An unrestricted upload of a file with a dangerous type in the WooCommerce Wholesale Lead Capture plugin, allowing a malicious file to be placed on the host. NVD scores it 9.0 (Critical, CVSS 3.1).

Wordfence reported blocking roughly 100,000 attacks exploiting an unauthenticated upload flaw in this plugin class within days of disclosure, which is the pattern that matters here: WordPress plugin flaws with unauthenticated upload reach are weaponised at volume almost immediately, because scanning for vulnerable plugin versions is trivial and the payoff is direct code execution. The action is to confirm the plugin version on every WooCommerce site you own and remove unused plugins rather than merely update them — an unmaintained plugin with a public upload flaw is a standing invitation.

• NVD record — CVE-2026-27540