoking wwlc_file_upload_handler and removing unknown administrator accounts, Defiant advises that if compromise is confirmed the recommended action is to restore from a safe backup, because removing every persistence mechanism, user and backdoor from a compromised WordPress install is not reliably achievable. Wordfence has published a set of high-offender IP addresses responsible for tens of thousands of attempts. For Australian and New Zealand retail and e-commerce operators this is the same exploitation class the ACSC's standing CMS campaign alert describes, and the February patch date is the operative point: the fix has been available for seven months.

• Source article